I'm new to buffer overflows and I'm trying to understand exactly what I'm doing before using any premade and easy to go scripts.
My goal is to spawn a shell, so I found the asm code to do an execve("/bin/sh")
. The shellcode comes from shell-storm. :
char *shellcode = "\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69"
"\x6e\x89\xe3\x50\x53\x89\xe1\xb0\x0b\xcd\x80";
Going through tutorials and stack documentation, I understood that the stack goes downward (from high addresses to low addresses when we add data on it).
For now let's say that this shellcode is stored in a local buffer starting at 0x00
.
Will we have the shellcode stored like that :
0x00 31 c0 50 68 0x04 2f 2f 73 68 0x08 .....
meaning that in the stack it will looks like :
0x08 ..... 0x04 2f 2f 73 68 0x00 31 c0 50 68
When a
scanf("%d",myInt)
is performed I understand that if we give"9"
and that&myInt = 0x04
we will have0x04 : 09 00 00 00
. Means that the"09"
is at the address0x04
. Even if addresses are only accessible when they are a multiple of 4 and given that this is little endian.Now how does the
scanf
works with a%s
? Does he read chars four by four and store the first in the (little endian) lowest 0x04 address and the 4th in the0x07
?
So the real question is:
Considering that we usually reverse the address that we want to see taking the place of the stored IP. Should we do the same for our shellcode ?
When we want to overwrite the IP register in the stack by 0x01020304
we commonly write in our payload \x04\03\02\01
because we write in the stack upward, meaning that we hit the least significant bit of an address first.