1

Code:

#include <string.h>

void vuln(char *arg) {
    char buffer[10];
    strcpy(buffer, arg);
}  

int main( int argc, char** argv ) {
    vuln(argv[1]);
    return 0; 
}

I've determined I can input a buffer of 26 total characters to overwrite EIP. In gdb the address of

system():                      0xb7e41b40
"/bin/bash" portion of $SHELL: 0xbffffdac 

if I run

run $(python -c "print ('a' * 22) + '\x40\x1b\xe4\xb7'+'FAKE'+'\xac\xfd\xff\xbf'")

in gdb it will drop me into a shell. Unfortunately this doesn't work in the shell due to ASLR. GDB tells me that strcpy is at 0xb7e7c750 which has an offset of 0x3AC10 from system(). What I'm thinking is if I can somehow store the address of strcpy at runtime and use the offset (and the offset to the string) I can get it to run system("/bin/bash") which is essentially what I'm doing in gdb without the ASLR.

Any tips or directions towards applicable documentation would be greatly appreciated. I'm trying to successfully exploit the bug without disabling any security measures.

Currently there's ASLR , PIE, ASCII Armor, NX (I'm assuming), and SSP (this is also assumed). I'm on Debian 9 stretch. Thank you!

2

Because you're not saying anything about RelRO, I'm assuming no RelRO (so no leaking of the address of strcpy because it isn't called yet). Yet, this doesn't matter much, here's why:

You say PIE is enabled, which in combination with ASLR will randomize the location of the binary in memory and thus the location of the PLT and GOT. Hence you cannot leak from the PLT or GOT because the locations are unknown.

There's a silver lining tho: You didn't say anything about the bitness. ASLR (and PIE) can be brute forced on 32 bit systems.

If you are on a 64 bit system, you are out of luck: The program is obviously designed to teach you the basics of binary exploitation and those are (successfully) mitigated by ASLR, PIE, NX and stack canaries.

If you want to learn the basics, you should deactivate the security features that mitigate those basic exploit techniques.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.