-1

I am trying to overflow the buffer shown bellow, yet can never reach it. I know that the location of buf is before i and len, and in my case to overload the return instruction I need to amend the integer len. I know I need to fill in the buffer till I get to the len variable, but don't know how to avoid filling the i variable without screwing up the counter.

I've tried filling the input string with just a bunch of NOP but that automatically overflows the variable i with 0x909, when I try to change it and just fill it with numbers from 0 to 272 it makes it go into a loop and changes back to a number in the loop.

int function( char *input)
{
    char    buf[256];
    int i, len;

    if (strlen(input) > 272) {
         len = 272;
    } else {
        len = strlen(input);
    }
    for (i = 0; i <= len; i++) {
        buf[i] = arg[i];
    }
    return (0);
}

int
lab_main ( int argc, char *argv[] )
{
    foo ( argv[1] );
}
  • 2
    What architecture is this? What flags did you use to compile and what protections are enabled? – multithr3at3d Oct 4 at 11:17
0

EDIT: There is a bug in the code.

    for (i = 0; i <= len; i++) {
        buf[i] = arg[i];
    }

The variable arg is not defined, not sure how this would even compile. It should probably be input.


Try the following;

./a.out $(python -c "print 'A'*272")

I have not tried this myself, but it should overflow the return address on the stack. Since the buffer itself is 256 bytes, the two integers are 4 bytes each and the saved base pointer is 4 bytes. This gives us 256+4+4+4 = 268, which leaves 4 bytes for the return address. If you run the command you should see that you either corrupt a stack canary or overflow the return address and attempt to return to 0x41414141.

Actually getting arbitrary code execution after that is a different story, and depends entirely on the mitigations of the target system/binary file.

0

i and len would often be registers, and therefore unaffected by your memory copying. If they are in fact being loaded from (and stored to, in i's case) on every iteration, though, you just need to set the correct bytes in your input buffer such that the value that gets written to i is the one that should be written. Assuming you're on x86 or another little-endian system, you will write the least-significant to most-significant bytes, which makes it easy to make a small edit. Assuming you're running into i before len, you can probably just write a value to i that makes the loop skip ahead a few bytes to the part of len you want to overwrite, overwrite it, and then continue on to your saved return address or whatever else you're targeting. You could also overwrite i with the correct values until you get to the most significant byte, which you could then make negative; this will pass the loop condition but also likely send you quite far off in the address space, plausibly into kernel space (which will cause an exception). If len comes before i in the variables that get overwritten, you can put an immense value into len and then write a value into i that jumps to wherever you want to be, without it needing to be contiguous with or even close to the buffer.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.