0

I am reading the PWK course book, the chapter of Linux Buffer Overflow:

Once the crossfire application is running, we can use the following Proof of Concept (PoC) code, found on the Exploit Database to crash the application.

...
crash="\x41" * 4379
buffer = "\x11(setup sound " + crash + "\x90\x00#"
...
s.send(buffer)

Once we run this script, the debugger spits out the following error message, which clearly indicates a buffer overflow condition in the setup sound command:

Then a window popup shows "... segmentation fault. The address 0x41414141 cannot be accessed". This is the expected result, because EIP has been overwritten by \x41\x41\x41\x41.

My question:

I understand those buffer overflow, EIP stuff. My question is just about this special string before \x41\x41...\x41:

"\x11(setup sound

What is this means? What means setup sound command?

1

According to https://vuldb.com/?id.29211 there is a memory corruption in the function setup of request.c. While I'm not familiar with the full details of the vulnerability, the exploit connects to a socket so it is presumably part of the networking protocol. The \x11setup sound string is likely the syntax that causes the server to invoke the setup function in request.c if you cannot cause the code execution to enter the vulnerable function then you cannot trigger the vulnerability.

You usually see a semblance of correct syntax in network protocol and file based exploits for this reason. This exploit for example, contains several FTP syntax commands to reach the vulnerable function: https://github.com/wireghoul/sploit-dev/blob/master/freeFTPD-bof.pl

| improve this answer | |
  • i understand your 1st paragraph already. In the link of your 2nd paragraph, the vulnerable function is "egghunter"? – TJCLK Jan 30 at 6:37
  • No, an egg Hunter is an exploitation technique for overcoming small shell code byte space. I never did root cause analysis on the freeftpd vulnerability, I just popped shell and moved on. If I had to guess it would be in a function related to "receive password" or "authenticate" as the overflow string is the supplied password for a username. I included it as an example of why you may often see text that isn't part of the "exploit code" in exploits, such as initiating a login session and supplying a username to make the server enter a state where the vulnerable function is called. – wireghoul Jan 30 at 7:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.