1
struct record {
char name[24];
char * message;
};

int main() {
puts("GOT Overwrite");

// Create the struct record
struct record student;
strcpy(student.name, "Alice");
student.message = (char *) malloc(sizeof(char) * 24);
strcpy(student.message, "hello world");
printf("Message from %s: (%s)\n", student.name, student.message);

// Read some user data
// Could leak the memory at student.message
read(0, student.name, 28);
printf("Message from %s: (%s)\n", student.name, student.message);

// Overwrite the message
// Could allow arbitary write at student.message
read(0, student.message, 4);
printf("Message from %s: (%s)\n", student.name, student.message);

// Print the name again
// The address of puts could have been changed to system
// and student.name could be "/bin/sh"
puts(student.name);
}

What I want to do is overflow the student.name pointer, and push an address into student.message. But the thing is, the the read function prevents me from writing an address in the form of '\xef\xbe\xad\xde' into the student.message. How do I format/place the address into the student.message pointer after filling the student.name with padding?

Thanks

1
  • Use a pipe to feed data into the stdin of the program?
    – wireghoul
    Commented Feb 18, 2020 at 18:26

1 Answer 1

1

I'm assuming this is from a GOT hijacking homework assignment that uses Python Pwntools.

If you look on line 24, you'll see that the read instruction reads 28 bytes even though student.name is only 24 bytes. Record is a struct, and as such, student.name and student.message are right next to each other in memory. This means that if you overflow student.name in line 24, you can overwrite student.message.

Essentially, try inputting 24 bytes of garbage (like 24 A's), and then input your address (which I'm assuming is the address of puts you got off-line). Manually inputting may not work if read includes the new line character at the end, so instead input using a script. Perhaps something like:

from pwn import *

def main():
    p = process('./a.out')
    command = 'A'* 24 + '\xef\xbe\xad\xde'
    p.send(command)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .