Overwrite eip twice for buffer overflow?

Question

So I have a binary I've been tasked with exploiting. However, I need to have root privileges to execute a function in it that (hopefully) gives the password.

There is a function in the program that gives root privileges which I can run with a buffer overflow and pointing assigning the eip to the function's address. The problem is that the moment the program stops root privileges are then lost and the privileges function does not take an input so there's no option of a second overflow.

So I need to overflow the buffer to execute the privilege function which I've done, but I was wondering if there is way to overwrite the eip "twice" so that the second function can be executed after?

Here's essentialy what I need to do in pseudocode form:

./binary $(<padding>*100 + <address of privilege function> + <way to overflow a second time to run next function>

Any tips or help here would be much appreciated.

Answer 1

Keep in mind with an overflow that you are not just "overwriting EIP", you control the stack completely. This then allows you to ensure the next return address on the stack is whatever you want. It only ends up in EIP when it is time to execute it. This is important to understand.

When you redirect control flow to a different function using the overflow, where does that newly called function look for a return address when it's done? Again, the stack!

Using this knowledge plus the proper calling conventions for the program's architecture, we can shape the stack to chain together multiple functions. This is a basic example of ROP (return oriented programming).

For an x86 Linux binary, this is how the stack needs to look regarding calling functions, from lower addresses to higher addresses (in the order you'd overflow):

<function_to_call_addr> <next_return_addr> <arguments_for_function>... <function_to_call_addr> <next_return_addr> <arguments_for_function>... ...

Now, you don't always need to call functions. You can also return to "ROP gadgets"; usually one or more useful instructions followed by a ret. However, if you are not passing any arguments, you shouldn't need to worry about cleaning up the stack or anything. Therefore, your payload should look like:

overflow + privileges + password + AAAA

This calls the privilege function, and tells it that the next return address is the address of password. The next address doesn't matter, since hopefully you've gotten what you've wanted. To be complete, you could change it to resume normal execution of the program.

Let me know if this is wrong. I mostly work with x64 Linux these days so my x86 is a bit rusty.

Answer 2

run it as a service binary, possible side by side, and network socket connect, and pass the data results or memory address with correct API system OS permissions.

the service binary would need to be crafted