So I have a binary I've been tasked with exploiting. However, I need to have root privileges to execute a function in it that (hopefully) gives the password.
There is a function in the program that gives root privileges which I can run with a buffer overflow and pointing assigning the eip to the function's address. The problem is that the moment the program stops root privileges are then lost and the privileges
function does not take an input so there's no option of a second overflow.
So I need to overflow the buffer to execute the privilege function which I've done, but I was wondering if there is way to overwrite the eip "twice" so that the second function can be executed after?
Here's essentialy what I need to do in pseudocode form:
./binary $(<padding>*100 + <address of privilege function> + <way to overflow a second time to run next function>
Any tips or help here would be much appreciated.
file binary
ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), dynamically linked, interpreter /lib/ld-linux.so.2, for GNU/Linux 3.2.0, BuildID[sha1]=970d996e89b43d86654cbeace60920a8e0ea3c04, not stripped