Return address incorrect (buffer overflow)

Question

I'm trying to exploit the following code with a buffer overflow to get a shell:

int main()
{
    char str[64]

    gets(str);
    return(0);
}

The platform is Ubuntu 64 bit, arch i686.

The program is segfaulting on the 76th byte. Next four bytes are the return address.

But when i implement a x86_64 execveat("/bin//sh") 29 bytes shellcode the return address is not correct and the shell doesn't spawn.

The return address :

Have you any tracks ?

Answer 1

Since you are using gdb, set some breakpoints before main returns. Try executing step by step. Notice how 0x39783039 came to be the return address and see where it came from. Getting familiar with your tool will help you tremendously.

In this case, you have a typo in your python script which is sending "x90" repeatedly instead of NOPs. So, it is three times as long as you expected. Thus, the intended NOP sled is still overrunning right through the return address.

Remember that 0x39783039 is "90x9" when unpacked in ascii.