0

So I hope I'm phrasing this right. I'm trying to exploit a piece of c code which you can see below.

#include <stdlib.h>
#include <unistd.h>
#include <stdio.h>
#include <string.h>

int user_age;
void secretClub(){
  if(user_age<18){
    printf("Come back when your old enough!!");
  }
  else{
    printf("Come on in.");
}
}

int main(){
  char name[30];
  user_age = 17;
  gets(name);
  printf("Hello there ");
  printf(name);
}

What I'm trying to do here is call the secretClub function and to print "Come on in". So I know if I wanted to just call the secretClub function, I could just overflow the buffer enough with the memory address of the function at the end. And I know that I can use this programs string format vulnerability to modify the variable's value in memory.

What I'm wondering is how to do both in one line? Sorry if this seems like a stupid and obvious question, upon searching I couldn't find much. Any guidance would be greatly appreciated!

Improve this question
5
  • 1
    What do you mean by "at the same time"? You can chain these vulnerabilities, e.g. exploit a buffer overflow allows you to call printf on an arbitrary string or write out of bounds of a buffer using a format string. In this case, this hardly seems necessary though, unless you need to write 0xa (\n) bytes onto the stack, which is not possible with just gets. In that case, you could abuse the format string vulnerability later to write those 0xa bytes.
    – plonk
    Nov 26, 2020 at 15:04
  • @plonk I just mean in one line. As in I was wondering if it's possible to write one input that changes the variable and then changes the return address so that it call secretClub? Or would I be better off just writing some shellcode to print the string?
    – Fiach ONeill
    Nov 26, 2020 at 15:16
  • @plonk would it be possible to just redirect with just a buffer overflow so the return address is pointing at theprintf("Come on in."); line in code?
    – Fiach ONeill
    Nov 26, 2020 at 15:26
  • Yes. There is no strict requirement that the overwritten return address needs to be at the beginning of the function, although some stack cleanup may be necessary to exit cleanly. The question of whether user_age can be set with just the buffer overflow depends on the stack layout imposed by the compiler. This is implementation-specific behaviour. Finally, using the buffer overflow to get arbitrary code execution may be possible using shellocde or ROP, depending on mitigations and ROP gadgets.
    – plonk
    Nov 26, 2020 at 23:37
  • "in one line" We usually write a script to do the exploitation (python with pwntools is popular) so you can always do everything in one line with python exploit.py
    – ChocolateOverflow
    May 7, 2021 at 6:44

1 Answer 1

Reset to default
0

Yes, you can certainly chain both of these together. For the most part, you can ignore the other exploit while working on the other; it will just affect your offsets.

Start by constructing your format string exploit at the beginning of your payload. Then, create padding from the end of that to where your buffer overflow offset is (e.g. if the needed offset is 40 bytes and your format string payload is 12 bytes, add padding of 28 bytes). After the overflow padding, add the address of secretClub.

It should look something like this (values are completely made up):

%5435325c$5%n + A*28 + secretClub

Note that user_age probably won't be on the stack since it's a global variable, so the necessary format string payload may be a little trickier than what I've illustrated.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .