Can't overwrite EIP in bufferoverflow example

Question

I am trying to make a simple buffer-overflow exploit on an example program to understand binary exploitation a bit better. The goal is to simple write shellcode on the stack and execute it. However, despite all the resources online, I keep running into weird problems that I can't figure out a solution for. I hope someone can clarify a couple of things for me :)

The following program is the target application:

#include <string.h>
#include <stdio.h>

int main (int argc, char** argv)
{
    char buffer[8];
    if (argv[1] == NULL) return 0;
    strcpy(buffer, argv[1]);
    printf("Text: %s\n", buffer);
    return 0;
}

To keep things simple, I disable a couple of protection mechanisms. The binary is compiled like so: gcc app.c -o app -z execstack -fno-stack-protector -m32. Also, ASLR is disabled for now: (/proc/sys/kernel/randomize_va_space == 0).

Furthermore, I am using gdb-peta, because from what I've heard its a bit nicer to work with, when doing binary exploitation.

Now, I am currently experiencing the following problem:

I can't seem to overwrite EIP, no matter how long the input string is:

Note how EIP always points to the return address of main? Why, it should be overwritten. Increasing the amount of A doesn't change anything. Also, even more weird is the fact ESP is never completly filled with A's either, it always ends up as 0x4141413d ('=AAA')

Since I can't seem to overwrite EIP correctly, I can't really continue.

Does anyone know why that happens and what I can do about that?

Answer 1

You're segfaulting because you have overflowed the buffer and in doing so managed to corrupt ESP. If you look at the error it says: Could not read memory at 0x4141413d and this is the value of ESP. So when it tries to execute the ret the stack is pointing to uninitialized memory causing the segfault. The reason why it's 0x3d and not 0x41 at the end is because its reduced ESP by 4 before trying to read a value from ESP. You could try using a shorter string of A and see if you are able to leave ESP intact.

Bufferoverflows in main() tends to be a little more messy and unreliable as they only trigger once the program is finished (main returns) as opposed to while the program is running. For learning you'll usually want to trigger the overflow in a function so it will trigger when it returns, something like this:

#include <string.h>
#include <stdio.h>

void hello(char* name) {
    char buffer[8];
    strcpy(buffer, name);
    printf("Hello %s\n", buffer);
}

int main (int argc, char** argv)
{
    if (argv[1] == NULL) return 0;
    hello(argv[1]);
    return 0;
}

Good luck!