0

I am trying to make a simple buffer-overflow exploit on an example program to understand binary exploitation a bit better. The goal is to simple write shellcode on the stack and execute it. However, despite all the resources online, I keep running into weird problems that I can't figure out a solution for. I hope someone can clarify a couple of things for me :)

The following program is the target application:

#include <string.h>
#include <stdio.h>

int main (int argc, char** argv)
{
    char buffer[8];
    if (argv[1] == NULL) return 0;
    strcpy(buffer, argv[1]);
    printf("Text: %s\n", buffer);
    return 0;
}

To keep things simple, I disable a couple of protection mechanisms. The binary is compiled like so: gcc app.c -o app -z execstack -fno-stack-protector -m32. Also, ASLR is disabled for now: (/proc/sys/kernel/randomize_va_space == 0).

Furthermore, I am using gdb-peta, because from what I've heard its a bit nicer to work with, when doing binary exploitation.

Now, I am currently experiencing the following problem:

I can't seem to overwrite EIP, no matter how long the input string is:

Note how EIP always points to the return address of main? Why, it should be overwritten. Increasing the amount of A doesn't change anything. Also, even more weird is the fact ESP is never completly filled with A's either, it always ends up as 0x4141413d ('=AAA')

Since I can't seem to overwrite EIP correctly, I can't really continue.

Does anyone know why that happens and what I can do about that?

1 Answer 1

0

You're segfaulting because you have overflowed the buffer and in doing so managed to corrupt ESP. If you look at the error it says: Could not read memory at 0x4141413d and this is the value of ESP. So when it tries to execute the ret the stack is pointing to uninitialized memory causing the segfault. The reason why it's 0x3d and not 0x41 at the end is because its reduced ESP by 4 before trying to read a value from ESP. You could try using a shorter string of A and see if you are able to leave ESP intact.

Bufferoverflows in main() tends to be a little more messy and unreliable as they only trigger once the program is finished (main returns) as opposed to while the program is running. For learning you'll usually want to trigger the overflow in a function so it will trigger when it returns, something like this:

#include <string.h>
#include <stdio.h>

void hello(char* name) {
    char buffer[8];
    strcpy(buffer, name);
    printf("Hello %s\n", buffer);
}

int main (int argc, char** argv)
{
    if (argv[1] == NULL) return 0;
    hello(argv[1]);
    return 0;
}

Good luck!

3
  • I guess this might be a naïve question, but why would the stack buffer overflow corrupt ESP though?
    – nobody
    Jan 24 at 6:34
  • Most likely from the function epilogue moving ebp into esp, see stackoverflow.com/questions/38648731/…. I highly recommend learning about stack frames to aid you in stack based exploitation techniques like ret2libc and rop.
    – wireghoul
    Jan 24 at 22:05
  • Well, isn't the ebp moved into esp before ebp is popped off the stack? If so, wouldn't that mean ebp hasn't been corrupted yet when it is copied into esp?
    – nobody
    Jan 24 at 22:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.