0

I am trying to complete a buffer overflow challenge. The code I am trying to exploit is below. I can only use the command line in a Linux environment.

I understand that writing more than 100 characters into "userString" will start to overwrite "command". My guess is that I need to somehow overwrite command with "/bin/sh" to launch into shell. I don't know exactly how to do that.

I've tried exceeding the input buffer to see what happens and I get this error:

sh: -c: line 0: unexpected EOF while looking for matching `"'
sh: -c: line 1: syntax error: unexpected end of file 
Segmentation fault

Here is the code:

#include <stdlib.h>
#include <stdio.h>
    int main() {
        char command[100];
        char userString[100];
        printf("Input a string to echo: ");
        gets(userString);
        snprintf(command, sizeof(command), "echo \"%s\"", userString);
        setresuid(502,502,502);
        system(command);
        return 0;
    }

1 Answer 1

1

You don't need to do any exploitation of the C part, and it wouldn't help anyway (at least, just filling command wouldn't help). Whether overflowing userString will fill command depends on the order in which the compiler places the two variables. Even if userString is first, the snprintf call will overwrite command anyway.

The program runs echo "%s" where %s is the string you type. It's easy to make this run arbitrary code. One way is to insert a closing quote:

"; cat /secret; echo "

Another way, since these are double quotes, is to use a command substitution:

$(cat /secret)
2
  • Thank you for your answer! I don't understand how to use those commands to launch me into a shell. Can you explain a bit more, please? Commented Aug 12, 2021 at 18:06
  • @TravisTaylor The system function is what launches you into a shell. What I show in my answer is what to pass as input to the program so that the shell executes something useful. I took cat /secret as an example. If you want a shell where you can type more commands, you can replace that by bash, for example. Commented Aug 12, 2021 at 19:47

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .