Exploting a Stack Buffer Overflow vulnerability to get privilege access to system

Question

I am trying to complete a buffer overflow challenge. The code I am trying to exploit is below. I can only use the command line in a Linux environment.

I understand that writing more than 100 characters into "userString" will start to overwrite "command". My guess is that I need to somehow overwrite command with "/bin/sh" to launch into shell. I don't know exactly how to do that.

I've tried exceeding the input buffer to see what happens and I get this error:

sh: -c: line 0: unexpected EOF while looking for matching `"'
sh: -c: line 1: syntax error: unexpected end of file 
Segmentation fault

Here is the code:

#include <stdlib.h>
#include <stdio.h>
    int main() {
        char command[100];
        char userString[100];
        printf("Input a string to echo: ");
        gets(userString);
        snprintf(command, sizeof(command), "echo \"%s\"", userString);
        setresuid(502,502,502);
        system(command);
        return 0;
    }

Answer 1

You don't need to do any exploitation of the C part, and it wouldn't help anyway (at least, just filling command wouldn't help). Whether overflowing userString will fill command depends on the order in which the compiler places the two variables. Even if userString is first, the snprintf call will overwrite command anyway.

The program runs echo "%s" where %s is the string you type. It's easy to make this run arbitrary code. One way is to insert a closing quote:

"; cat /secret; echo "

Another way, since these are double quotes, is to use a command substitution:

$(cat /secret)