0

Maybe is a silly question but I can't understand exactly why this type of buffer overflow does not work...

Let's me explain with an example.

Suppose we have a program written in c. This program has 2 function , normal() and special(). In main function we have a pointer which points in address of normal function. Also it has an array we 5 bytes which we fill using gets and after that we Call the pointer which has the address of normal () . Our goal is to perform buffer overflow which overwrite the content of the pointer with the address of function special.

So when I write a python script like python-c " A*5 + <address_of_special> " | myprogram I successfully perform an buffer overflow calling the special function.

However, when I try to run the program without the script, for example ./myprogram AAAAA + address_of_special I get segmentation fault and the program crash.

Why this happens ; I mean the program gets the same input but I have different results ...

Improve this question
1
  • 1
    It's not the same input. Passing data thru a pipe is not the same as passing as an argument.
    – ThoriumBR
    Commented Dec 10, 2021 at 1:49

1 Answer 1

Reset to default
0

Your first example is passing data to the programs stdin pipe, which is what gets reads from. The second example is passing the data as a parameter (which gets stored in the argv parameter of main, if there is one), and gets will fail to read anything (unless you type some stuff while the program is running).

You absolutely can perform the buffer overflow directly from the shell. One option is to use the printf shell command, which works similarly to the C function of the same name, and then pipe that to the the program: printf 'AAAAA\xB1\xB2\xB3\xB4' | myprogram will feed the ASCII string "AAAAA" followed by four bytes (in little-endian, 0xB4B3B2B1), which you'd make the address of special, to your program just the same as Python does. Another option (for Bash and things like it) is to store the exact string you want to send (which may include unprintable characters!) either in a string, file, or variable, and then do myprogram <<< 'AAAAA&,´æ (or similar), myprogram << filename, or myprogram <<< $variable, respectively (each of those also causes the shell to feed some data to the program's stdin).

Improve this answer
2
  • Thank you very much for you response , I appreciate it. If I try to put the input through gets, when the program is running , why I have the same error ; For example , if I run the program and after I type in gets --> AAAAA\x11\x11\x11\x11 I get segmentation fault.
    – NeCro
    Commented Dec 10, 2021 at 14:04
  • That's because your program is receiving the binary value for ASCII literal backslashes, x characters, and 1s. You have to either pass the desired binary values directly to the program (typically, though not always, by first decoding them through a command like printf), or you need to decode the escape sequences in your C code (there's probably a safer way to do this than sprintf but hey, it's not like your program is going to get a lot less secure). Of course, you might have trouble calling a formatting function on a buffer that has already overflowed.
    – CBHacking
    Commented Dec 11, 2021 at 0:53

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .