2

I'm learning some hacking with Erickson's "The Art of Explotation". To try out the exploits myself, I'm using C on a virtual maching with 32-bit Debian on my windows laptop (in VirtualBox).

Many of the exploits rely on overwriting pointers with address via an overflow (i.e., using something like "\x32\xbf\xcf\x12" as input to a string). However, on my machine many of the relevant addresses (of variables on the stack or function pointers) contain zeros, which terminates the string and the exploit fails.

Is there a way avoid zeros in important addresses?
Maybe by changing the setup of the virtual machine or the Linux?

I've found some questions regarding this problem here and here, where the solution was to use a 32-bit architecture. However, I already use one. Is this a problem of using a virtual machine?

Improve this question
3
  • 1
    Are you compiling code with C#? With managed code your variables will contain zeros. Instead, try to compile some native tool with plain C and gcc, enable optimization (like -O3) and uninitialized vars on stack will contain garbage
    – user996142
    Commented Jan 27, 2022 at 14:23
  • Sorry, that was a typo. I'm using C and compile with gcc. I will try the -O3 option and see if it helps. Thanks!
    – Cream
    Commented Jan 27, 2022 at 14:43
  • @user996142 Using the flag -O3 didn't change the position of the stack. In case that wasn't clear: My problem is not that the uninitialized variables contain zeros. My problem is that the addresses (of the variables) are so far up in the stack that they start with zeros, like 0x0046a02c. This is problematic if you want to write them into other pointers using an overflow, because they terminate the string.
    – Cream
    Commented Jan 27, 2022 at 15:07

1 Answer 1

Reset to default
1

What changed since the book seems to be the introduction of position independent executables (PIE) since Debian 9 (see this stackoverflow question).

Apparently, PIE does a few things, among them shifting the stack towards lower addresses (starting with 0x00). If somebody can explain what it does and why, that would answer all my questions.

For now, including the flag gcc -no-pie does the trick!
With this flag, the stack addresses are now similar to what I see in the book.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .