0

I am learning about Buffer Overflows (BOF) and came up with this piece of C code:

#include <stdio.h>
#include <stdlib.h>

void win()
{
        system("/bin/bash");
}

int main()
{
        char s[128];
        scanf("%s",&s);
        printf("%s\n", s);
        return 0;
}

Using pwntools I wrote the following script:

from pwn import * 
context.binary = binary = "./test"

payload = b"A"*(0x80)+p64(0x1159)

p = process()
p.sendline(payload)
p.interactive()

This does not work and throws a Broken Pipe error:

[*] '/home/kali/simple_bof/test'
    Arch:     amd64-64-little
    RELRO:    Partial RELRO
    Stack:    No canary found
    NX:       NX enabled
    PIE:      PIE enabled
[+] Starting local process '/home/kali/simple_bof/test': pid 40126
[*] Switching to interactive mode
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAY\x11[*] Got EOF while reading in interactive
$ 
[*] Process '/home/kali/simple_bof/test' stopped with exit code -11 (SIGSEGV) (pid 40126)
[*] Got EOF while sending in interactive
Traceback (most recent call last):
  File "/home/kali/.local/lib/python3.9/site-packages/pwnlib/tubes/process.py", line 746, in close
    fd.close()
BrokenPipeError: [Errno 32] Broken pipe

I am clueless to why this is happening and all of my search attempts didn't yield anything useful

I tried compiling in many ways but the end result is the same (broken pipe), I tested with the following flags

-fno-stack-protector
-no-pie
-m32 (used p32 for this one )

1 Answer 1

0

The broken pipe happened because your program died with a SIGSEGV and therefore the interactive session that pwntools was trying to open wasn't possible to establish (in the log said it has received an end of file (EOF)). It's all written in the log, when you look for an error you should look at the first failing line not the last one :)

Probably the offset where to place the value to overwrite the EIP is wrong or maybe the PIE is enabled or the ASLR is not disabled.

You should attach a debugger and find out where the process is dying.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .