1

I am trying to find the offset for a buffer overflow attack for a simple C program using a Buffer overflow pattern generator

#include <stdio.h>
#include <string.h>

int main (int argc, char** argv)
{
    char buffer[500];
    strcpy(buffer, argv[1]);

    return 0;
}

However, once I crash the program by inputting the non-repeating pattern (of an arbitrary large length such as 800) into the argv[1] while executing the code in gdb, the SIGSEV error message gives me something like:

enter image description here

The problem is this message does not give me the actual memory address that got overwritten in the stack. It only gives the address of the line number of the code where the error happened.

What I would ideally want is something like this instead, in order to find what value the return address got overwritten with, so I can use the pattern generator to find the offset.

enter image description here

Is there some setting in gdb that would show me the latter? Or is there another way to find what value the return address got overwritten with so I can use this pattern generator?

Compiling code:

gcc -g vuln.c -o vuln -fno-stack-protector -no-pie

I also have aslr disabled:

sudo su -c "echo "kernel.randomize_va_space=0 && systctl -p"

Running this on VM (Ubuntu-64 bit)

2 Answers 2

1

Are you running under WSL or some other emulation layer? Try compiling the binary to a 32 bit version or use a VM rather than emulation. This post is showing the same behavior.

https://stackoverflow.com/questions/60822460/sigsegv-raised-by-32-bit-application-vs-64-bit-applicationn

I would also add that the example they show is better vulnerable code for practicing as it sets up the stack with a call to the vulnerable function from main, rather than overwriting the main() return as that is a little less clean.

0
0

I installed the pwntools extension with gdb and I now see a lot more info (including what I need).

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .