I'm learning about buffer overflows and that there are various different types of them, including ones you can do when you can't directly hijack the return address.
In these cases, you can hijack a function instead and make that call a shell for you. It took me days but now I finally think I understand it. But much to my surprise the payload doesn't work.
This is essentially the function call I'm trying to hijack:
fprintf(stdout, "%s\n", buffer);
So I overflow the buffer, rewrite a pointer to point to
[email protected], and write the address of
I also use the string
"/bin/sh;#" repeating to fill the buffer, expecting it to be passed as the argument to
system(), but instead what I get is:
sh: 1: ▒: not found
Any idea what's happening here that I'm not seeing?
As @Meow pointed out below, it seems like whats happening is that when the fprintf call gets replaced, the command becomes:
system(stdout, "%s\n", buffer);
which is effectively just
system(stdout). So system is trying to run stdout instead of my argument which is in the buffer at this point.
Spent some more hours trying to figure it out, tried to do some stuff with IO redirection when running the program, but nothing I was trying worked.
Is this even possible?
EDIT: It seems this is actually not possible to do like this. If you're going to replace a function with system(), the arguments to that function have to actually be something you can use with system()