0
#include <stdio.h>
#include <stdlib.h>

void reading();
void reading_hexa(char*);
void secret();

int main()
{
    reading();
    printf("Input done\n");
    exit(0);
}

void reading() {
    char buf[16];
    reading_hexa(buf);
}

void reading_hexa(char* buf) {
    int it = 0;
    while (1) {
        char hexa[5];
        if (scanf("%4s", hexa) != 1) break;
        if (hexa[0] != '\\' || hexa[1] != 'x') exit(1);
        char c = (char) strtol(hexa + 2, NULL, 16);
        printf("buf[%d]@%p: %02hhX -> %02hhX\n", it, &buf[it], buf[it], c);
        buf[it++] = c;
    }
}

void secret() {
    printf("Secret obtained\n");
}

I am attempting an exercise on buffer overflows. I have managed to overwrite the return address on the stack once reading_hexa() finishes, by inputting 24 "A"s (16 for the buffer and 8 for overwriting the base pointer), and then overflowing with the address of secret(). (i.e. if the address was 0x12345678, my input would be "\x41" * 24 + "\x78\x56\34\12" accounting for little endian)

However, I wish to return to main after secret() has printed, such that I can print "Input done\n". How can I do this? I've tried many things including appending the address of main to my existing input, appending extra characters for overwriting the base pointer, but none have worked.

I'm consistently either getting segmentation fault, or ../sysdeps/nptl/libc_start_call_main.h: No such file or directory.

1
  • Welcome to the community. Is this for a CTF? Mar 16 at 22:41

1 Answer 1

0

If i am not wrong, you should be able to execute the code in main if you redirect the execution to the address of the main function by adding a JMP instruction (either unconditional or relative) with the address of main as the operand. This will make the instruction pointer to be inside the main function.

To visualize this properly, try achieving this in a x64dbg/gdb. Once you reach the secret() function, change the EIP/RIP value to the address of the main. Once you get the flow, try to do this programmatically. Again, use the debugger to see the exact OPCODE for the ‘JMP’ instruction.

2
  • Or you could use Ghidra's Instruction patching functionality which automates most of the worries and common issues with this :-) Mar 20 at 18:11
  • OP is not writing a shellcode. They are hijacking the execution flow by changing the return address of reading. So they would have to implement a totally different strategy to follow your advice. If main have space above the reading return address, OP can simply add another return address after the secret's one. Mar 22 at 14:59

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .