3

I am developing a script to perform an a buffer overflow for an assignment in school. However, I am stuck at a point where my payload works injected through the commandline, but not injected through my python script.

When I inject my payload from the commandline:

 user@ubuntu:~/Documents/$ /home/user/Documents/easy $(python -c 'print"AAAAAAAAAAAAAA"\xa0\xf4\xff\xbf"')
 $ exit  //I get the shell.... 

The return address

\xa0\xf4\xff\xbf

Is the address of my NOP sled in an environment variable.

Now, I run the complete same command through my python script:

 path = "/home/dvddaver/Documents/easy AAAAAAAAAAAAAA\xa0\xf4\xff\xbf"
 os.system(path);

However, when I run my python script, I get a segmentation fault:

 user@ubuntu:~/Documents$ python bruteforcer.py
 Segmentation fault (core dumped)
  • 1
    New process - new environment. Perhaps your return address is wrong? – Dog eat cat world Mar 18 '14 at 20:01
  • Have you tried using a debugger? – atk Dec 10 '14 at 23:42
2

I understand it is a bit late for your assignment ;) but for other students who may be groping in the dark with similar problem, here goes...

Python is written in C, and the C executable is throwing the segmentation fault error. To understand segmentation fault you need to run Python itself in gdb (GNU Debugger assuming you are on Linux/Unix) and then pass in your script as the parameter and then step through the C code written for Python.

It is quite possible that you have have caused a buffer-overflow within the python interpreter to have caused a segmentation fault (so that's good!). Though I cannot say for sure in the case you are executing here.

I have studied one of the vulnerabilities of Python in detail and blogged about it. It affects older versions of Python 2 and 3. I downloaded the Python source and built the source with debugging on.

Next I figured out how Python works and executed Python scripts on the built interpreter and stepped through them in GDB.

I have uploaded my work on my Blog (http://yazadk.wordpress.com/2014/12/10/remotely-exploitable-buffer-overflow-in-python/) - though mind it we were specifically looking for C programs that had buffer overflow available in the wild and I happened to choose Python which is written in C.

I hope this gives you some basic insight in what you or anyone else is trying to achieve.

1

The address in your environment may have changed because the environment is different.

You could look at the coredump to find out the correct address to use ( you don't have to use a nop sled then :) )

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.