Exploiting buffer overflow

Question

When I download a copy of a vulnerable program and try to exploit it by buffer overflow (any internal function calling as a payload), it works. However, when I made a same type of vulnerable program in C I am not able to exploit it and I have no idea what's going wrong. Checking on gdb I figure out that I am able to overwrite the return address on the stack but still getting a segmentation fault and my desired address is not executed.

The vulnerable program:

#include<stdio.h>

input()
{
    char a[4];

    gets(a);
    puts(a);
}

main()
{
    input();
    printf("\nthis will execute after returning from the function\n");
}


over()
{
    printf("this can only be executed by the hacker");
}

I want to execute the function over() and I used the payload

printf "aaaaaaaa\xb3\x84\x04\x08" | ./my

Answer 1

The main problem with your code is that it isn't vulnerable to a buffer overflow more than likely due to the compiler (are you using gcc?) replacinggets withfgets

If you strace the above compiled code (with malicious input) you should see what I mean.

Answer 2

If you've disabled ASLR (and checked that it's really disabled), you may be running into a canary. Disable it using the -fno-stack-protector flag:

gcc my.c -o my -fno-stack-protector