I was trying to overflow buffers and I was wondering ,

Is there anyway to do a buffer overflows without using environment variables ?

closed as unclear what you're asking by TildalWave, schroeder, Xander, Mark, Rory Alsop Nov 6 '14 at 8:26

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 1
    I'm not sure that you understand buffer overflows. Can you elaborate on how you think environment variables are involved? – schroeder Nov 5 '14 at 21:50
  • Sorry for being vague the last time . I took time to understand how buffer overflow works. My question is when writing an exploit , we design a buffer in the exploit program containing shell code and name it something like $BUF and we run the vulnerable program using this environment variable . I am asking if there is a possibility for me to carry out the same thing without using the environment variable – proteann Nov 5 '14 at 22:27
  • This is still confusing. Why do you not want to use a variable? Where would the code come from? – schroeder Nov 5 '14 at 22:34
  • Alright assume we need to write a program that would execute a shell code by buffer overflowing the target program(The program would pass argument to the target program) .. So if we have to modify the return address in the target program, we have to know what address to replace it with. How do we do that ? – proteann Nov 6 '14 at 1:06
  • Your question has nothing to do with variables. Each buffer (in each program) has its own size that needs to be exceeded. You need to know what that is beforehand, then craft a payload that will trigger the overflow and execute your code. You don't use the same code for every potential overflow. – schroeder Nov 6 '14 at 4:37

Yes, you normally overflow buffers without using environment variables. In fact, I'm not exactly sure how you would manage to overflow a buffer using only an environment variable.

Ok, that last part is slightly facetious, you could potentially malform an environment variable to cause an overflow as well, but you can cause a buffer overflow with any unchecked variable length input. It could be a text box, a command line parameter, an environment variable, a memory value from another program, an API call, whatever... If it takes input of variable length and doesn't check that it fits, it can potentially be used to cause an overflow.

  • Thanks for the answer. But what if I have to write an exploit program that would launch the target program and pass an argument to it. In this case we might not know what we have to overwrite the return address with right? – proteann Nov 6 '14 at 1:09
  • We don't need to know an address. We need to know an offset. The structures of how a program loads in to memory are generally consistent, so you would just make a payload that is oversized by enough to be able to push in to some control flow in memory and then hijack it to jump wherever we want. It's not the simplest thing to do in practice, which is why not every overflow can be easily exploited, but the basic principal isn't that complicated. – AJ Henderson Nov 6 '14 at 1:14

Not the answer you're looking for? Browse other questions tagged or ask your own question.