Databases
StackOverflow2013
Postsdbo
POBuffer Overflow Attack
 

Note that there are some explanatory texts on larger screens.

plurals
  1. POBuffer Overflow Attack
    primarykey
    data
    text
    <p>I'm trying to execute a very simple buffer overflow attack. I'm pretty much a newbie to this. So, if this question is stupid, please excuse me :-)</p> <p>The code:</p> <pre><code>#include&lt;stdio.h&gt; #include&lt;stdlib.h&gt; int i, n; void confused(int i) { printf("**Who called me? Why am I here?? *** %x\n ", i); } void shell_call(char *c) { printf(" ***Now calling \"%s\" shell command *** \n", c); system(c); } void victim_func() { int a[4]; printf("Enter n: "); scanf("%d",&amp;n); printf("~~~~~~~~~~~~~ values and address of n locations ~~~~~~~~~~"); for (i = 0;i &lt;n ;i++) printf ("\n a[%d] = %x, address = %x", i, a[i], &amp;a[i]); printf("\nEnter %d HEX Values \n", n); // Buffer Overflow vulnerability HERE! for (i=0;i&lt;n;i++) scanf("%x",&amp;a[i]); printf("Done reading junk numbers\n"); } int main() { victim_func(); printf(“\n done”); return 0; } </code></pre> <p>When I use objdump to get the function addresses, I have the following:</p> <pre><code>main(): 0x804854d Address of main() where printf() is called: 0x8048563 victim_func(): 0x8048455 confused(): 0x8048414 </code></pre> <p>Now, what I want is to jump to the function 'confused()' from victim_func() by overflowing the buffer there, and overwriting the return address to the address of confused(). And I want to return back from confused() to the printf() statement in main, and exit normally. So, I provide the following input</p> <pre><code>Enter n: 7 Enter 7 HEX values: 1 2 3 4 5 8048414 (This is to jump to confused) 8048563 (this is to jump to printf() in main) </code></pre> <p>Although, the program prints "Done" from that printf statement, it is jumping back to victim_func() and prints "Enter n:"</p> <p>What am I doing wrong? Any help would be greatly appreciated!</p> <p>PS: I'm not sure if I have put the question right. Please let me know, if any more information is needed.</p>
    singulars
    1. PO
      singulars
      1. PTAnswer
    1. This table or related slice is empty.
    1. PTQuestion
    1. USjww
    1. USAshwin
    plurals
    1. This table or related slice is empty.
    1. PL
      singulars
      1. LTLinked
    2. PL
      singulars
      1. LTLinked
    3. PL
      singulars
      1. LTLinked
    1. This table or related slice is empty.
    1. PO
      singulars
      1. PTAnswer
    2. PO
      singulars
      1. PTAnswer
    3. PO
      singulars
      1. PTAnswer
    1. VO
      singulars
      1. POBuffer Overflow Attack
      1. This table or related slice is empty.
      1. VTUpMod
    2. VO
      singulars
      1. POBuffer Overflow Attack
      1. This table or related slice is empty.
      1. VTUpMod
    3. VO
      singulars
      1. POBuffer Overflow Attack
      1. This table or related slice is empty.
      1. VTUpMod
    1. COactually, this is an assignment at school!
      singulars
      1. POBuffer Overflow Attack
      1. USAshwin
    2. COIf this is really homework, please tag it as such.
      singulars
      1. POBuffer Overflow Attack
      1. USNPE
    3. CO@VJo I think this is a great educational task - I'm tempted to try it myself: it requires a deep understanding and direct experimentation with the assembler implementation of the code. White hats need to grasp these ideas too.
      singulars
      1. POBuffer Overflow Attack
      1. USElemental
 

Querying!

 
Guidance
A row detail

Detail views are divided into sections. All the information in the data section comes from columns in the selected row. The other sections display data from other, related rows.

Related data can be related in a to-one or a to-many fashion. Captions of data related in a to-many fashion link to a list view showing a filtered view of the table.

Try moving around until you find a non-empty to-many entry and click on the label to get to one. You can move back to the root by clicking on the database name in the header.

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload