Basic Buffer Overflow Help

Question

I am currently practicing for a CTF competition and one of the practice challenges is a buffer overflow exploit. Before this challenge I knew absolutely nothing about these exploits, but I've been reading into them and trying to understand the basics.

#include <stdio.h>
#include <string.h>
#include <stdlib.h>

void win(void)
{
    system("cat flag.txt");
    return;
}


int main(int argc, char *argv[])
{
    printf("Give me some data: \n");
    fflush(stdout);
    char buffer[32];
    gets(buffer);
    printf("You entered %s\n", buffer);
    fflush(stdout);
    return 0;
}

So what I know so far is that I need to redirect to the win() function and that there is a buffer of 32 characters. I broke down the program into assembly and found that the win() function's address is 0x080484fd. After that, I connected to the program's server and typed 32 characters and the function's address. The program only returned my input, and did not redirect to the win() function. I did some more reading and tried doing it from another shell with the command:

sudo python -c 'print "a"*32 + "\x08\x04\x84\xfd"' >& /dev/pts/2

Sadly, this did not get me to the win() function. What am I doing wrong? I've hit a total block and not sure what else to try. Any advice and help would be greatly appreciated.

Answer 1

You're doing well, with a little bit help you can exploit this program. First, let's look at stack layout for Linux (i assume it is Linux because of sudo and it is more common than other Unix-like OSes).

old-EIP is not immediately after our buffer.

I compiled your program in my 32-bit Linux Mint and as you can see GCC throw security warning.

Lets, prepare our exploit.

Segmentation fault, most probably EIP tried to execute wrong address. (Maybe because it is a CTF :)

Program crashed again:

You can see we overwritten old-EBP value before old-EIP. We just need to find function symbol and smack the stack (old-EIP) value with that address.

I hope it made things little more clear for you.

Little security warning for you: Do not use sudo unless you need it.