2

I am currently practicing for a CTF competition and one of the practice challenges is a buffer overflow exploit. Before this challenge I knew absolutely nothing about these exploits, but I've been reading into them and trying to understand the basics.

#include <stdio.h>
#include <string.h>
#include <stdlib.h>

void win(void)
{
    system("cat flag.txt");
    return;
}


int main(int argc, char *argv[])
{
    printf("Give me some data: \n");
    fflush(stdout);
    char buffer[32];
    gets(buffer);
    printf("You entered %s\n", buffer);
    fflush(stdout);
    return 0;
}

So what I know so far is that I need to redirect to the win() function and that there is a buffer of 32 characters. I broke down the program into assembly and found that the win() function's address is 0x080484fd. After that, I connected to the program's server and typed 32 characters and the function's address. The program only returned my input, and did not redirect to the win() function. I did some more reading and tried doing it from another shell with the command:

sudo python -c 'print "a"*32 + "\x08\x04\x84\xfd"' >& /dev/pts/2

Sadly, this did not get me to the win() function. What am I doing wrong? I've hit a total block and not sure what else to try. Any advice and help would be greatly appreciated.

  • have you read Smashing The Stack For Fun And Profit? it may help you think about how to approach this challenge. Also, have you tried using GDB to step through your code to see exactly what is happening? PS if your system is little-endian then memory addresses in the payload need to be written in little-endian fashion – julian Mar 19 '17 at 4:58
4

You're doing well, with a little bit help you can exploit this program. First, let's look at stack layout for Linux (i assume it is Linux because of sudo and it is more common than other Unix-like OSes). Sorry for Turkish parts in pictures.

Linux stack layout

old-EIP is not immediately after our buffer.

I compiled your program in my 32-bit Linux Mint and as you can see GCC throw security warning.

You can see GCC warning

Lets, prepare our exploit.

Segfault

Segmentation fault, most probably EIP tried to execute wrong address. (Maybe because it is a CTF :)

Exploiting buffer overflow Program crashed again:

Crashed

You can see we overwritten old-EBP value before old-EIP. We just need to find function symbol and smack the stack (old-EIP) value with that address.

Exploit in action

I hope it made things little more clear for you.

Little security warning for you: Do not use sudo unless you need it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.