1

I am new to radare2. I am trying out radare2 with exercise from Protostar stack0
I generate raw De Bruijn Patterns with below command

$ ragg2 -P 500 -r
AAABAACAADAAEAAFAAGAAHAAIAAJAAKAALAAMAANAAOAAPAAQAARAASAATAAUAAVAAWAAXAAYAAZAAaAAbAAcAAdAAeAAfAAgAAhAAiAAjAAkAAlAAmAAnAAoAApAAqAArAAsAAtAAuAAvAAwAAxAAyAAzAA1AA2AA3AA4AA5AA6AA7AA8AA9AA0ABBABCABDABEABFABGABHABIABJABKABLABMABNABOABPABQABRABSABTABUABVABWABXABYABZABaABbABcABdABeABfABgABhABiABjABkABlABmABnABoABpABqABrABsABtABuABvABwABxAByABzAB1AB2AB3AB4AB5AB6AB7AB8AB9AB0ACBACCACDACEACFACGACHACIACJACKACLACMACNACOACPACQACRACSACTACUACVACWACXACYACZACaACbACcACdACeACfACgAChACiACjACkAClACmACnACoACpACqACrACsA

Run the program in debug mode and execute it

$ r2 -d -A stack0
Process with PID 31611 started...
= attach 31611 31611
bin.baddr 0x08048000
Using 0x8048000
asm.bits 32
[x] Analyze all flags starting with sym. and entry0 (aa)
[x] Analyze len bytes of instructions for references (aar)
[x] Analyze function calls (aac)
[x] Use -AA or aaaa to perform additional experimental analysis.
[x] Constructing a function name for fcn.* and sym.func.* functions (aan)
= attach 31611 31611
31611
 -- Buy a mac

[0xf7f72a20]> dc
AAABAACAADAAEAAFAAGAAHAAIAAJAAKAALAAMAANAAOAAPAAQAARAASAATAAUAAVAAWAAXAAYAAZAAaAAbAAcAAdAAeAAfAAgAAhAAiAAjAAkAAlAAmAAnAAoAApAAqAArAAsAAtAAuAAvAAwAAxAAyAAzAA1AA2AA3AA4AA5AA6AA7AA8AA9AA0ABBABCABDABEABFABGABHABIABJABKABLABMABNABOABPABQABRABSABTABUABVABWABXABYABZABaABbABcABdABeABfABgABhABiABjABkABlABmABnABoABpABqABrABsABtABuABvABwABxAByABzAB1AB2AB3AB4AB5AB6AB7AB8AB9AB0ACBACCACDACEACFACGACHACIACJACKACLACMACNACOACPACQACRACSACTACUACVACWACXACYACZACaACbACcACdACeACfACgAChACiACjACkAClACmACnACoACpACqACrACsA
You have changed the modified variable
child stopped with signal 11
[+] SIGNAL 11 errno=0 addr=0x4141583d code=1 ret=0

[0x080484d0]> dr
eax = 0x00000000
ebx = 0x5a414159
ecx = 0x41415841
edx = 0xf7f48870
esi = 0x00000001
edi = 0xf7f47000
esp = 0x4141583d
ebp = 0x41614141
eip = 0x080484d0
eflags = 0x00010282
oeax = 0xffffffff

[0x080484d0]> wopO ebp
Need hex value with `0x' prefix e.g. 0x41414142
[0x080484d0]> wopO esp
Need hex value with `0x' prefix e.g. 0x41414142
[0x080484d0]> wopO eip
Need hex value with `0x' prefix e.g. 0x41414142

Below is the C code which I am working on

  1 #include<stdio.h>
  2 #include<stdlib.h>
  3 #include<unistd.h>
  4
  5 int main(int argc, char **argv){
  6
  7     volatile int modified;
  8     char buffer[64];
  9
 10     modified = 0;
 11     scanf("%s",buffer);
 12
 13     if(modified !=0){
 14         printf("You have changed the modified variable\n");
 15     }else{
 16         printf("Try again\n");
 17     }
 18     return 0;
 19 }

Q1)Any reason why eip is not overwritten with the De Bruijn Pattern?

Q2)Why do I get the message Need hex value with '0x' prefix e.g. 0x41414142

Kindly let me know. Thank you.

0
0

Did you notice that you indeed changed the desired variable?

You have changed the modified variable

Anyway, regarding the 2nd question, this is an intended behavior after the following pull-request was merged to radare2.

Now it is requires that you'll have 0x prefixed to the passed value, so you can do something like this:

wopO `dr ebp`

or something like that:

wopO `?v ebp`

The backticks are used to execute radare2 command so you basically use the result of the inner command and pass it to wopO


Regarding the first question, after some amount of chars (i.e long input) you'll get a Segfault, that's mean that your input cause a corruption and you indeed made a "damage" to eip. If you want to override eip you should bypass the security mitigation -- ASLR:

To disable it temporarily, execute:

echo 0 | sudo tee /proc/sys/kernel/randomize_va_space

And to enable it again, execute:

echo 2 | sudo tee /proc/sys/kernel/randomize_va_space

If you want to change the value permanently, say if it is an exploitation-dedicated machine, add the following setting to /etc/sysctl.conf, for example:

echo "kernel.randomize_va_space = 0" >> /etc/sysctl.conf

and run the sysctl -p command.

1
  • 1
    Thank you very much for wopO dr ebp & wopO ?v ebp.And Yes, I did notice however from the link which I have been following the exercise second part was to get a reverse shell. – vanquish Mar 26 '18 at 12:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.