-2

for the practice i take some C code and compiled i try put shellcode open some calc and i not have idea which method i need to use

enter image description here enter image description here

#include <stdio.h>
#include <string.h>

int main(void)


{
char buff[120];
int pass = 0;

printf("\n Enter the password : \n");
gets(buff);

if(strcmp(buff, "thegeekstuff"))
{
    printf ("\n Wrong Password \n");
}
else
{
    printf ("\n Correct Password \n");
    pass = 1;
}

if(pass)
{
   /* Now Give root or admin rights to user*/
    printf ("\n Buffer success \n");
}

return 0;

}

what the problem ?

8
  • 1
    You need to locate the address of the input first. Then you put the shellcode somewhere in the input. Calculate the effective address of the shellcode then and put in the packed address(\x01\xef\xcd\xab for 0xabcdef01) in place of BBBB. Follow the tutorial carefully which you're trying. Read on the materials suggested/provided.
    – sudhackar
    Sep 9 '18 at 6:42
  • @sudhackar ok i find i can use kernel32.dll to return address the address is "77C6F8F7" i use this site to change hex2ascii iptuga.com/conversor.php i input 136*A+F7F8C677+160*"/x90" i do simple copy paste the output website and the program crash i really wonder what the problem i check the kernel address with another program , crush it and the calc open... whats wrong?
    – Aviran Ben
    Sep 10 '18 at 15:20
  • 1
    can you please paste the code as text instead of a blurry screenshot?
    – Igor Skochinsky
    Sep 10 '18 at 19:49
  • @IgorSkochinsky the code is one line when i paste it #include <stdio.h> #include <string.h> int main(void) { char buff[120]; int pass = 0; printf("\n Enter the password : \n"); gets(buff); if(strcmp(buff, "thegeekstuff")) { printf ("\n Wrong Password \n"); } else { printf ("\n Correct Password \n"); pass = 1; } if(pass) { /* Now Give root or admin rights to user*/ printf ("\n Buffer success \n"); } return 0; }
    – Aviran Ben
    Sep 12 '18 at 7:30
  • 1
    Please edit the question and put the code instead of picture, thanks.
    – Igor Skochinsky
    Sep 12 '18 at 7:44
1

I don't know what you're trying to accomplish here, but you can overwrite* pass to correct second if statement as you did accidentally on the picture.

If you are determined to use shellcode, find a memory area you can continuously overflow your input and use that address to replace BBBB. Another option is returning to a Windows API; then you must correctly set arguments before calling function and bypass ASLR.

* Since some compilers can place buffers immediately after return value, I assume pass variable stored higher addresses than buff and you overwrote it.

This site is temporarily in read only mode and not accepting new answers.

Not the answer you're looking for? Browse other questions tagged .