-2

for the practice i take some C code and compiled i try put shellcode open some calc and i not have idea which method i need to use

enter image description here enter image description here

#include <stdio.h>
#include <string.h>

int main(void)


{
char buff[120];
int pass = 0;

printf("\n Enter the password : \n");
gets(buff);

if(strcmp(buff, "thegeekstuff"))
{
    printf ("\n Wrong Password \n");
}
else
{
    printf ("\n Correct Password \n");
    pass = 1;
}

if(pass)
{
   /* Now Give root or admin rights to user*/
    printf ("\n Buffer success \n");
}

return 0;

}

what the problem ?

  • 1
    You need to locate the address of the input first. Then you put the shellcode somewhere in the input. Calculate the effective address of the shellcode then and put in the packed address(\x01\xef\xcd\xab for 0xabcdef01) in place of BBBB. Follow the tutorial carefully which you're trying. Read on the materials suggested/provided. – sudhackar Sep 9 '18 at 6:42
  • @sudhackar ok i find i can use kernel32.dll to return address the address is "77C6F8F7" i use this site to change hex2ascii iptuga.com/conversor.php i input 136*A+F7F8C677+160*"/x90" i do simple copy paste the output website and the program crash i really wonder what the problem i check the kernel address with another program , crush it and the calc open... whats wrong? – Aviran Ben Sep 10 '18 at 15:20
  • 1
    can you please paste the code as text instead of a blurry screenshot? – Igor Skochinsky Sep 10 '18 at 19:49
  • @IgorSkochinsky the code is one line when i paste it #include <stdio.h> #include <string.h> int main(void) { char buff[120]; int pass = 0; printf("\n Enter the password : \n"); gets(buff); if(strcmp(buff, "thegeekstuff")) { printf ("\n Wrong Password \n"); } else { printf ("\n Correct Password \n"); pass = 1; } if(pass) { /* Now Give root or admin rights to user*/ printf ("\n Buffer success \n"); } return 0; } – Aviran Ben Sep 12 '18 at 7:30
  • 1
    Please edit the question and put the code instead of picture, thanks. – Igor Skochinsky Sep 12 '18 at 7:44
1

I don't know what you're trying to accomplish here, but you can overwrite* pass to correct second if statement as you did accidentally on the picture.

If you are determined to use shellcode, find a memory area you can continuously overflow your input and use that address to replace BBBB. Another option is returning to a Windows API; then you must correctly set arguments before calling function and bypass ASLR.

* Since some compilers can place buffers immediately after return value, I assume pass variable stored higher addresses than buff and you overwrote it.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.