First off we don't have ASLR and stack cookie, and assume we can't create our own files on this system
So I'm trying to execute a shellcode in this code, this is what i have done so far:
i have managed to overwrite the buffer and set the return address of function foo to function critical, but my problem is how to run a specific shellcode here? the execv will run the bin/sh but i can't replace the first argument with a shellcode and it won't work and I'm not sure if its even possible to run a shellcode with execv, and when i pass a shellcode to sh it doesn't work.
also i know the return to libc exploit but still don't know how to execute a shellcode with system()? is it even possible to pass a shellcode to it? or maybe i can use another function to just pass a shellcode to it?
And i assume we can run our own shellcode if we created our own shellcode file and replaced the sh path, but we don't have access to create files, we have to do it with this code only.
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
int bar(char *arg, char *out)
{
strcpy(out, arg);
return 0;
}
int foo(char *arg)
{
char buffer1[100]="Test program.\n";
char buffer2[100];
bar(arg, buffer2);
printf("%s",buffer1);
return 0;
}
void critical()
{
char *msg[]={"/bin/sh",NULL};
execv(msg[0],msg);
}
int main(int argc, char *argv[])
{
if (argc != 2)
{
fprintf(stderr, "prog_vuln2: argc != 2\n");
exit(EXIT_FAILURE);
}
foo(argv[1]);
return 0;
}