1

It seems abo1.exe advanced_buffer_overflow challenge is packed, I've tried to unpack it, but I am still beginner in unpacking.It seems it is packed manually. I've also tried OllyDump and ImortREC.

Can any body give me a hand on unpacking it? Here is the file : http://www.binary-auditing.com/binary-auditing-training-package.zip

password : fdcd2ff4c2180329053650f3075d39f4

  • md5 hash of the file 22702fbfc5b198080aca8f0be6f2df0b is not packed its a strcpy vuln challenge – blabb Jun 2 '15 at 12:06
3

The file abo1.exe (MD5: 22702FBFC5B198080ACA8F0BE6F2DF0B) doesn't look packed to me. Looking at the PE structure we can see the entry point is in the .text section and the file has a few imports:

enter image description here

Disassembling this entry point shows some code that looks normal. The main function gets the command line arguments and passes them to another function before terminating:

enter image description here

Looking at this other function we can see a strcpy to a stack destination buffer with an attacker supplied source buffer.

enter image description here

The challenge from the training perspective is to exploit this stack based buffer overflow in order to gain arbitrary code execution (which is beyond the scope of this answer).

| improve this answer | |
  • IDA gives me this error at start: The import segment seems to be destroyed.... IDA just show five imports. – Vlad Jun 2 '15 at 12:02
  • Can u give me more guide on this 3 line: mov eax, [ebp+arg_4] |||| |||| add eax, 4 |||| mov ecx, [eax] – Vlad Jun 2 '15 at 12:24
  • The getmainargs docs (bit.ly/1Fpd03y) tell us the Argv parameter will be "An array of null-terminated strings representing command-line arguments entered by the user of the program." The "mov eax, [ebp+arg_4]" pulls the ptr to the array of pointers. EAX now points to first entry in the array. The "add eax, 4" advanced to the second entry in the array (as according to the docs, the first entry is "the command with which the program is invoked"). The "mov ecx, [eax]" get the second pointer in the array which is a pointer to the first user supplied cmd line arg. – QAZ Jun 2 '15 at 12:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.