2

I need to execute a call to cat on a target file using a buffer overflow in a challenge app (can't execute on the stack, but can use libc). For reference, in C this is valid code for what I'm trying to do:

int main(void) {
        char * const argv[] = {"cat", "/etc/target/file"};
        char * const envp[] = {NULL};;
        execve("/bin/cat", argv, envp);
}

I can load some null-terminated strings up on the target and I've also determined the address of execve. Here's the info I have:

"/bin/cat" @ 0xbfffffb9:
"cat" @ 0xbfffffbe
"/etc/target/file" @ 0xbffff96f

execve @ 0x804831c

I can overwrite the EIP and following bytes with a string like:

"AAAA....AAA" + EIP + [RETURN ADDR] + ARG1 + ARG2 ....

In the string above I can replace EIP with the address of execve and jump to the function, but that's where things go sour for me. I've never set up a stack for arrays and couldn't find a google example of using arrays in a classic buffer overflow.

How can I set up the stack with array parameters for my function call? What does my stack need to look like in this case?

1

What you're actually doing there is passing pointers to the array, not the array itself. If you look at the declarations:

    char * const argv[] = {"cat", "/etc/target/file"};
    char * const envp[] = {NULL};
    execve("/bin/cat", argv, envp);

'argv' and 'envp' are pointers to the array.

Typically, it's easiest to just ROP to execve('command', NULL, NULL) to avoid fancy setup. Why not execve('/bin/bash', NULL, NULL) then cat the file from the spawned shell?

Otherwise you can finagle some pointers to make it work - pass it pointers to NULL-pointer terminated arrays of strings that contain your args.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.