search

bof

Source code (Link to binaryarrow-up-right):

#include <stdio.h>
#include <string.h>
#include <stdlib.h>
void func(int key){
        char overflowme[32];
        printf("overflow me : ");
        gets(overflowme);       // smash me!
        if(key == 0xcafebabe){
                system("/bin/sh");
        }
        else{
                printf("Nah..\n");
        }
}
int main(int argc, char* argv[]){
        func(0xdeadbeef);
        return 0;
}

If you are running a 32-bit machine, you will not have any problems running the binary as the binary is compiled for 32-bit machines.

For the users on 64-bit machines, you follow the solution mentioned herearrow-up-right to run the 32-bit binaries on 64-bit machines.

As evident from the source code, it is clear that we have to overflow the overflowme buffer and pass the if confition on line number 8.

If we try to go the usual route and try overflowing this binary by passing in a large value to check if it segfaults, we get the following:

We can inspect the reason for this by checking the output of checksec utility which states what all binary protection mechanisms are applied on this binary.

As we can see all the binary protection mechanisms are applied over this binary, we have to search for another route.

Lets hop into GDB and see exactly how far is the value of key from the buffer and try overwriting the value of key.

Lets set a breakpoint at func+40 and see the values int the stack (x/30hwx $esp) once we have send in A*32 as our input.

As we can see, the value of 0xdeadbeef (key) is at 0xffffd150, 52 bytes away from the starting of buffer overflowme, thus to bypass the comparison at line 8, we have to create a payload which consists of 52 junk bytes and 0xcafebabe as last 4 bytes.

NOTE: We willll have to pass the value 0xcafebabe in little endian format along with other values.

Payload can be generated using the following in-line python command:

Lets give this a try in GDB and see if we were able to achieve the results we were after.

As it is clear from the output of examine command we have successful overwritten the value at 0xffffd150 with 0xcafebabe. Thus our payload works, now we can use this payload to actually get a shell on the remote server using the following command:

PreviousfdNextflag

Last updated