Linux Buffer Overflow Return-to-libc

Question

This question is a follow up with a previous question Previous Question

The previous question was solved by changing the permissions of the executable with execstack. My new problem revolves around another implementation to bypass stack execution protection. This uses return-to-libc and involves executing /bin/sh against the address of system().

I am currently using the following code:

#include <stdio.h>

void func(char *buff){  
    char buffer[5];
    strcpy(buffer, buff);
    printf("%s\n", buffer);
}

int main(int argc, char *argv[]){
    func(argv[1]);
    printf("I'm done!\n");
    return 0;
}

My problem occures when I need to overflow the return address of func() to the address 0x00167100. When I perform the buffer overflow the argument I use is $(echo -e "\x00\x71\x16\x00"). The problem however is the least significant \x00 just before \x71 gets removed from my argument. In fact I can use \x00\x00\x00\x00\x00...\x71\x16\x00 and the argument passed in will still be \x71\x16\x00. The end result is the overriden address before some like 0x08001671 when it should really be 0x00167100.

@OliCharlesworth Why am I loosing those particular bytes.

Blackninja543
– Blackninja543

2012-03-31 00:07:49 +00:00
Commented Mar 31, 2012 at 0:07 — Blackninja543
– Blackninja543, Commented Mar 31, 2012 at 0:07

caf · Accepted Answer · 2012-03-31 00:14:17Z

3

strcpy() stops copying at the first null byte. This means that you must use an address where at least the last three bytes are non-null.

Perhaps you can jump over the first instruction of the target function.

answered Mar 31, 2012 at 0:14

caf

241k42 gold badges344 silver badges480 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

Blackninja543 Over a year ago

That was the problem however I have encountered a new problem. There is still the tail \x00 byte and I have extra code after that byte. Any suggestions on getting around the stycpy() null byte problem.

caf Over a year ago

@Blackninja543: The way to get around it is to ensure that your payload doesn't have any nulls other than as the last byte.

Collectives™ on Stack Overflow

Linux Buffer Overflow Return-to-libc

1 Answer 1

2 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

2 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related