I have this code, which have some vulnerability, but I can't seem to exploit it.
For now, this is what I've noticed:
1) if argv[1] = 3 and argc = 3, then it overflows and writes argv[2] into memory of array[3] in "place_int_array" function.
2) if argv[1] < 0 and argc = 3, then it argv[2] overrides memory at array[argv[1]].
3) we write argv[0] in printf function, which can be exploited somehow (didnt manage to exploit it at all).
Here is the code. I've put some comments, hopefully it's readable.
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
int secretCode = 123;
void print_secret_code(){
//TODO - call this from somewhere...
printf("You get better at this stuff, ah?! Go get your treasure, the code is %d\n", secretCode);
}
// array, 3
void fill_array(int array[], size_t len){
unsigned int i;
for (i = 0; i < len; i++){
array[i] = i * 10;
printf("array[i]: %d, i: %d\n", array[i], i);
}
}
void place_int_array(int slot,int value){
//buffer size = 3*4=12 bytes?
int array[3];
//sizeof(array)=4*SAFES ( = 12 here), sizeof(array[0]) = 4 ==> fill_array(array, 12/4=3)
fill_array(array, sizeof(array)/sizeof(array[0]));
//vuln - when slot = 3.
if(slot>3) //we stop bad guys here
printf("safe number is greater than 3, out of bounds.\n");
else{
//vuln?
array[slot]=value;
printf("filled safe %d with %d.\n",slot,value);
}
return;
}
int main(int argc,char **argv){
if(argc!=3){
printf("Welcome to Alladin's magic cave!\n");
printf("Enter the secret number into the right safe and get the treasure cave entrance code!\n");
printf("syntax: %s [SAFE NUMBER] [SECRET NUMBER]\n",argv[0]);
//TEMP TEMP - for debugging only
printf("print_secret_code function = %p\n", print_secret_code);
}
else
//atoi("14s56")=>14, atoi("a14s56")=>0
place_int_array(atoi(argv[1]), atoi(argv[2]));
exit(0);
}
I expect to somehow manage to control the flow of the program to execute the "print_secret_code". I know how to find its address, just can't find a way to exploit the program such that it goes to that memory.
NOTE: I know how to debug and make it print the value of the variable. I'm asking how can I exploit the code itself to jump into that function.
