search

3. Classic Exploitation Technique

hashtag
Classic Exploitation Technique

Let us revisit the classical technique of exploiting a stack overflow on a binary with no protections enabled and ASLR turned off. We will do a demonstration on a binary compiled from the following source code:

#include <unistd.h>
#include <stdio.h>

void vuln() {
    char buffer[16];
    read(0, buffer, 100);
    puts(buffer);
}

int main() {
    vuln();
}

The binary was compiled with the following flags:

gcc -m32 -fno-stack-protector -zexecstack -o ./build/1_vulnerable ./src/1_vulnerable.c

Before running the binary, disable ASLR with the command:

ubuntu@ubuntu-xenial:/vagrant$ echo 0 | sudo tee /proc/sys/kernel/randomize_va_space
0

Verify that ASLR is indeed turned off.

Also, all protections are off.

The binary is simple. It reads 100 bytes from stdin into a 16 byte character buffer and prints the contents of the buffer to the user. On a benign execution, the behaviour might look like this:

It is very easy to get the binary to crash.

Let's delve into GDB to get the offset we need to place our return address at to control EIP.

We can begin writing a skeleton for our exploit.

If we run this and attach to the spawned process, we can verify that the program will crash on the address 0x41424344.

Next, we need to figure out where should we direct execution to. This would probably be somewhere in the buffer we write to with the read() call. If we break on the call to puts(), we can get a stack address we can use as the argument.

0xffffd5f0 is the start of buffer the user input is read into. A good place to jump to would be (0xffffd5f0 + 28 + 4). This lets us put our shellcode right after the return address. To begin with, we can test out strategy by filling that space with 'int 3' instructions (0xcc).

Now, we can run this, attach our debugger to the process and see if it breaks.

Taking some shellcode from Aleph One's 'Smashing the Stack for Fun and Profit':

Putting it all together:

Running the script.

Note that you might have to adjust the return address as the one on this machine might not match up to the one on your machines.

Previous2. Introduction to PEDA and PwntoolsNext4. Linux Binary Protections

Last updated