Return Styles: Pseud0ch, Terminal, Valhalla, NES, Geocities, Blue Moon. Entire thread

stack buffer overflow

Name: Anonymous 2012-07-26 13:33

I come to you for help with this assignment I have; smashing the stack. Implement a buffer overflow attack on the program, isThisGood.c, by exploiting the input, see gets(). If exploit successful, it should invoke the function oopsIGotToTheBadFunction!

a. What is the address of the function oopsIGotToTheBadFunction()?
How did you determine this?

b. What is the address on the stack that your input must overwrite
(address and content please)? How did you locate this address?

c. What is the address of buf?

d. What is the minimum length your input, the length you need to alter
the return address stored on the stack.

e. what is your input - show it in hexa characters since some of the
input is not likely to be printable.

#include <stdio.h>
#include <stdlib.h>

int oopsIGotToTheBadFunction(void)
{
printf("Gotcha!\n");
exit(0);
}

int goodFunctionUserInput(void)
{
char buf[12];
gets(buf);
return(1);
}

int main(void)
{
goodFunctionUserInput();
printf("Overflow failed\n");
return(1);
}

Name: Anonymous 2012-07-26 21:41

Sorry I'm not very good at programming; this is my first time doing any sort of thing like this. All I'm asking for is a little bit of guidance... anyways:

I have used objdump -D to figure out the address I am supposed to be jumping to is 0x08048444. I just am not sure how to figure out the address of the char var 'buf'. When I try to do anything in gdb it shows up "symbol table not found" or when i try to do x/4w $esp, or the like, it comes up saying "No Registers". I have figured out though that it takes 15 characters to throw a segmentation fault.

I am trying to do my own homework, but I need guidance. I'm taking an online class and the teacher went over a few things and then threw this homework at us while never even explaining what gdb was. I've had to look at many tutorials on youtube and even then it's really hard to figure this out.

Name: Anonymous 2012-07-26 22:21

There is a call in the assembly dump that says (at address 0x080484ba) "call 8048462 <goodFunctionUserInput>" which i'm assuming is the address that I need to replace so that it will run the "oopsIGotToTheBadFunction"; is this correct? Link to assembly dump: http://pastebin.com/L1N7DkUs

I'm still confused on how to figure out what address "buf" is out using the assembly dump. I also was wrong, it takes 16 characters to throw a segmentation fault.

Please, any help is appreciated.

Newer Posts
Don't change these.
Name: Email:
Entire Thread Thread List