The art of exploitation - exploit_notesearch.c

Question

i've got a question regarding the exploit_notesearch program.

This program is only used to create a command string we finally call with the system() function to exploit the notesearch program that contains a buffer overflow vulnerability. The commandstr looks like this: ./notesearch Nop-block|shellcode|repeated ret(will jump in nop block).

Now the actual question: The ret-adress is calculated in the exploit_notesearch program by the line:

ret = (unsigned int) &i-offset;

So why can we use the address of the i-variable that is quite at the bottom of the main-stackframe of the exploit_notesearch program to calculate the ret address that will be saved in an overflowing buffer in the notesearch program itself ,so in an completely different stackframe, and has to contain an address in the nop block(which is in the same buffer).

mangusta mangusta · Accepted Answer · 2013-08-10T01:04:46

that will be saved in an overflowing buffer in the notesearch program itself ,so in an completely different stackframe

As long as the system uses virtual memory, another process will be created by system() for the vulnerable program, and assuming that there is no stack randomization, both processes will have almost identical values of esp (as well as offset) when their main() functions will start, given that the exploit was compiled on the attacked machine (i.e. with vulnerable notesearch).
The address of variable i was chosen just to give an idea about where the frame base is. We could use this instead:

unsigned long sp(void)         // This is just a little function
{ __asm__("movl %esp, %eax");} // used to return the stack pointer

int main(){

esp = sp(); 
ret = esp - offset; 

//the rest part of main()

}

Because the variable i will be located on relatively constant distance from esp, we can use &i instead of esp, it doesn't matter much.

It would be much more difficult to get an approximate value for ret if the system did not use virtual memory.

The art of exploitation - exploit_notesearch.c

2 Answers