Experimental buffer overflow in Ubuntu 10 (assembly)

Question

I am trying to overflow buffer in Ubuntu 10.04 using a C program and diverting the return address to function "junk". But I am not able to overwrite the return address with the address of unused function "junk". It just dumps some unknown address on 12 bytes of stack. Please help me troubleshoot it. Here is the C code:-

    (gdb) list 
    1   #include<stdio.h>
    2   void display()
    3   {
    4       char buff[8];
    5       gets(buff);
    6       puts(buff);
    7   }
    8   main()
    9   {
    10      display();
    (gdb) 
    11      return(0);
    12  }
    13  junk()
    14  {
    15      printf("cracked");
    16  }

The disasambled code for main is:- Dump of assembler code for function main:

    0x08048462 <+0>:    push   %ebp
    0x08048463 <+1>:    mov    %esp,%ebp
    0x08048465 <+3>:    call   0x8048444 <display>
    0x0804846a <+8>:    mov    $0x0,%eax
    0x0804846f <+13>:   pop    %ebp
    0x08048470 <+14>:   ret

End of assembler dump.

Dump of assembler code for function display:

    0x08048444 <+0>:    push   %ebp
    0x08048445 <+1>:    mov    %esp,%ebp
    0x08048447 <+3>:    sub    $0xc,%esp
    0x0804844a <+6>:    lea    -0x8(%ebp),%eax
    0x0804844d <+9>:    mov    %eax,(%esp)
    0x08048450 <+12>:   call   0x8048350 <gets@plt>
    0x08048455 <+17>:   lea    -0x8(%ebp),%eax
    0x08048458 <+20>:   mov    %eax,(%esp)
    0x0804845b <+23>:   call   0x8048380 <puts@plt>
    0x08048460 <+28>:   leave  
    0x08048461 <+29>:   ret

End of assembler dump.

Dump of assembler code for function junk:

    0x08048471 <+0>:    push   %ebp
    0x08048472 <+1>:    mov    %esp,%ebp
    0x08048474 <+3>:    sub    $0x4,%esp
    0x08048477 <+6>:    mov    $0x8048550,%eax
    0x0804847c <+11>:   mov    %eax,(%esp)
    0x0804847f <+14>:   call   0x8048370 <printf@plt>
    0x08048484 <+19>:   leave  
    0x08048485 <+20>:   ret

End of assembler dump.

Now i assemble it without stack protection:-

    gcc -ggdb -fno-stack-protector -mpreferred-stack-boundary=2 -o buffer buffer.c

If i give input of:- printf "wwwwwwwwwwww\x72\x84\x04\x08" | ./buffer

The value:- "x72\x84\x04\x08" as the diverted address of 1st instruction of unused function "junk". It stores some strange memory values on the 12 bytes alongwith return address also, but not my address. And again gives "Segmentation Fault". Is there some other way to exploit buffer in newer Linux flavors?

tj90241 tj90241 · Accepted Answer · 2012-09-14T20:31:36

leave is equivalent to the following:

movl %ebp, %esp
popl %ebp

Thus, in your case, if you supply 'wwww' for %ebp, the program is going to try and do something like this:

movl $0x77777777, %esp    ; 0x77777777 = 'wwww'
popl %ebp                 ; read from address 0x77777777!

You need to supply a reasonable value for %esp!

Experimental buffer overflow in Ubuntu 10 (assembly)

1 Answers