1 year ago

#250888

test-img

John Doe

Buffer overflow a simple echo program

I have an executable which simply inputs a string using "gets" and places it in a buffer. Using gdb the disassembly of the executable comes out to be -

push   %rbp
mov    %rsp,%rbp
sub    $0x40,%rsp
mov    $0x400684,%edi
call   0x400470 <puts@plt>
lea    -0x40(%rbp),%rax
mov    %rax,%rdi
mov    $0x0,%eax
call   0x4004a0 <gets@plt>
lea    -0x40(%rbp),%rax
mov    %rax,%rsi
mov    $0x400699,%edi
mov    $0x0,%eax 
call   0x400480 <printf@plt>
mov    $0x0,%eax
leave  
ret 

I am trying to pass a shellcode which prints "hello world" on the console overflowing the buffer (64 Bytes) of the program. Address Space Layout Randomization (ASLR), Stack Smashing Protection (SSP) and preventing the execution of code from the stack all are disabled. The inputs like "\xdf" etc which I see in tutorials all over the internet are not overwriting the return address as intended. The program is considering "", "x", "d", "f" to be separate characters. The shellcode I am using is -

\x90\x90\x90\x48\x65\x6c\x6c\x6f\x2c\x20\x57\x6f\x72\x6c\x64\x21\x0d\x0a\xdf\xff\xff\xff\x7f

The last 5 bytes are what I want the return address to point to i.e (0x7fffffffdf). How to achieve the desired result? Thanks!

x86-64

buffer-overflow

shellcode

0 Answers

Your Answer

Accepted video resources