Overwrite return address In C with a unsigned long variable using buffer overflow

Question

I am trying to overwrite the data using strcpy() function with that stack protection off. The problem I encounter here is that using strcpy() to write an unsigned long variable(address) would change the value because of little-endian(?). I want to know if there is any way to copy the exact value of unsigned long into the stack using strcpy() or I should use another function instead.

#include <stdlib.h>
#include <stdio.h>
#include <string.h>

// some shellcode in format like "\x31\xc0"
const char shellcode[] = ...;

// vulnerable function bof
void bof(char *str){
    char buffer[12];
    printf("Come into function bof\n");
    strcpy(buffer, str);
}

int main(int argc, char **argv){
    char buffer[517];
    //random filling of buffer that may not be necessary
    strcpy(buffer,"abcdefghijkl1234");

    //I believe buffer[16] is the location of return addr when the program goes in bof()
    //I write the shell code into buffer[20] first
    strcpy(&buffer[20],shellcode);

    //Trying to make value of location buffer[16] into address of buffer[20]
    strcpy(&buffer[16],&buffer[20]);


    // bof is called here
    bof(buffer);
    printf("Exit from function bof\n");
}

For copying arbitrary data, you should be using memcpy() rather than strcpy(). — Ken Y-N
– Ken Y-N, Commented Oct 6, 2020 at 10:16
I'm a little uncertain of what you are trying to do, but endianness is not the issue. Please give use a better explanation of what you hope to accomplish. Also, As Ken Y-N said you should use memcpy for arbitrary data, so you can control the size. — mreff555
– mreff555, Commented Nov 19, 2020 at 17:10

Zeltrax · Accepted Answer · 2020-11-19 16:59:22Z

1

strcpy(&buffer[16],&buffer[20]); will copy shellcode to &buffer[16], not the address of shellcode, which is &buffer[20]. You have to translate &buffer[20] into byte array then copy it to &buffer[16].

For example, &buffer[20] == 0xbfff1234. Then you should have a char shell_addr[5] = "\x34\x12\xff\xbf\x00" and do strcpy(&buffer[16], a);

answered Nov 19, 2020 at 16:59

Zeltrax

3193 silver badges11 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

Overwrite return address In C with a unsigned long variable using buffer overflow

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related