Stack Buffer Overflow

Question

How do you store the address of a function in a char* so that it overflows the strcpy() return address in order to return to a different function.

If you have a function:

void f()
{
     printf("We made it");
     exit(0);
}
void main()
{
    char *add;
    //Do something like: add = &f;
    char str[4] = "123";
    strcpy(str, add);
    return 0;
}

From my understanding all you need to do is overwrite the return address stored in the call of strcpy() by making add be large and have the address of f in it. Is this correct? How can this be done?

Answer 1

make a nop sled, then put your payload at the end of it. https://www.corelan.be/index.php/2009/07/19/exploit-writing-tutorial-part-1-stack-based-overflows/ This is a very detailed way of how to do it. The payload is written in shell code which is kind of complicated. But this will show you the basics of an overflow.

If I recall correctly, http://insecure.org/stf/smashstack.html is also another tutorial on the topic.