Question

I’m working on a basic buffer overflow project. The goal is to overflow a buffer to run a shell. The code I’m exploiting looks like this:

int func(char *str)
{
    //4 bytes for str, 16 bytes for the buffer, 4 for the ebp, 4 for the ret
    char buffer[12];

    /* The following statement has a buffer overflow problem */ 
    strcpy(buffer, str);

    return 1;
}

Essentially, I am creating str so that it will overwrite the return address of func() with the address of some shellcode that starts a shell.

If I compile my code with the gcc -g option and run the executable in gdb, everything works fine. However, if I omit the -g, I get a segfault instead of a shell.

If I understand things correctly, this is most likely due to the fact that gdb adds things to the stack. This would mean that I need to change the value that I use to replace func’s return address. How would I go about finding this new address?

I have tried adding a printf(“%p”, str); to func, then compiling and running with and without -g but this prints the same thing either way. I have tried several other similar things as well.

Answer 1

I found the solution. Apparently it is not the -g flag that changes the stack – running it with gdb is. If I use printf when running in gdb and when running the program independently, the difference appears and I am able to adjust my code accordingly