I’ve just read Smashing the Stack for Fun and Profit (http://insecure.org/stf/smashstack.html) and want to explore more. Then I found this code here: https://github.com/yangsu/Stack-Smashing
I understand the principles stated here quite clearly, and I followed the steps closely, but got some error. I opened 2 terminals.
In the first terminal: (The “Segmentation fault” line appeared after typing the “cat” line in the other terminal)
$ sudo sysctl -w kernel.randomize_va_space=0
$ gcc -z execstack -fno-stack-protector webserver.c -o server
$ ./server 5000
Segmentation fault. Shutting down peacefully, then rebooting.
$
In the second terminal,
$ g++ generate.cpp -o generate
$ ./generate
$ cat data.dat | nc 127.0.0.1 5000
$
Was the error caused by wrong formats or paramaters of the “cat” line? Or any other causes?
Also, as written in the function sigsegv, the server should restart after 2 sec. But in my execution here it didn’t. Why is this?
Thank you very much!
Learning to smash the stack starts with paying attention to the smallest details.
A successful exploit and a simple process crash are almost exactly the same. You must find the fine difference and change the exploit.
Start by debugging the crashed program.
Why exactly did it crash? What was written where on the stack?
Did it crash because the return address was modified (in this case you’re half way there), or for some other reason?
If you can’t answer these questions, then even if you get things working, you will learn nothing.