current community

your communities

more stack exchange communities

Stack Exchange
tour help
stack overflow careers
Take the 2-minute tour ×
Stack Overflow is a question and answer site for professional and enthusiast programmers. It's 100% free.
up vote 0 down vote favorite

I'm learning about buffer overflows and found a challenge that has a program somewhat like this:

int main() {
    do_something()
    return 0;
}

void do_something() {
    //get inputs
    printf("Did something.");
}

void do_something_else() {
    printf("Did something else.")
}

Assuming there was a buffer overflow in do_something(), how would I make it call the function do_something_else()?

share|improve this question

2 Answers 2

up vote 1 down vote

What you're asking about is called shellcoding. You can get an intro from http://insecure.org/stf/smashstack.html. The basic idea is that you'll have do_something read input into a fixed sized buffer. Then you'll send more data into the buffer such that it overwrites the data on the stack, and if you write it just right you can make the spot that holds the return address point to do_something_else, so when do_something tries to return it will go where you want it to

You'll need to use a debugger to get the right address of the do_something_else function, and probably to get the real number of bytes you need to override the buffer by to get to the return address.

share|improve this answer
up vote 1 down vote

When a function is called, the compiler automatically pushes the value of saved return address onto the stack. After that, it pushes the value of ebp onto the stack.

So when main calls do_something(), the values of saved eip, saved ebp will be pushed onto the stack in that order.

The saved eip will most probably be pointing to somewhere in the main(). If you overwrite that address with the address of do_something_else(), the do_something_else() function will be executed after do_something() is executed.

So your payload should look something like this:

"(bunch of A's or \x90's to reach ebp"+"BBBB(random value to fill ebp)"+"(address of do_something_else())" Hope that helped.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.