stack5

Stack5

URL: https://exploit.education/protostar/stack-five/ Stack5 is a standard buffer overflow, this time introducing shellcode.

This level is at /opt/protostar/bin/stack5

Hints

  • At this point in time, it might be easier to use someone elses shellcode

  • If debugging the shellcode, use \xcc (int3) to stop the program executing and return to the debugger remove the int3s once your shellcode is done.

  • Source code

#include <stdlib.h>
#include <unistd.h>
#include <stdio.h>
#include <string.h>

int main(int argc, char **argv)
{
  char buffer[64];

  gets(buffer);
}

Writeup

Here we have to use the shell code Steps to follow:

  1. check for the padding using random string and you will get the padding from the $eip and $ebp pointer

  2. we have to get the address from where we can enter our shell

  3. thirdly, we will get error in our method and after debugging I found out that, the address is different, so we have to use NOP for that.

So let us start from GDB.

From this, we can say that the offset is 76 and the $eip pointer will be 4 bytes after the current $eip, so 0xbffff7bc + 4 = 0xbffff780.

Then as per the discussion, we will append NOP the the hex value of NOP is \x90 and will add 100 times (it doesn't matter how many time we add NOP)

Then adding shellcode from the shell storm website.

Therefore, the exploit will be

Solution:

Previousstack4Nextstack6

Last updated