Level 3:  Dynamite (20 pts)

Our preceding attacks have all caused the program to jump to the code for some other function, which then causes the program to exit.  As a result, it was acceptable to use exploit strings that corrupt the stack, overwriting the saved value of register %ebp and the return pointer. 

The most sophisticated form of buffer overflow attack causes the program to execute some exploit code that patches up the stack and makes the program return to the original calling function (test in this case).  The calling function is oblivious to the attack.  This style of attack is tricky, though, since you must: 

  1. get machine code onto the stack,
  2. set the return pointer to the start of this code, and
  3. undo the corruptions made to the stack state.

Your job for this level is to supply an exploit string that will cause getbuf to return your cookie back to test, rather than the value 1.  You can see in the code for test that this will cause the program to go “Boom!”  Your exploit code should set your cookie as the return value, restore any corrupted state, push the correct return location on the stack, and execute a ret instruction to really return to test. 

Some Advice

Once you complete this level, pause to reflect on what you have accomplished.  You caused a program to execute machine code of your own design.  You have done so in a sufficiently stealthy way that the program did not realize that anything was amiss. 

Back to the assignment page

Last Change: 11 February 2014 / Michael Scott's email address