Level 2: Firecracker (15 pts)

A much more sophisticated form of buffer attack involves supplying a string that encodes actual machine instructions.  The exploit string then overwrites the return pointer with the starting address of these instructions.  When the calling function (in this case getbuf) executes its ret instruction, the program will start executing the instructions on the stack rather than returning.  With this form of attack, you can get the program to do almost anything.  The code you place on the stack is called the exploit code.  This style of attack is tricky, though, because you must get machine code onto the stack and set the return pointer to the start of this code. 

Within the file bufbomb there is a function bang having the following C code:

    int global_value = 0;

    void bang(int val)
    {
        if (global_value == cookie) {
            printf("Bang!: You set global_value to 0x%x\n", global_value);
            validate(2);
        } else
            printf("Misfire: global_value = 0x%x\n", global_value);
        exit(0);
    }
  

Similar to Level 0 and 1, your task is to get bufbomb to execute the code for bang rather than returning to test  Before this, however, you must set global variable global_value to your team’s cookie.  Your exploit code should set global_value, push the address of bang on the stack, and then execute a ret instruction to cause a jump to the code for bang. 

Some Advice:


Back to the assignment page


Last Change: 11 February 2014 / Michael Scott's email address