Our preceding attacks have all caused the program to jump to the code for some other function, which then causes the program to exit. As a result, it was acceptable to use exploit strings that corrupt the stack, overwriting the saved value of registers and the return pointer.
The most sophisticated form of buffer overflow attack causes the program to execute some exploit code that patches up the stack and makes the program return to the original calling function (test in this case). The calling function is oblivious to the attack. This style of attack is tricky, though, since you must:
Your job for this level is to supply an exploit string that will cause
getbuf
to return your cookie back to test
,
rather than the value 1. You can see in the code for test that this will
cause the program to go "Boom!" Your exploit code should set your cookie
as the return value, restore any corrupted state, push the correct return
location on the stack, and execute a ret
instruction to
really return to test.
Some Advice:
gdb
to get the information you need to
construct your exploit string. Set a breakpoint within
getbuf
and run to this breakpoint. Determine parameters
such as the saved return address.
gcc
and objdump
do all of the work of generating a byte encoding of the instructions.
(An example of how to do this is included in the main assignment page.
See the section of "Hint on Generating Byte Codes".)
bufbomb
.
Once you complete this level, pause to reflect on what you have accomplished. You caused a program to execute machine code of your own design. You have done so in a sufficiently stealthy way that the program did not realize that anything was amiss.