A much more sophisticated form of buffer attack involves supplying a string
that encodes actual machine instructions. The exploit string then overwrites
the return pointer with the starting address of these instructions. When the
calling function (in this case getbuf
) executes its ret
instruction, the program will start executing the instructions on the stack
rather than returning. With this form of attack, you can get the program to
do almost anything. The code you place on the stack is called the exploit
code. This style of attack is tricky, though, because you must get machine
code onto the stack and set the return pointer to the start of this code.
Within the file bufbomb
there is a function bang
having the following C code:
int global_value = 0; void bang(int val) { if (global_value == cookie) { printf("Bang!: You set global_value to 0x%x\n", global_value); validate(2); } else printf("Misfire: global_value = 0x%x\n", global_value); exit(0); }
Similar to Level 0 and 1, your task is to get bufbomb
to
execute the code for bang
rather than returning to
test
. Before this, however, you must set global
variable global_value
to your team's cookie. Your exploit
code should set global_value
, push the address of bang on
the stack, and then execute a ret instruction to cause a jump to the code
for bang.
Some Advice:
global_value
and
the location of the buffer.
objdump
. You should be able to get the exact byte sequence
that you will type at the prompt.
(An example of how to do this is included in the main assignment page.
See the section of "Hint on Generating Byte Codes".)
bufbomb
.
movl $0x4, %eax
moves the value 0x00000004
into
register %eax
; whereas movl 0x4, %eax
moves the
value at memory location 0x00000004
into %eax
.
Since that memory location is usually undefined, the second instruction
will cause a segfault!
jmp
or a call
instruction to jump to the code
for bang. These instructions uses PC-relative addressing, which is very
tricky to set up correctly. Instead, push an address on the stack and use the
ret
instruction.