Stack One
This level looks at the concept of modifying variables to specific values in the program, and how the variables are laid out in memory. This level is at /opt/protostar/bin/stack1
Hints
If you are unfamiliar with the hexadecimal being displayed, “man ascii” is your friend
Protostar is little endian
Source code
#include <stdlib.h>
#include <unistd.h>
#include <stdio.h>
#include <string.h>
int main(int argc, char **argv)
{
volatile int modified;
char buffer[64];
if(argc == 1) {
errx(1, "please specify an argument\n");
}
modified = 0;
strcpy(buffer, argv[1]);
if(modified == 0x61626364) {
printf("you have correctly got the variable to the right value\n");
} else {
printf("Try again, you got 0x%08x\n", modified);
}
}This program requires us to pass arguments, with argv[0] being the program name. If we don't provide an extra argument, we are asked to specify an argument.
The strcpy system call is used to read user input into the buffer.
Let's look at it's manual page.
We can see that the characters are read from argv[1] and copied to the buffer.
It is better that the gets syscall but it still has it's own problems.
So the strcpy syscall stores characters past the end of the buffer. This essentially breaks the limit set on the buffer which means we can input more than 64 bytes.
This is the vulnerability that we have to exploit.
But before that let's go through the rest of the code.
There is an if statement which checks if the value of modified in not equal to 0x61626364. If it is not equal to 0, it prints out a string else it prompts us to try again.
We have to overwrite the modified variable using a buffer overflow. For that we have have to know where the modified variable is located.
Let's disassemble the program in gdb.
The instruction at main+67 sets up the check.
The value in eax is compared with 0x61626364 which in ASCII is abcd. This value is moved from esp+0x5c.
Next, we want to locate the buffer.
In 32-bit assembly the arguments for a call are stored onto the stack.
In our program the gets syscall takes the location of the buffer as argument. This buffer is located at esp+0x1c.
The distance between the location of the modified variable and the buffer is the following:
The variable is located right where the buffer ends.
Therefore we need 68 bytes in total, 64 bytes to fill the buffer and 4 bytes to overwrite the modified variable.
Ah! The characters are being stored in little-endian format. So abcd is being flipped to dcba.
In order to pass the check, we have to provide the the flipped string i.e. dcba.
Exploit
Last updated
Was this helpful?