Stack Three
Stack3 looks at environment variables, and how they can be set, and overwriting function pointers stored on the stack (as a prelude to overwriting the saved EIP)
Hints
both gdb and objdump is your friend you determining where the win() function lies in memory.
Source code
#include <stdlib.h>
#include <unistd.h>
#include <stdio.h>
#include <string.h>
void win()
{
printf("code flow successfully changed\n");
}
int main(int argc, char **argv)
{
volatile int (*fp)();
char buffer[64];
fp = 0;
gets(buffer);
if(fp) {
printf("calling function pointer, jumping to 0x%08x\n", fp);
fp();
}
}There is a pointer fp which is set to 0. The program then jumps to the address in the fp pointer.
The win function is what we want to call. However it is not called by the main function.
Therefore we have to redirect program execution by overwriting the fp pointer.
In order to do that, we have to know the address of the win function.
So we set the value of fp to 0x08048424.
Let's look at the program in gdb.
We can see that the instruction at main+57 is what sets up the function call.
Let's find the distance between the buffer and fp.
Therefore we need 68 bytes in total, 64 bytes to fill the buffer and 4 bytes to overwrite the fp function pointer.
Note that the value is stored in little-endian.
Exploit
Last updated
Was this helpful?