Stack Two
Stack2 looks at environment variables, and how they can be set.
Source code
#include <stdlib.h>
#include <unistd.h>
#include <stdio.h>
#include <string.h>
int main(int argc, char **argv)
{
volatile int modified;
char buffer[64];
char *variable;
variable = getenv("GREENIE");
if(variable == NULL) {
errx(1, "please set the GREENIE environment variable\n");
}
modified = 0;
strcpy(buffer, variable);
if(modified == 0x0d0a0d0a) {
printf("you have correctly modified the variable\n");
} else {
printf("Try again, you got 0x%08x\n", modified);
}
}This challenge is similar to Stack One except that we are using the environment variable GREENIE to pass user input.
The strcpy syscall uses the environment variable as it's second argument.
As we can see the second argument is the source. So the environment variable GREENIE is being copied into the buffer.
Let's disassemble the program in gdb.
The instruction at main+16 calls the getenv syscall.
We can set an environment variable using the export syscall, and then running the program.
The instruction at main+84 compares the modified variable with 0xd0a0d0a.
The distance between the location of the modified variable and the buffer is the following:
The variable is located right where the buffer ends.
Therefore we need 68 bytes in total, 64 bytes to fill the buffer and 4 bytes to overwrite the modified variable.
Exploit
Note that the overwrite value is in little-endian.
Last updated
Was this helpful?