General Background: I have written an echo server trying to implement an example of BoF in C that utilizes a strcpy() function call like such:
// .... including the corresponding libraries depending on host environment
#include <stdio.h> // crossed platform headers
#include <string.h> // string header, for strcpy
#include <stdlib.h> // stardard lib, for exit()
void echo(void); // infinite loop echo serving client
char* vuln_func(char* recieved); // BoF vulnerable function that uses strcpy from string.h
int main(void)
{
... setting up echo server
echo();
return 0;
}
void echo(void)
{
char *send_str; // declaring the pointer to the string recieved from vulnFunc
char recv_str[1024]; // variable declaration to store input string from client
// infinite loop to echo serve clients
while(1)
{
... recieving string from client and storing it starting at location recv_str
// calling vuln_func and inputting the received string from client
send_str = vuln_func(recv_str);
...echoing the send_str back to the client
}
}
char* vuln_func( char* recieved)
{
char* sending_str = (char*)calloc(100, sizeof(char));
char buf[100];
int i; // declaring counter for loop
strcpy(buf, recieved);
for (i = 0; i < strlen(buf); i++) // for loop to populate return string with the send
{
sending_str[i] = buf[i];
}
return sending_str;
}
Problem: So once we feed the server a big enough input string, the server will generate an Access Violation with offset 41414141 (which is What we wanted); however once we disassembled the exe in a disassembler/debugger (I used immunity Debugger)at the point of the violation neither the ESP nor the EIP was overwritten with the string of As (for instance). While the EBP register was overwritten with the overflown big string of As.
Solution: So I did some googling around and saw similar example codes of the same kind (Echo Server with a BoF vuln) and tried different things with the vuln_func like such:
void vuln_func( char* recieved)
{
char buf[100];
strcpy(buf, recieved);
}
Or:
int vuln_func( char* recieved)
{
char buf[100];
strcpy(buf, recieved);
return 1;
}
and the echo function will look like such:
void echo(void)
{
char recv_str[1024]; // variable declaration to store input string from client
// infinite loop to echo serve clients
while(1)
{
... recieving string from client and storing it starting at location recv_str
// calling vuln_func with string received from client
vuln_func(recv_str);
...echoing the recv_str back to the client
}
}
so have the echo function echo back the recv_str instead of the send_str which imho defeats the entire purpose of the vuln_func call, but for the purpose of demonstrating this BoF Vulnerability, we will leave it in there. After checking with Immunity Debugger, both the ESP and the EIP registers are successfully overwritten with the string ("A*128"), problem fixed!! Great
Question: Why did the problem behave that way?
- How come when returning a pointer(address) to a string to the calling function it prevents the EIP to be overwritten, while returning void, or int will cause the EIP register to be overwritten as expected
- How does the EIP register store its value in the two scanrios
mentioned above (with one vuln_func returning char* and other vuln_func
returning void )? - Does the problem behaving this way have anything to do with the stack alignment, I know that (having the EIP overwritten) would be an issue if strcpy was called in main(), studying from other SE posts/answers
As you can see, the problem was solved but I don't understand why it worked. Please explain, or point to the write direction. Much kudos and thanks in advance.
