	[x] Posted via EE Mobile
	Search, ask, and monitor your questions on the go with EE Mobile. Visit Experts Exchange from your mobile device and never be out of touch again.

Question

	[x] Attachment Details

[x]

The Solution Rating System

With so many solutions, how can you tell which solutions are most likely to help you and which ones are not? To provide you with a tool to use, we rate our solutions based on various elements that most accurately determine if a solution is a quality solution. To explain what factors affect the solution rating, here are the elements we take into consideration when formulating our solution rating.

The Grade of the Solution
The Zone Rank of the Expert Providing the Solution
The Number of Author and Expert Comments
The Number of Experts Contributing
The Feedback of the Community

Your Input Matters
Because of the way the system is set up, the most important variable in this equation is you. As a member of Experts Exchange, you are able to cast your vote on the quality of the solutions in regard to how complete, accurate, helpful and easy to understand each solution is. When you provide your feedback, each rating is adjusted accordingly. So, if you see a solution that has a poor rating that you think is a good solution, let us know by rating it. As you do, the rating will be adjusted and will become more accurate for other members of our site.

If you have any suggestions that you would like to make for our rating system, please ask a question in the Suggestions Zone of Community Support.

Thank you!

7.7

Buffer Bomb Phase 0

Asked by purewin in Assembly Programming Language, C Programming Language, Miscellaneous Programming

Starting this Buffer Overflow assignment and I'm not really sure how to proceed. Figure I could just use a kick in the right direction. Here is what I've been given:

Also I tried stepping through the code from the very beginning but I kept getting this error

(gdb) s
Single stepping until exit from function __libc_start_main,
which has no line number information.
Warning:
Cannot insert breakpoint 4.
Error accessing memory address 0x19: Input/output error.

I'm not sure what it means.

I know that I need to inject a string somewhere but I don't really understand how to do this or even figure out what the string needs to be....Any Help would be great. Thanks.

Get your answer NOW

         
           
             1:
2:
3:
4:
5:
6:
7:
8:
9:
10:
11:
12:
13:
14:
15:
16:
17:
18:
19:
20:
21:
22:
23:
24:
25:
26:
27:
28:
29:
30:
31:
32:
33:
34:
35:
36:
37:
38:
39:
40:
41:
42:
43:
44:
45:
46:
47:
48:
49:
50:
51:
52:
53:
54:
55:
56:
57:
58:
59:
60:
61:
62:
63:
64:
65:
66:
67:
68:
69:
70:
71:
72:
73:
74:
75:
76:
77:
78:
79:
80:
81:
82:
83:
84:
85:
86:
87:
88:
89:
90:
91:
92:
93:

           
           
             Level 0: Candle (10 pts) 
The function getbuf() is called within bufbomb by a function test() having the following C code:
1 void test()
2 {
3 int val;
4 volatile int local = 0xdeadbeef;
5 entry_check(3); /* Make sure entered this function properly */
6 val = getbuf();
7 /* Check for corrupted stack */
8 if (local != 0xdeadbeef) {
9 printf("Sabotaged!: the stack has been corrupted\n");
10 }
11 else if (val == cookie) {
12 printf("Boom!: getbuf returned 0x%x\n", val);
13 validate(3);
14 }
15 else {
16 printf("Dud: getbuf returned 0x%x\n", val);
17 }
18 }
When getbuf() executes its return statement (line 5 of getbuf()), the program ordinarily resumes execution within function test() (at line 8 of this function). Within the file bufbomb, there is a function smoke() having the following C code:
void smoke()
{
entry_check(0); /* Make sure entered this function properly */
printf("Smoke!: You called smoke()\n");
validate(0);
exit(0);
}
Your task is to get bufbomb to execute the code for smoke() when getbuf() executes its return statement, rather than returning to test(). You can do this by supplying an exploit string that overwrites the stored return pointer in the stack frame for getbuf() with the address of the first instruction in smoke(). Note that your exploit string may also corrupt other parts of the stack state, but this will not cause a problem, since smoke() causes the program to exit directly. Some Advice:
All the information you need to devise your exploit string for this level can be determined by examining a diassembled version of bufbomb.
Be careful about byte ordering.
ou might want to use GDB to step the program through the last few instructions of getbuf() to make sure it is doing the right thing.
The placement of buf within the stack frame for getbuf() depends on which version of gcc was used to compile bufbomb. You will need to pad the beginning of your exploit string with the proper number of bytes to overwrite the return pointer. The values of these bytes can be arbitrary.  
Dump of assembler code for function test:
0x08048f60 <test+0>:    push   %ebp
0x08048f61 <test+1>:    mov    %esp,%ebp
0x08048f63 <test+3>:    sub    $0x18,%esp
0x08048f66 <test+6>:    movl   $0xdeadbeef,0xfffffffc(%ebp)
0x08048f6d <test+13>:   movl   $0x3,(%esp)
0x08048f74 <test+20>:   call   0x8048920 <entry_check>
0x08048f79 <test+25>:   call   0x8048f40 <getbuf>
0x08048f7e <test+30>:   mov    %eax,%edx
0x08048f80 <test+32>:   mov    0xfffffffc(%ebp),%eax
0x08048f83 <test+35>:   cmp    $0xdeadbeef,%eax
0x08048f88 <test+40>:   je     0x8048f98 <test+56>
0x08048f8a <test+42>:   movl   $0x8049780,(%esp)
0x08048f91 <test+49>:   call   0x8048794 <puts@plt>
0x08048f96 <test+54>:   leave  
0x08048f97 <test+55>:   ret    
0x08048f98 <test+56>:   cmp    0x804a1b0,%edx
0x08048f9e <test+62>:   je     0x8048fb2 <test+82>
0x08048fa0 <test+64>:   mov    %edx,0x4(%esp)
0x08048fa4 <test+68>:   movl   $0x8049957,(%esp)
0x08048fab <test+75>:   call   0x8048724 <printf@plt>
0x08048fb0 <test+80>:   leave  
0x08048fb1 <test+81>:   ret    
0x08048fb2 <test+82>:   mov    %edx,0x4(%esp)
0x08048fb6 <test+86>:   movl   $0x804993a,(%esp)
0x08048fbd <test+93>:   call   0x8048724 <printf@plt>
0x08048fc2 <test+98>:   movl   $0x3,(%esp)
0x08048fc9 <test+105>:  call   0x8048a60 <validate>
0x08048fce <test+110>:  leave  
0x08048fcf <test+111>:  ret    
End of assembler dump. 
Dump of assembler code for function smoke:
0x08048d90 <smoke+0>:   push   %ebp
0x08048d91 <smoke+1>:   mov    %esp,%ebp
0x08048d93 <smoke+3>:   sub    $0x8,%esp
0x08048d96 <smoke+6>:   movl   $0x0,(%esp)
0x08048d9d <smoke+13>:  call   0x8048920 <entry_check>
0x08048da2 <smoke+18>:  movl   $0x8049903,(%esp)
0x08048da9 <smoke+25>:  call   0x8048794 <puts@plt>
0x08048dae <smoke+30>:  movl   $0x0,(%esp)
0x08048db5 <smoke+37>:  call   0x8048a60 <validate>
0x08048dba <smoke+42>:  movl   $0x0,(%esp)
0x08048dc1 <smoke+49>:  call   0x80487d4 <exit@plt>
0x08048dc6 <smoke+54>:  lea    0x0(%esi),%esi
0x08048dc9 <smoke+57>:  lea    0x0(%edi),%edi
End of assembler dump. 
Dump of assembler code for function getbuf:
0x08048f40 <getbuf+0>:  push   %ebp
0x08048f41 <getbuf+1>:  mov    %esp,%ebp
0x08048f43 <getbuf+3>:  sub    $0x18,%esp
0x08048f46 <getbuf+6>:  lea    0xfffffff4(%ebp),%eax
0x08048f49 <getbuf+9>:  mov    %eax,(%esp)
0x08048f4c <getbuf+12>: call   0x8048dd0 <Gets>
0x08048f51 <getbuf+17>: mov    $0x1,%eax
0x08048f56 <getbuf+22>: leave  
0x08048f57 <getbuf+23>: ret    
0x08048f58 <getbuf+24>: nop    
0x08048f59 <getbuf+25>: lea    0x0(%esi),%esi
End of assembler dump.

           
         

20091111-EE-VQP-89 - Hierarchy / EE_QW_3_20080625

Hall of Fame

1. Infinity0899,180
2. DropZone10,500
3. t0t08,520
4. ozo7,000
5. abel4,375
6. evilrix4,332
7. jcgriff24,000
8. garycase3,750
9. nobus3,000
10. billprew2,860
11. TheLearn...2,500
11. ikework2,500
11. ravenpl2,500
14. itsmeandn...2,332
15. giltjr2,164
16. woolmilkp...2,150
17. Hypo2,000
17. tliotta2,000
17. vo1d2,000
17. Agarici2,000
17. oBdA2,000
17. Sandra-242,000
17. moorhous...2,000
17. bounsy2,000
17. McKnife2,000
17. noci2,000
17. kaufmed2,000
17. Eladla2,000
17. DefreeCo...2,000
17. mgonullu2,000
17. HooKooD...2,000
17. comegets...2,000
17. sjl19862,000
17. xenacode2,000
17. HalfAsleep2,000
17. climbgunks2,000
17. roman22,000
17. intelfx2,000

1. Infinity08233,426
2. dimitry158,876
3. grg99116,208
4. mzvika56,009
5. BrianGEF...52,043
6. BeyondWu51,715
7. PaulCasw...50,139
8. manish_r...30,623
9. stefan7325,328
10. PeterdLo20,472
11. Dancie17,978
12. ozo16,114
13. mtmike15,779
14. abith13,536
15. billious12,777
16. DeanHorak12,698
17. DropZone11,500
18. joghurt11,070
19. _Katka_10,600
20. craigward...9,570
21. AlexFM9,504
22. evilrix9,332
23. Jase-Co...9,100
24. ravenpl8,980
25. TheLearn...8,875

Buffer Bomb Phase 0

Asked by purewin in Assembly Programming Language, C Programming Language, Miscellaneous Programming

About this solution