Buffer Overflow Bomb Phase 1

Just wanted to make sure I'm starting in the right direction with this one. I would start off by replacing the call to smoke() from phase 0 with the address of fizz() correct?

Level 1: Sparkler (20 pts)

Within the file bufbomb there is also a function fizz() having the following C code:
void fizz(int val)
{
entry_check(1); /* Make sure entered this function properly */
if (val == cookie) {
printf("Fizz!: You called fizz(0x%x)\n", val);
validate(1);
}
else
printf("Misfire: You called fizz(0x%x)\n", val);
exit(0);
}
Similar to Level 0, your task is to get bufbomb to execute the code for fizz() rather than returning to test. In this case, however, you must make it appear to fizz() as if you have passed your cookie as its argument. You can do this by encoding your cookie in the appropriate place within your exploit string.
Note that the program wont really call fizz() it will simply execute its code. This has important implications for where on the stack you want to place your cookie.

Instant Access to this Solution

Plus...

30 Day FREE access, no risk, no obligation

Collaborate with the world's top tech experts

Unlimited access to our exclusive solution database

Never be left without tech help again

Trusted by hundreds of thousands everyday for fast, accurate and reliable tech support.

"The time we save is the biggest benefit of Experts Exchange to Warner Bros. What could take multiple guys 2 hours or more each to find is accessed in around 15 minutes on Experts Exchange." Mike Kapnisakis, Warner Bros.

"Our team likes having a resource that is more secure than just using Google and most experts using this service really know their stuff. It's nice to look here first versus using Google." Dayna Sellner, Lockheed Martin

"Anytime that I've been stumped with a problem, 9 out of 10 times Experts Exchange has either the accepted solution or an open discussion of the potential solution to the problem." Kenny Red, eBay Inc.

See what Experts Exchange can do for you.

Got a question?

We've got the answer.

Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.

Screenshot of Experts Exchange Knowledgebase

Need individual assistance?

Our experts are ready to help.

If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.

Want to learn from the best?

Read articles from industry experts.

Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.

Working on a long term project?

Store your work and research.

Save solutions to your questions, answers you’ve discovered through searching plus helpful articles in your personal knowledgebase for easy future access.

Join the Community

Give a Little. Get a Lot.

Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.

Okay so I've looked at the stack as it progresses through fizz() and here is what I have. I need to encode my string so that my cookie ends up in ebx so when fizz reaches this part

0x08048d46 <fizz+22>: cmp 0x804a1b0,%ebx
0x08048d4c <fizz+28>: je 0x8048d70 <fizz+64>

they are equal and phase 1 should be done. OR I have this backwards and my cookie needs to be in the address 0x804a1b0.

So first this is ebp being pushed onto the stack correct?

0x08048d31 in fizz ()
(gdb) x/32xw $sp
0xbfffb40c: 0xbfffb428

then ebx is pushed onto the stack

(gdb) x/32xw $sp
0xbfffb408: 0x00000000 0xbfffb428

Then I'm not sure what happens or sure where the address 0x0804a108 came from. I know at this point esp-14 is executed. Any idea what occurs here? And where 0x0804a108 came from?

Breakpoint 1, 0x08048f57 in getbuf ()
(gdb) x/32xw $sp
0xbfffb40c:     0x08048d30      0x00000000      0x0024f4c0      0x08049983
0xbfffb41c:     0xbfffb434      0xbfffb434      0xdeadbeef      0xbfffe9f8
0xbfffb42c:     0x08049056      0x08049983      0x000000f4      0x00003560
0xbfffb43c:     0x00000000      0xf4f4f4f4      0xf4f4f4f4      0xf4f4f4f4
0xbfffb44c:     0xf4f4f4f4      0xf4f4f4f4      0xf4f4f4f4      0xf4f4f4f4
0xbfffb45c:     0xf4f4f4f4      0xf4f4f4f4      0xf4f4f4f4      0xf4f4f4f4
0xbfffb46c:     0xf4f4f4f4      0xf4f4f4f4      0xf4f4f4f4      0xf4f4f4f4
0xbfffb47c:     0xf4f4f4f4      0xf4f4f4f4      0xf4f4f4f4      0xf4f4f4f4
(gdb) si
0x08048d30 in fizz ()
(gdb) x/32xw $sp
0xbfffb410:     0x00000000      0x0024f4c0      0x08049983      0xbfffb434
0xbfffb420:     0xbfffb434      0xdeadbeef      0xbfffe9f8      0x08049056
0xbfffb430:     0x08049983      0x000000f4      0x00003560      0x00000000
0xbfffb440:     0xf4f4f4f4      0xf4f4f4f4      0xf4f4f4f4      0xf4f4f4f4
0xbfffb450:     0xf4f4f4f4      0xf4f4f4f4      0xf4f4f4f4      0xf4f4f4f4
0xbfffb460:     0xf4f4f4f4      0xf4f4f4f4      0xf4f4f4f4      0xf4f4f4f4
0xbfffb470:     0xf4f4f4f4      0xf4f4f4f4      0xf4f4f4f4      0xf4f4f4f4
0xbfffb480:     0xf4f4f4f4      0xf4f4f4f4      0xf4f4f4f4      0xf4f4f4f4
(gdb) si
0x08048d31 in fizz ()
(gdb) x/32xw $sp
0xbfffb40c:     0xbfffb428      0x00000000      0x0024f4c0      0x08049983
0xbfffb41c:     0xbfffb434      0xbfffb434      0xdeadbeef      0xbfffe9f8
0xbfffb42c:     0x08049056      0x08049983      0x000000f4      0x00003560
0xbfffb43c:     0x00000000      0xf4f4f4f4      0xf4f4f4f4      0xf4f4f4f4
0xbfffb44c:     0xf4f4f4f4      0xf4f4f4f4      0xf4f4f4f4      0xf4f4f4f4
0xbfffb45c:     0xf4f4f4f4      0xf4f4f4f4      0xf4f4f4f4      0xf4f4f4f4
0xbfffb46c:     0xf4f4f4f4      0xf4f4f4f4      0xf4f4f4f4      0xf4f4f4f4
0xbfffb47c:     0xf4f4f4f4      0xf4f4f4f4      0xf4f4f4f4      0xf4f4f4f4
(gdb) si
0x08048d33 in fizz ()
(gdb) x/32xw $sp
0xbfffb40c:     0xbfffb428      0x00000000      0x0024f4c0      0x08049983
0xbfffb41c:     0xbfffb434      0xbfffb434      0xdeadbeef      0xbfffe9f8
0xbfffb42c:     0x08049056      0x08049983      0x000000f4      0x00003560
0xbfffb43c:     0x00000000      0xf4f4f4f4      0xf4f4f4f4      0xf4f4f4f4
0xbfffb44c:     0xf4f4f4f4      0xf4f4f4f4      0xf4f4f4f4      0xf4f4f4f4
0xbfffb45c:     0xf4f4f4f4      0xf4f4f4f4      0xf4f4f4f4      0xf4f4f4f4
0xbfffb46c:     0xf4f4f4f4      0xf4f4f4f4      0xf4f4f4f4      0xf4f4f4f4
0xbfffb47c:     0xf4f4f4f4      0xf4f4f4f4      0xf4f4f4f4      0xf4f4f4f4
(gdb) si
0x08048d34 in fizz ()
(gdb) x/32xw $sp
0xbfffb408:     0x00000000      0xbfffb428      0x00000000      0x0024f4c0
0xbfffb418:     0x08049983      0xbfffb434      0xbfffb434      0xdeadbeef
0xbfffb428:     0xbfffe9f8      0x08049056      0x08049983      0x000000f4
0xbfffb438:     0x00003560      0x00000000      0xf4f4f4f4      0xf4f4f4f4
0xbfffb448:     0xf4f4f4f4      0xf4f4f4f4      0xf4f4f4f4      0xf4f4f4f4
0xbfffb458:     0xf4f4f4f4      0xf4f4f4f4      0xf4f4f4f4      0xf4f4f4f4
0xbfffb468:     0xf4f4f4f4      0xf4f4f4f4      0xf4f4f4f4      0xf4f4f4f4
0xbfffb478:     0xf4f4f4f4      0xf4f4f4f4      0xf4f4f4f4      0xf4f4f4f4
(gdb) si
0x08048d37 in fizz ()
(gdb) x/32xw $sp
0xbfffb3f4:     0x00000000      0x0804a108      0xbfffb434      0x00857ff4
0xbfffb404:     0x00000003      0x00000000      0xbfffb428      0x00000000
0xbfffb414:     0x0024f4c0      0x08049983      0xbfffb434      0xbfffb434
0xbfffb424:     0xdeadbeef      0xbfffe9f8      0x08049056      0x08049983
0xbfffb434:     0x000000f4      0x00003560      0x00000000      0xf4f4f4f4
0xbfffb444:     0xf4f4f4f4      0xf4f4f4f4      0xf4f4f4f4      0xf4f4f4f4
0xbfffb454:     0xf4f4f4f4      0xf4f4f4f4      0xf4f4f4f4      0xf4f4f4f4
0xbfffb464:     0xf4f4f4f4      0xf4f4f4f4      0xf4f4f4f4      0xf4f4f4f4
(gdb) si
0x08048d3a in fizz ()
(gdb) x/32xw $sp
0xbfffb3f4:     0x00000000      0x0804a108      0xbfffb434      0x00857ff4
0xbfffb404:     0x00000003      0x00000000      0xbfffb428      0x00000000
0xbfffb414:     0x0024f4c0      0x08049983      0xbfffb434      0xbfffb434
0xbfffb424:     0xdeadbeef      0xbfffe9f8      0x08049056      0x08049983
0xbfffb434:     0x000000f4      0x00003560      0x00000000      0xf4f4f4f4
0xbfffb444:     0xf4f4f4f4      0xf4f4f4f4      0xf4f4f4f4      0xf4f4f4f4
0xbfffb454:     0xf4f4f4f4      0xf4f4f4f4      0xf4f4f4f4      0xf4f4f4f4
0xbfffb464:     0xf4f4f4f4      0xf4f4f4f4      0xf4f4f4f4      0xf4f4f4f4
(gdb) si
0x08048d41 in fizz ()
(gdb) x/32xw $sp
0xbfffb3f4:     0x00000001      0x0804a108      0xbfffb434      0x00857ff4
0xbfffb404:     0x00000003      0x00000000      0xbfffb428      0x00000000
0xbfffb414:     0x0024f4c0      0x08049983      0xbfffb434      0xbfffb434
0xbfffb424:     0xdeadbeef      0xbfffe9f8      0x08049056      0x08049983
0xbfffb434:     0x000000f4      0x00003560      0x00000000      0xf4f4f4f4
0xbfffb444:     0xf4f4f4f4      0xf4f4f4f4      0xf4f4f4f4      0xf4f4f4f4
0xbfffb454:     0xf4f4f4f4      0xf4f4f4f4      0xf4f4f4f4      0xf4f4f4f4
0xbfffb464:     0xf4f4f4f4      0xf4f4f4f4      0xf4f4f4f4      0xf4f4f4f4
(gdb) si
0x08048920 in entry_check ()
(gdb) c
Continuing. 
Breakpoint 2, 0x08048d46 in fizz ()
(gdb) x/32xw $sp
0xbfffb3f4:     0x00000001      0x0804a108      0xbfffb434      0x00857ff4
0xbfffb404:     0x00000003      0x00000000      0xbfffb428      0x00000000
0xbfffb414:     0x0024f4c0      0x08049983      0xbfffb434      0xbfffb434
0xbfffb424:     0xdeadbeef      0xbfffe9f8      0x08049056      0x08049983
0xbfffb434:     0x000000f4      0x00003560      0x00000000      0xf4f4f4f4
0xbfffb444:     0xf4f4f4f4      0xf4f4f4f4      0xf4f4f4f4      0xf4f4f4f4
0xbfffb454:     0xf4f4f4f4      0xf4f4f4f4      0xf4f4f4f4      0xf4f4f4f4
0xbfffb464:     0xf4f4f4f4      0xf4f4f4f4      0xf4f4f4f4      0xf4f4f4f4
(gdb) si
0x08048d4c in fizz ()
(gdb) x/32xw $sp
0xbfffb3f4:     0x00000001      0x0804a108      0xbfffb434      0x00857ff4
0xbfffb404:     0x00000003      0x00000000      0xbfffb428      0x00000000
0xbfffb414:     0x0024f4c0      0x08049983      0xbfffb434      0xbfffb434
0xbfffb424:     0xdeadbeef      0xbfffe9f8      0x08049056      0x08049983
0xbfffb434:     0x000000f4      0x00003560      0x00000000      0xf4f4f4f4
0xbfffb444:     0xf4f4f4f4      0xf4f4f4f4      0xf4f4f4f4      0xf4f4f4f4
0xbfffb454:     0xf4f4f4f4      0xf4f4f4f4      0xf4f4f4f4      0xf4f4f4f4
0xbfffb464:     0xf4f4f4f4      0xf4f4f4f4      0xf4f4f4f4      0xf4f4f4f4
(gdb) print /x ($ebp+8)
$1 = 0xbfffb414
(gdb) si
0x08048d4e in fizz ()
(gdb) x/32xw $sp
0xbfffb3f4:     0x00000001      0x0804a108      0xbfffb434      0x00857ff4
0xbfffb404:     0x00000003      0x00000000      0xbfffb428      0x00000000
0xbfffb414:     0x0024f4c0      0x08049983      0xbfffb434      0xbfffb434
0xbfffb424:     0xdeadbeef      0xbfffe9f8      0x08049056      0x08049983
0xbfffb434:     0x000000f4      0x00003560      0x00000000      0xf4f4f4f4
0xbfffb444:     0xf4f4f4f4      0xf4f4f4f4      0xf4f4f4f4      0xf4f4f4f4
0xbfffb454:     0xf4f4f4f4      0xf4f4f4f4      0xf4f4f4f4      0xf4f4f4f4
0xbfffb464:     0xf4f4f4f4      0xf4f4f4f4      0xf4f4f4f4      0xf4f4f4f4
(gdb) kill y
Kill the program being debugged? (y or n) y
(gdb)

1:
2:
3:
4:
5:
6:
7:
8:
9:
10:
11:
12:
13:
14:
15:
16:
17:
18:
19:
20:
21:
22:
23:
24:
25:
26:
27:
28:
29:
30:
31:
32:
33:
34:
35:
36:
37:
38:
39:
40:
41:
42:
43:
44:
45:
46:
47:
48:
49:
50:
51:
52:
53:
54:
55:
56:
57:
58:
59:
60:
61:
62:
63:
64:
65:
66:
67:
68:
69:
70:
71:
72:
73:
74:
75:
76:
77:
78:
79:
80:
81:
82:
83:
84:
85:
86:
87:
88:
89:
90:
91:
92:
93:
94:
95:
96:
97:
98:
99:
100:
101:
102:
103:
104:
105:
106:
107:
108:
109:
110:
111:
112:
113:
114:
115:
116:
117:
118:
119:
120:
121:
122:
123:
124:
125:
126:
127:
128:
129:

Select all Open in new window

Question

Buffer Overflow Bomb Phase 1

Subscribe now for full access to Experts Exchange and get

Instant Access to this Solution

Assembly Programming Language

C Programming Language

Trusted by hundreds of thousands everyday for fast, accurate and reliable tech support.

See what Experts Exchange can do for you.

Got a question?

We've got the answer.

Need individual assistance?

Our experts are ready to help.

Want to learn from the best?

Read articles from industry experts.

Working on a long term project?

Store your work and research.

What Makes Experts Exchange Unique?

Trusted by the world's most respected brands.

Faithfully serving IT professionals since 1996.

Related Solutions

Free Tech Articles

Cloud Class Webinars

Join the Community

Give a Little. Get a Lot.

Answers

3 Ways to Join

The Experts

The Experts

Testimonials

Testimonials

Testimonials

Business Clients

Business Clients

In the Press

In the Press

In the Press