STACK REDIRECTION

In a buffer overflow vulnerability, control flow can be redirected by overwriting a function’s return address on the stack. This allows execution to jump to a different memory location with more useful or malicious code, enabling exploits like executing injected shellcode.

//gcc -g -fno-stack-protector -z execstack 29_stack_redirect.c -o 29_stack_redirect.out
// the -fno-stack-protector means turn off stack protector which protects against stack smashing
// the -z execstack means make the user writable memory executable
//gcc -g -m32 -fno-stack-protector -z execstack 29_stack_redirect.c -o 29_stack_redirect.out

remnux@remnux:~$ nano 29_stack_redirect.c

#include <stdio.h>
#include <stdlib.h>
#include <string.h>

void lockOutUser(void)
{
  //if the user enters in the wrong password, they must be a hacker. lock out the account
  printf("You entered the wrong password. Account locked out!\n");
}

void giveUserRoot(void)
{
  //if we're here, the user must be legit. full admin privileges
  printf("Root access granted!\n");
}

int passCheck(void)
{
  char buff[16];                 //passwords can be up to 15 characters
  int validPass = 0;
  
  //prompt the user for a password and store it in "buff"
  printf("Enter the password : \n");
  gets(buff);
  
  
  //password checking routine
  if(strcmp(buff, "gen_cyber=1337")){
    //incorrect
    printf("Wrong Password. \n");
    validPass = 0;
  }
  else{
    //correct
    printf("Correct Password! \n");
    validPass = 1;
  }
  
  return validPass;
}

int main(void)
{
  if (passCheck() == 1)
    giveUserRoot();
  else
    lockOutUser();
    
    exit(0);
}

the objective to bypass the check & just have the giveUserRoot() be called instead!

BUFFER OVERFLOW REDIRECTION (WITH CRASHING)

BUFFER OVERFLOW REDIRECTION (W/O CRASHING)

IOT prevent the application from crashing, you'll need to find the address of the Global Offset Table (GOT)

PreviousWINDOWSNextHEAP OVERFLOW

Last updated