|  
 
 
 
 |   |   | Level 2: Firecracker (15 pts)
    A much more sophisticated form of buffer attack involves supplying a string
    that encodes actual machine instructions.  The exploit string then overwrites
    the return pointer with the starting address of these instructions.  When the
    calling function (in this case getbuf) executes its ret
    instruction, the program will start executing the instructions on the stack
    rather than returning.  With this form of attack, you can get the program to
    do almost anything.  The code you place on the stack is called the exploit
    code.  This style of attack is tricky, though, because you must get machine
    code onto the stack and set the return pointer to the start of this code. 
    Within the file bufbombthere is a functionbanghaving the following C code: 
    int global_value = 0;
    void bang(int val)
    {
        if (global_value == cookie) {
            printf("Bang!: You set global_value to 0x%x\n", global_value);
            validate(2);
        } else
            printf("Misfire: global_value = 0x%x\n", global_value);
        exit(0);
    }
  
  Similar to Level 0 and 1, your task is to get bufbombto
  execute the code forbangrather than returning totestBefore this, however, you must set global
  variableglobal_valueto your team’s cookie.  Your exploit code
  should setglobal_value, push the address of bang on the stack,
  and then execute a ret instruction to cause a jump to the code for bang. 
  Some Advice:
 
  
    You can use GDB to get the information you need to construct your exploit
    string.  Set a breakpoint within getbuf and run to this breakpoint. 
    Determine parameters such as the address of global_valueand the
    location of the buffer.
    Determining the byte encoding of instruction sequences by hand is tedious
    and prone to errors.  You can let tools do all of the work by writing an
    assembly code file containing the instructions and data you want to put on
    the stack.  Assemble this file with GCC and disassemble it with
    objdump.  You
    should be able to get the exact byte sequence that you will type at the
    prompt.
    Keep in mind that your exploit string depends on your machine, your compiler,
    and even your team’s cookie.  Do all of your work on a CSUG machine, and make
    sure you include the proper team name on the command line to
    bufbomb.
    Watch your use of address modes when writing assembly code.  Note that
    movl $0x4, %eaxmoves the value0x00000004into
    register%eax; whereasmovl 0x4, %eaxmoves the
    value at memory location0x00000004into%eax. 
    Since that memory location is usually undefined, the second instruction will
    cause a segfault!
    Do not attempt to use either a jmp or a call instruction to jump to the code
    for bang.  These instructions uses PC-relative addressing, which is very
    tricky to set up correctly.  Instead, push an address on the stack and use the
    retinstruction. 
  Back to the assignment page |