Penetration Testing mailing list archives
Re: Buffer Overflow Experiment
From: Amit Bagree <bagree () cmu edu>
Date: Tue, 25 Sep 2007 08:11:32 +0100 (BST)
" The basic stack structure is: [Buffer][EBP/Frame pointer][Return addr/saved Instruction Ptr][arguments] You need to account for the Frame pointer/ BP." One doesnt need to use binoculars at all to read an email, which in turn begets the question why some people waste so much time just to repeat things putting it in different words and show-off their knowledge? I'm sure someone wont have time to take reading classes but definately waste it replaying emails. ~Amit --- Justin Ferguson <jnferguson () gmail com> wrote:
one doesnt need the code at all to understand your situation, and in fact, when he said that he overwrote one byte past, the most likely presumption is that he hit the saved frame pointer, which in turn begets the question, why would you be answering a question you dont know the answer to? As I said out-of-band to you Alcides, go lookup the documentation for the instructions 'leave' and 'ret' or whatever equiv for your architecture, if you still don't see your answer, think a bit harder for a while, if you're still not getting it see if this paper rouses any ideas http://www.phrack.org/archives/55/P55-08 , lastly if you still don't get it perhaps you should consider a new hobby, maybe something pen-testing web-apps. On 9/13/07, Amit Bagree <bagree () cmu edu> wrote:Hey Alcides, It would be more helpful if you can provide theactualcode. Are you sure you are watching the EIP values right after the overflow happens and I mean in asmnotC. The key to understanding BO is to notice howthestack, EIP and EBP are manipuated for each asm instruction. "Smashing the stack for fun andprofit"is the quintessential reference for understandingBO.The basic stack structure is: [Buffer][EBP/Frame pointer][Return addr/saved Instruction Ptr][arguments] You need to account for the Frame pointer/ BP.Fromwhat you say in 3] and 4] either you are notlookingat the what you need to watch for or you are not reaching till the ret addr. Hope that helps. Cheers & Chi!! Amit --- Alcides <alcides.hercules () gmail com> wrote:Hi List, I was wondering if someone has already donethis.I'm testing a small program written in C,especiallycoded for testing buffer overflow. In source code, I have assigned charbuffer[512]; Icompile with gcc and run on bash. As soon as I pass "512" characters as argument("A"x512--being precise), the program gives " Segmentation fault (coredumped)" -->as desired. 1] Using GDB debugger, it has been verified thattheextended instruction pointer EIP has been overwritten, as expected. (EIP-->0x41414141) 2] But, on passing "513" chars. argument, theEIPbecomes 0x0 -->WHY 3]On passing 520 chars. argument, EIP takes'some'value and EBP becomes 0x41414141 4]Thereafter, every increment by 1 --> in input characters causes EIP to remain the same as that 'some' value and EBP totakevarious incremental values. every time, for several unit increments [I am using: 2.6.21-1.3194.fc7 kernel, i686, Disabled VA randomization] Any views that help me understand why EIPbecomes0, are welcome. Thanks.
------------------------------------------------------------------------
This list is sponsored by: Cenzic Need to secure your web apps NOW? Cenzic finds more, "real" vulnerabilities fast. Click to try it, buy it or download a solutionFREEtoday! http://www.cenzic.com/downloads
------------------------------------------------------------------------
DELETE button is history. Unlimited mailstorage is just a click away. Go to https://edit.india.yahoo.com/config/eval_register
------------------------------------------------------------------------
This list is sponsored by: Cenzic Need to secure your web apps NOW? Cenzic finds more, "real" vulnerabilities fast. Click to try it, buy it or download a solutionFREE today!http://www.cenzic.com/downloads
------------------------------------------------------------------------
------------------------------------------------------------------------
This list is sponsored by: Cenzic Need to secure your web apps NOW? Cenzic finds more, "real" vulnerabilities fast. Click to try it, buy it or download a solution FREE today! http://www.cenzic.com/downloads
------------------------------------------------------------------------
5, 50, 500, 5000 - Store N number of mails in your inbox. Go to http://help.yahoo.com/l/in/yahoo/mail/yahoomail/tools/tools-08.html ------------------------------------------------------------------------ This list is sponsored by: Cenzic Need to secure your web apps NOW? Cenzic finds more, "real" vulnerabilities fast. Click to try it, buy it or download a solution FREE today! http://www.cenzic.com/downloads ------------------------------------------------------------------------
Current thread:
- Buffer Overflow Experiment Alcides (Sep 13)
- Re: Buffer Overflow Experiment Amit Bagree (Sep 14)
- Re: Buffer Overflow Experiment Justin Ferguson (Sep 14)
- Re: Buffer Overflow Experiment Amit Bagree (Sep 25)
- Re: Buffer Overflow Experiment Justin Ferguson (Sep 14)
- Re: Buffer Overflow Experiment Rick Zhong (Sep 14)
- Re: Buffer Overflow Experiment Amit Bagree (Sep 14)