Buffer Overflow (BOF)

BUFFER OVERFLOW

---

BOF

It's a vulnerability that occurs when you can receive input larger than the set buffer size.

int __cdecl main(int argc, const char **argv, const char **envp)
{
  char s[40]; // [esp+4h] [ebp-34h] BYREF
  int v5; // [esp+2Ch] [ebp-Ch]

  v5 = 0x4030201;
  fgets(s, 45, stdin);
  printf("\n[buf]: %s\n", s);
  printf("[check] %p\n", v5);
  if ( v5 != 0x4030201 && v5 != 0xDEADBEEF )
    puts("\nYou are on the right way!");
  if ( v5 == 0xDEADBEEF )
  {
    puts("Yeah dude! You win!\nOpening your shell...");
    system("/bin/dash");
    puts("Shell closed! Bye.");
  }
  return 0;
}

I brought the code from HackCTF problem #1. The size of array s is 40, but fgets(s, 45, stdin); receives 45 bytes of buffer input. This is where BOF triggers.

Stack #1

Since input is currently going into s[40] and you can input a total of 45, you can fill all of s[40] and even change v5.

If that v5 becomes 0xDEADBEEF, the exploit succeeds.

//gcc -fno-stack-protector -z execstack -no-pie -o bof bof.c
#include <stdio.h>

int main(void) {
    char buf[40];
    
    scanf("%s", buf);
    printf("%s", buf);
}

Here's an even easier piece of code. Actually, when we first learn C, we end up writing code like scanf("%s", buf); as above. That kind of code is very dangerous. Since a length like %40s wasn't specified, you can overwrite buf[40] + the sfp and even overwrite the return address.

Here, sfp stands for Stack Frame Pointer and, literally, refers to the base pointer of the upper stack frame.

It takes 4 bytes in 32-bit and 8 bytes in 64-bit. If the bof is long enough to overwrite the return address, you must write it as buffer + sfp[4 or 8] + return address.

That was BOF up to here. It's a really easy concept so there isn't much to explain ,;,ㅡ,;,

---

Original (Korean): tistory — published 2021-09-09, migrated to this blog. This translation was generated with the help of AI.