Home page logo
/

pen-test logo Penetration Testing mailing list archives

Overflowing Scripts fail to work
From: Paul Sebastian Ziegler <psz () observed de>
Date: Sat, 22 Apr 2006 10:30:43 +0200

Hallo list!

I've been on this for quite some time and after failing to find out
anything on the Internet I've finally decided to propose this question
here. Any help would be greatly appreciated!

Due to interest I have started to try to understand
buffer-overflow-attacks. The theory is fine with me. But now I'm getting
quite some trouble when trying to write exploiting scripts.

Let me show you what I mean:

The program I'll be using consists of those few lines of C-code.

###Content of test.c#######################
#include <stdio.h>

int main(int argc, char *argv[]) {

        char buffer[512];
        setuid(0);
        seteuid(0);
        strcpy(buffer, argv[1]);
        printf("%s\n",buffer);

return(0);
}
###########################################

This is more or less the average "vulnerable" Program.

Ok; now I compile it and then have a go at it from the shell:

--------------------------------------------------------------
xyz () localhost ~ $ ./test `python -c "print 'A' * 524"`
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
Speicherzugriffsfehler (core dumped)
--------------------------------------------------------------

As expected the program crashes with a segmentation fault.
When firing up gdb with the coredump it can also be seen that the
segmentation fault was caused by the registers being filled with "41".
So far so good.

Now for the part that puzzles me:
I put exactly the same thing into a script:

###Content of exp.py########################
#! /bin/env python

import os
os.system("./test "+("A" * 524))
############################################

Now when I'm running it I get no overflow at all:

-------------------------------------------------------------
xyz () localhost ~ $ ./exp.py
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
--------------------------------------------------------------

To make sure I increased the number of As until 10000.
Still nothing happens.

I don't know what do do with this.


Some more information that might be of need:
I'm running Gentoo-Linux with a 2.6.16-Kernel with the Gentoo-Patchset
applied. 

Python version and C-Compiler:
Python 2.4.2 (#1, Feb  5 2006, 10:03:22)
[GCC 3.3.6 (Gentoo 3.3.6, ssp-3.3.6-1.0, pie-8.7.8)] on linux2

Any help would be greatly appreciated. Thanks in advance! If anyone
should need any other information please tell me.

MfG
Paul




------------------------------------------------------------------------------
This List Sponsored by: Cenzic

Concerned about Web Application Security? 
Why not go with the #1 solution - Cenzic, the only one to win the Analyst's 
Choice Award from eWeek. As attacks through web applications continue to rise, 
you need to proactively protect your applications from hackers. Cenzic has the 
most comprehensive solutions to meet your application security penetration 
testing and vulnerability management needs. You have an option to go with a 
managed service (Cenzic ClickToSecure) or an enterprise software 
(Cenzic Hailstorm). Download FREE whitepaper on how a managed service can 
help you: http://www.cenzic.com/news_events/wpappsec.php 
And, now for a limited time we can do a FREE audit for you to confirm your 
results from other product. Contact us at request () cenzic com for details.
------------------------------------------------------------------------------


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]
AlienVault