Hi,

I'm an aspiring security specialist and am currently working on my first buffer overflow. (using The Shellcoders Handbook by Jack Koziol.)
However, while it seems to work on older versions of linux, in fedora core 2 I can not overwrite EIP no matter how hard I try. EBP no problem but not EIP. Anyways, any help or direction would be fantastic. Thanks in advance.

Neo

neophytic; attempt to program with c++, c or visual basic. from info are u dealing with a hispeed
system? as u know EIP deals with program counter. either address or instruction registers.
logic, constants and counters check:
calculate,compare and copy. or u dealing with corporate system? that is another twist.

Sorry for being so indescriptive. I created a fedora core 2 system to play around on. I created a program in C listed here:

void return_input(void)
{
char array[30];

gets (array);
printf("%s\n", array);

}

main()
{
return_input();
return 0;

Obviously, there is a glaring overflow vulnerability within the return_input function. I compiled the program with gcc using the -mpreferred-stack-boundary=2 -ggdb option listed here:

[neophyte@localhost overflow_pg19]$ gcc -mpreferred-stack-boundary=2 -ggdb overflow.c

/tmp/ccsyJRjA.o(.text+0xb): In function `return_input':
/home/neophyte/code/shellcoders_handbook/overflow_pg19/overflow.c:5: warning: the `gets' function is dangerous and should not be used.

[neophyte@localhost overflow_pg19]$ ./overflow AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
Segmentation Fault (core dumped)

then:

[neophyte@localhost overflow_pg19]$ gdb overflow core.xxxxxx

info registers

and here we have it: ebp is x41414141 (cap A's)
and unfortunately eip is x80483c8

it seems no matter what I do I can not override eip. There is something obviously limiting this from happening and I'm not sure what it is. Any help would be greatly appreciated. Thanks again!

-Neophytic

Fedora core and some newer versions of linux come with stack protections. Fedora especifically has Exec shield by default. Common technicas just wont do due to the fact exec shield will randomize an protect eip from being overwritten. If its your firts time you are trying to exploit a program i recommend you, dissable exec shield or get another distro like slackware 9 or mandrake

Please do not post the same thread in more than one forum. Picking the most relevant forum and posting it once there makes it easier for other members to help you and keeps the discussion all in one place.

http://www.linuxquestions.org/rules.php

Please direct replies to:
http://www.linuxquestions.org/questi...hreadid=253451