Bufferoverruns (under RH7.2)
See last weeks lecture for help.
In particular, you probably need to understand the layout of the stack as well
as some tools...
<![CDATA[
/*
* gcc -o stack -g stack.c
* gcc -S -o stack.s stack.c
* gdb stack
* try the following gdb commands:
* list sumNums
* break 86
* run
* print i
* step
* print i
* info registers
* display i
* print &sum
* print &main
* x/6w 0xbffff9e0
* disassemble main
*/
]]>
- As we did in lecture, modify stack.c so that upon return from sumNums, hacked gets called.
-
Modify target1.c so that
hacked is executed upon return from foo(). Your modifications are limited to shellcode.
-
Modify target1.c so that
/bin/sh is executed upon return
from foo().
Your modifications are limited to shellcode.
Hint: See my shellcode notes very bottom.
-
For the last exploit, explain what would happen if target1 was running as root?