A buffer overflow only returning seg fault and not jumping to the address of a function

81 Views Asked by At

So I'm trying to apply buffer overflow on this code,

#include <stdio.h>
#include <string.h>

void hello()
{
        printf("WELCOME TO THE SYSTEM");
}

int main(){
        char passwd[10];
        printf("ENTER THE PASSWORD: ");
        scanf("%s", passwd);
        if (strcmp(passwd,"pass")==0)
                hello();
        else
                printf("WRONG PASSWORD");
}

I'm going to overflow the buffer passwd with the addresss of the function hello and I'm expecting to see "WELCOME TO THE SYSTEM" but all I get is a Segmentation fault. I used gdb for further investigation,

(gdb) print &hello
$1 = (void (*)()) 0x555555555159 <hello>
(gdb) run
Starting program: /home/reader/server
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
ENTER THE PASSWORD: aaaaaaaaa\x59\x51\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x59\x51\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x59\x51\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x59\x51\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x59\x51\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x59\x51\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x59\x51\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x59\x51\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x59\x51\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x59\x51\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x59\x51\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x59\x51\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55

Program received signal SIGSEGV, Segmentation fault.
0x00005555555551eb in main () at server.c:17
warning: Source file is more recent than executable.

The address of the hello function didn't change after execution. Here are the info registers

rax            0x0                 0
rbx            0x7fffffffe188      140737488347528
rcx            0x0                 0
rdx            0x0                 0
rsi            0x415020474e4f5257  4706297101230756439
rdi            0x7fffffffde80      140737488346752
rbp            0x5c3135785c393578  0x5c3135785c393578
rsp            0x7fffffffe078      0x7fffffffe078
r8             0xffff              65535
r9             0x0                 0
r10            0x7ffff7f4d210      140737353404944
r11            0x7ffff7f4c800      140737353402368
r12            0x0                 0
r13            0x7fffffffe198      140737488347544
r14            0x555555557dd8      93824992247256
r15            0x7ffff7ffd000      140737354125312
rip            0x5555555551eb      0x5555555551eb <main+119>
eflags         0x10202             [ IF RF ]
cs             0x33                51
ss             0x2b                43
ds             0x0                 0
es             0x0                 0
fs             0x0                 0
gs             0x0                 0

as you can see rbp got overwriten.

0

There are 0 best solutions below