Stack Buffer Overflow

Question

How do you store the address of a function in a char* so that it overflows the strcpy() return address in order to return to a different function.

If you have a function:

void f()
{
     printf("We made it");
     exit(0);
}
void main()
{
    char *add;
    //Do something like: add = &f;
    char str[4] = "123";
    strcpy(str, add);
    return 0;
}

From my understanding all you need to do is overwrite the return address stored in the call of strcpy() by making add be large and have the address of f in it. Is this correct? How can this be done?

user1399238 · Accepted Answer · 2014-03-04 00:26:12Z

2

make a nop sled, then put your payload at the end of it. https://www.corelan.be/index.php/2009/07/19/exploit-writing-tutorial-part-1-stack-based-overflows/ This is a very detailed way of how to do it. The payload is written in shell code which is kind of complicated. But this will show you the basics of an overflow.

If I recall correctly, http://insecure.org/stf/smashstack.html is also another tutorial on the topic.

answered Mar 4, 2014 at 0:26

user1399238

1831 silver badge7 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

Stack Buffer Overflow

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related