x86 ebp's behavior in buffer overflow attack

Question

Looking at a few basic stack-based buffer overflows, I'm confused as to the difference the caller's ebp plays in a basic return address overwrite vs an off-by-one ebp overwrite.

In the return address overwrite, the goal is to smash the stack enough to overwrite the return address and therefore control eip.

In the off-by-one attack, the LSB of the caller's ebp is overwritten. This forces ebp to pop, and the esp is moved to a location within the attacker-controlled buffer, which elicits control of the return address and, therefore `eip.

My confusion stems from the behaviour of ebp. In the basic return address overwrite, it doesn't matter that we overwrite the caller's ebp with junk bytes, but ebp's value needs to be coherent in the off-by-one attack. How does the function epilogue work in the basic buffer overflow case?

mov esp, ebp 
pop ebp
retn

poming · Accepted Answer · 2018-04-24 04:50:25Z

1

+100

In a basic return address overwrite, as you said you're able to overwrite ret directly so only retn matters in the instructions of function epilogue.

In an off-by-one ebp overwrite apparently you know you can't overwrite ret, but you can pivot the stack to somewhere user controlled.
In this case attacker goes through two function epilogue at least to gain control.

off-by-one ebp overwrite

mov esp, ebp
pop ebp          ; now ebp is partially overwriten
retn

pivot stack to controlled area.

mov esp, ebp     ; now stack(esp) is moved to controlled area.
pop ebp          ; controlled
retn             ; controlled --> gain eip control

answered Apr 24, 2018 at 4:50

poming

3981 gold badge3 silver badges12 bronze badges

Sign up to request clarification or add additional context in comments.

6 Comments

wulfgarpro Over a year ago

In the basic buffer overflow we completely overwrite ebp but that doesn't cause a pivot to a garbage address. What is it I'm not understanding about the difference?

poming Over a year ago

Stack pivot have to be done by going through twice function epilogue. and in a basic return address overflow you gain eip control in one overflow, the stack remains unchanged.

poming Over a year ago

Only ebp overwrited do not cause stack changed, overwrited ebp must be restored to esp, that means twice function epilogues are needed.

wulfgarpro Over a year ago

So if I have two functions, the second overwriting LSB of ebp, we won't gain eip until it returns normally via the first epilogue thensforth proceeding to continue until ebp is restored from the caller's [function] epilogue?

poming Over a year ago

yes, and in practice this trick is usually not for ret overwrite but for other like GOT overwrite.

|

Collectives™ on Stack Overflow

x86 ebp's behavior in buffer overflow attack

1 Answer 1

6 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

6 Comments

Your Answer

Sign up or log in

Post as a guest

Related