Ethical Hacking Learn to find vulnerabilities before the bad guys do! Gain real world hands on hacking experience in our state of the art hacking lab. Course designed and taught by expert instructors with years of penetration testing experience. 12 student maximum in every class. Certification attempt included in every package. | Computer Forensics Training at InfoSec Institute Gain the in-demand skills of a certified computer examiner, learn to recover trace data left behind by fraud, theft, and cybercrime perpetrators. Discover the source of computer crime and abuse at your organization so that it never happens again. All of our class sizes are guaranteed to be 12 students or less to facilitate one-on-one interaction with one of our expert instructors. |

| Subject: | Controling the eip |
|---|---|
| Date: | 15 May 2007 00:04:13 -0000 |
I am trying to learn about computer security. I picked up the book Shellcoder's
Handbook (ISBN: 0-7645-4468-3)
I understand the concepts in the beginning but I keep on getting a funny
result. Basically I wrote a program that had a buffer overflow in it:
I run it and enter A's into the program (it recieves user input)-->hit enter
and get a segmentation fault/core dump-perfect. When I inspect the stack with
gdb it over-writes the eip with 0x41414141.
I then look at the buffer size of the function as well as the address of said
function (the purpose being to overflow the buffer, control eip to make the
function iterate again) and the buffer size is 0x24 (36) and the address is
0x08048405.
I then write a program to translate the hex into ASCII cleanly to insert into
the buffer:
#include <stdio.h>
main()
{
int i=0;
char stuffing[44];
for (i=0; i<=44; i+=4)
{
*(long *) &stuffing[i] = 0x08048405;
puts(stuffing);
}
}
I then run the program and input the address as ASCII into the buffer as
follows:
bash# (./addresstochar;cat) | ./overflow
which doesn't make the program iterate twice and doesn't change eip on
inspection of the stack. What am I doing wrong here? I tried to be as thorough
as possible; please forgive my verbosity. Thanks, Zach
------------------------------------------------------------------------
This List Sponsored by: Cenzic
Are you using SPI, Watchfire or WhiteHat?
Consider getting clear vision with Cenzic
See HOW Now with our 20/20 program!
http://www.cenzic.com/c/2020
------------------------------------------------------------------------
| <Prev in Thread] | Current Thread | [Next in Thread> |
|---|---|---|
| ||
| Previous by Date: | Looking for BlackBoard Contact for Vulnerability Reporting, David Swafford |
|---|---|
| Next by Date: | Re: Opinions of automated testers, rajat swarup |
| Previous by Thread: | Looking for BlackBoard Contact for Vulnerability Reporting, David Swafford |
| Next by Thread: | Re: Controling the eip, Carl Livitt |
| Indexes: | [Date] [Thread] [Top] [All Lists] |