Chapter 11 file stream pointer overwrite attacks
the unauthorized reproduction in whole or in part of this publication in any form is prohibited.
We now copy the files that will be used in this lesson.
Let's take a look at our first example
as we can see the program is susceptible to the error of buffer overflow while executing the read function.
Let's try to exploit this
after we copied 1200 bytes of data into the buffer.
Our program terminated with an error.
Let's investigate the core file to discover the details.
The program closed due to an error in the f close function that tried to refer to a forbidden address.
The address we entered.
0 x 41 41 41 41 or AAA AAA didn't indicate a correct file stream used by the close function.
Let's try to use the pointer of the standard input as D and let's overwrite with it in the area responsible
for the file structure.
In this case 1 0 4 0 bytes the last bytes of our file will consist of the address with which we will
overwrite the stack frame 0 x 41 41 41 41
as we can see we have managed to force the program to perform a jump under any address in memory.
Unfortunately as we will soon notice the use of this technique is affected by the presence of the return
function in the program.
In the case of the exit function it was not possible to force the program to perform the jump.
Let's now consider a broader usage of the file stream pointer we can investigate the appropriate header
file in order to find the file structure
Unfortunately we did manage to find the function pointer.
We'll look at a simple example using the debugger
we find an interest in Call of the slash i o under file close function.
We'll find out what is located under this address
as it turns out our function exploit system call number six the close function.
Let's try now to overwrite the under slash i o under slash violinist slash close address with the address
0 x 41 41 41 41.
It worked and we cause the program to jump to a location in memory of our choosing
analyzing the close function call we encountered the secret under slash i o under slash file Jump's.
Let's try to discover something more by looking at the resources of the B C library
as we can see the structure slash IO under file plus allocated to the file uses an additional structure
under slash IO under slash jump under slash.
It is exactly the structure that we found during our earlier analysis of the SDD and stream.
So let's take a look at the ready made exploit
we modified the program slightly to discover the address of the buffer being overwritten.
We entered the address in the code of our exploit.
We did it.
We executed the show code by overwriting the file stream.
We gained full control over the program.