Hello, everyone, welcome to a new video of our binary exploitation series.
Last time we were able to crash our program by overwriting our stack and causing the string for math
function to stop the execution.
But remember, we're not able to overwrite our main function return address yet.
We first need our string for math function to continue its execution.
Let's take a look at the server see program.
If you look here, the string for month function is called after the mem copy, and then it will return
to the main function.
Last time we overwrote an address of this tech belongs to talk to the time buff variable of the good
time function.
This one.
The let's see if we can replace this address by any other address or is only bound to the time baff
address.
Going to start our program in GDB again.
I'm to read the program.
First thing we need to take a look at the message, both variable, that we are actually copying everything
to it.
The address of the message above is Forry for me is zero.
So we need not to forget we have zero zero in the very beginning.
So zero zero 40 40 is zero, right?
What if we instead of overwriting this address of the string time variable, we give it any other address
like this address, for instance?
So let's use this address in our.
Buffer here.
But remember, we're using something our until processors call using something called little engine.
So this is this will be reversed.
So instead of 40 for you, zero will be zero for three four three zero zero.
So here first thing is zero four three four three zero zero.
And then we need to put the backslash X because this is, um.
Just here, backslash X, backslash X in here.
OK, now let's break after destroying Firmat again here and continue.
And then send our buffer.
OK, so far so good.
What if we step in a week where we're so far we're done?
Good.
We didn't get any segmentation fault, even though we gave it another memory address.
Is the memory address of the message buffer right?
It's not the memory of the time format, Stepin.
So far, so good.
Now, we should be returning to the main function right here if we look at this tech.
The top of the stack is pointing to the memory address of the main function that we are returning back
to, right.
It's zero zero 40, 50, 15 to be one.
It's the same memory address as this one.
When we called a good time function, right, and we went to a good time function, we finish executing
everything.
Now we need to go back to the next instruction.
So that means the address that we need to put there.
It's not bound by the time, but it can be any other address.
That's that's very good.
Now, let's take a look at the message board variable itself.
OK, we were able to copy everything, right, the no bite and then I will raise.
All the way to this memorial address of the message board itself, right?
That's fine.
So now what's our next step?
Our next step is to override the memory address of, um, the return address.
Right.
All right.
Let's do that.
What we need to do now is since our buffer is on the stack, then we can override the return address
to point to the top of the stack or to point to the location of our message above.
Oh, sorry, the message of this location.
Then instead of returning to the main function, it will go to this location and then it will execute
our show code.
But keep in mind that this variable is on initialize global variable.
It's located in the business segment, if you remember that from our slides.
And by default, it's not executable.
So we can just go there and execute it.
Same thing goes for the stack.
By default, we can just jump to the top of the stack and execute it because it's not executable.
So for the purpose of this video, we will make it executable by recompiling our program with the dash
exec stack argument.
Let's do that.
OK, now let's try again.
This is be a time for you to break here.
OK, let's examine the stack again.
This is the return address, so we need to overwrite so so far we are here this address, right?
This is our message of address.
It could be any other validators, right.
So we need another four, eight and then 12 and then another for the last four to over the address.
So let's try that.
We come here and.
One, one, two, three, four, five, six, seven, eight, nine, 10, 11, 12, and then and put
the same address again of our message both here.
All right, let's get was Dragon.
OK, let's break again here after the Fermat function.
Continue.
Let's send it.
OK, let's first check our stock.
OK, where is our last forty one forty one, so this is our first message of one that we added and then
A is, a is, a is and then again, the same address.
Well, let's start execution.
OK, now let's check.
What's the.
Night was check the top of the stack.
Nice, it points to our message of, uh, variable, which is.
So it's not working because we haven't compiled our program with the best option and that option with
due GTC will make the program contains some symbolic information like the names of our Arabel and more
debugging information.
But we can still check our message board by its memory address.
Right.
We know that we sent the memory address with our code here so we can check it here.
Let's check the first hexadecimal address and then.
But Durex and then.
Remember, this is the little Indian.
So instead of a zero four three four zero zero, it'll be zero zero for three for Asia.
So this is our message, both verbal, when we're able to copy everything here, everything we need.
So this is our no biter in the very beginning and then the rest of our days up until here, this is
actually the same address of our message board.
Let me move this a little bit and then we have another 12 days.
And then again, the same address that we put here, because, you know, the string of affirmative
action needs validators, right?
So if you step in step one instruction and then keep going.
Our function is almost ready to return to the main function.
Right.
So if we step in one more now, we haven't executed this on instruction yet.
So now our program is ready to go.
Where to go here to this message above address.
Right.
It's at the top of the stack E.S.P.
Or check up the top of the stack.
It's ready to go back.
So if we step in one more time, it will go to our message board and start executing the let's see if
we just step in again and see what happens.
Now we are inside our message board.
Let's continue.
We got segmentation fault, why?
Because we have zero zero the NHLBI that we have in the very beginning of our buffer.
This is a old byte.
So once it reads the mobile, it will stop.
So where are we going to do later is instead of pointing it to the very, very beginning of our message
above a zero, we can make it to start from here, from Bezier, and then we will fill all our messages,
both all these section with no operations and destruction.
We will do that next in the next video.
Thanks for watching and see you in the next one.