title: Causing a buffer Overflow with fgets
body: <p>I'm experimenting with buffer overflows and try to overwrite the return address of the stack with a certain input of fgets</p>
  
  <p>This is the code:</p>
  
  <pre><code>void foo()
  {
      fprintf(stderr, "You did it.\n");
  }
  
  void bar()
  {
      char buf[20];
      puts("Input:");
      fgets(buf, 24, stdin);
      printf("Your input:.\n", strlen(buf));
  }
  
  
  int main(int argc, char **argv)
  {
      bar();
      return 0;
  }
  </code></pre>
  
  <p>On a normal execution the program just returns your input. I want it to output foo() without modifying the code.</p>
  
  <p>My idea was to overflow the buffer of <code>buf</code> by entering 20 <code>'A'</code>s. This works and causes a segmentation fault.
  My next idea was to find out the address of <code>foo()</code> which is <code>\x4006cd</code> and append this to the 20 <code>'A'</code>s.</p>
  
  <p>From my understanding this should overwrite the return address of the stack and make it jump to <code>foo</code>. But it only causes a segfault. </p>
  
  <p>What am I doing wrong?</p>
  
  <p>Update: Assembler dumps
  main</p>
  
  <pre><code>    Dump of assembler code for function main:
     0x000000000040073b &lt;+0&gt;: push   %rbp
     0x000000000040073c &lt;+1&gt;: mov    %rsp,%rbp
     0x000000000040073f &lt;+4&gt;: sub    $0x10,%rsp
     0x0000000000400743 &lt;+8&gt;: mov    %edi,-0x4(%rbp)
     0x0000000000400746 &lt;+11&gt;:    mov    %rsi,-0x10(%rbp)
     0x000000000040074a &lt;+15&gt;:    mov    $0x0,%eax
     0x000000000040074f &lt;+20&gt;:    callq  0x4006f1 &lt;bar&gt;
     0x0000000000400754 &lt;+25&gt;:    mov    $0x0,%eax
     0x0000000000400759 &lt;+30&gt;:    leaveq 
     0x000000000040075a &lt;+31&gt;:    retq   
     End of assembler dump.
  </code></pre>
  
  <p>foo</p>
  
  <pre><code>Dump of assembler code for function foo:
     0x00000000004006cd &lt;+0&gt;: push   %rbp
     0x00000000004006ce &lt;+1&gt;: mov    %rsp,%rbp
     0x00000000004006d1 &lt;+4&gt;: mov    0x200990(%rip),%rax        # 0x601068 &lt;stderr@@GLIBC_2.2.5&gt;
     0x00000000004006d8 &lt;+11&gt;:    mov    %rax,%rcx
     0x00000000004006db &lt;+14&gt;:    mov    $0x15,%edx
     0x00000000004006e0 &lt;+19&gt;:    mov    $0x1,%esi
     0x00000000004006e5 &lt;+24&gt;:    mov    $0x400804,%edi
     0x00000000004006ea &lt;+29&gt;:    callq  0x4005d0 &lt;fwrite@plt&gt;
     0x00000000004006ef &lt;+34&gt;:    pop    %rbp
     0x00000000004006f0 &lt;+35&gt;:    retq   
  End of assembler dump.
  </code></pre>
  
  <p>bar:</p>
  
  <pre><code>Dump of assembler code for function bar:
     0x00000000004006f1 &lt;+0&gt;: push   %rbp
     0x00000000004006f2 &lt;+1&gt;: mov    %rsp,%rbp
     0x00000000004006f5 &lt;+4&gt;: sub    $0x20,%rsp
     0x00000000004006f9 &lt;+8&gt;: mov    $0x40081a,%edi
     0x00000000004006fe &lt;+13&gt;:    callq  0x400570 &lt;puts@plt&gt;
     0x0000000000400703 &lt;+18&gt;:    mov    0x200956(%rip),%rdx        # 0x601060 &lt;stdin@@GLIBC_2.2.5&gt;
     0x000000000040070a &lt;+25&gt;:    lea    -0x20(%rbp),%rax
     0x000000000040070e &lt;+29&gt;:    mov    $0x18,%esi
     0x0000000000400713 &lt;+34&gt;:    mov    %rax,%rdi
     0x0000000000400716 &lt;+37&gt;:    callq  0x4005b0 &lt;fgets@plt&gt;
     0x000000000040071b &lt;+42&gt;:    lea    -0x20(%rbp),%rax
     0x000000000040071f &lt;+46&gt;:    mov    %rax,%rdi
     0x0000000000400722 &lt;+49&gt;:    callq  0x400580 &lt;strlen@plt&gt;
     0x0000000000400727 &lt;+54&gt;:    mov    %rax,%rsi
     0x000000000040072a &lt;+57&gt;:    mov    $0x400821,%edi
     0x000000000040072f &lt;+62&gt;:    mov    $0x0,%eax
     0x0000000000400734 &lt;+67&gt;:    callq  0x400590 &lt;printf@plt&gt;
     0x0000000000400739 &lt;+72&gt;:    leaveq 
     0x000000000040073a &lt;+73&gt;:    retq   
  End of assembler dump.
  </code></pre>