Stack Buffer Overflows

Feed a program more bytes than its buffer can hold and one of two things happens. Either the program crashes with a segfault, or, if you are precise, it does exactly what you tell it to. The bug is old and simple: a function copies your input into a fixed-size stack buffer without checking how long your input is. gets, strcpy, sprintf, and a bare scanf("%s", ...) all do this. They keep writing until they hit a null or newline, straight past the end of the buffer.

Here is the target for this lesson. Compile it yourself so the mitigations are off and you can see the mechanics naked:

#include <stdio.h>
void vuln() {
    char buf[64];
    gets(buf);        // no bounds check, writes as much as you send
    puts(buf);
}
int main() { vuln(); }

$gcc -fno-stack-protector -z execstack -no-pie -g vuln.c -o vuln

Watch it die

buf is 64 bytes. Send 64 and it fits. Send 200 and you scribble past the buffer, over the saved rbp, and into the saved return address. When vuln runs ret, it pops your garbage into rip and the CPU tries to execute an address that is not code.

Seeing 0x41414141 in the fault is the whole point. Those are your A bytes sitting in the instruction pointer. That is not a random crash. That is you, holding the wheel, just not yet steering.

Find the exact offset

Two hundred As proves you can crash it. To exploit it you need the precise distance from the start of your input to the four (really eight) bytes that land on the return address. Guessing is for amateurs. Use a cyclic pattern, a string where every chunk is unique, so the value in rip tells you the offset directly.

gef and pwndbg ship pattern create and pattern search that do the same thing inside the debugger. However you slice it, the answer for this binary is 72: sixty-four bytes of buffer plus eight bytes of saved rbp, and then your next eight bytes are the return address.

Confirm control

Prove the offset before you build the real payload. Send 72 filler bytes then eight Bs and check that rip (or the fault address) is exactly 0x4242424242424242. If it is, you own the return address to the byte, and the next lesson turns that control into a jump you chose.