bfu/bl
2
1
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

(add): most documentation; fix segfault

Browse Source
This commit is contained in:
bfu4 2022-03-22 11:31:54 -04:00
parent ccad201e3d
commit a896711866
No known key found for this signature in database
GPG Key ID: FD1D952871D22043
2 changed files with 28 additions and 25 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
Makefile
View File

@ -3,7 +3,6 @@ TARGET := $(NAME).elf
CC := gcc CC := gcc
STD := c89 STD := c89
CFLAGS := -std=$(STD) -z execstack -ggdb -fno-stack-protector CFLAGS := -std=$(STD) -z execstack -ggdb -fno-stack-protector
LDFLAGS := --as-needed -dynamic-linker /lib/ld-linux.so.2 -lc
all: clean assemble-link all: clean assemble-link
@ -16,4 +15,4 @@ assemble-link: assemble
gcc -no-pie -nostartfiles $(CFLAGS) $(NAME).o -o $(TARGET) gcc -no-pie -nostartfiles $(CFLAGS) $(NAME).o -o $(TARGET)
assemble: assemble:
as $(NAME).s -o $(NAME).o as --gstabs+ $(NAME).s -o $(NAME).o

50
bof.s
View File

@ -11,9 +11,8 @@
# binary: bof.elf # # binary: bof.elf #
# # # #
# assembler: GNU Assembler (as or GAS) # # assembler: GNU Assembler (as or GAS) #
# assemble: as bof.s -o bof.o # # assemble: as --gstabs+ bof.s -o bof.o #
# link: gcc -no-pie -nostartfiles -z execstack -ggdb -fno-stack-protector bof.o -o bof.elf # # link: gcc -no-pie -nostartfiles -z execstack -ggdb -fno-stack-protector bof.o -o bof.elf #
# #
#---------------------------------------------------------------#---------------------------------------------- # #---------------------------------------------------------------#---------------------------------------------- #
.code64 # not required, but specifying we're 64-bit :) # .code64 # not required, but specifying we're 64-bit :) #
#---------------------------------------------------------------#-----------------------------------------------# #---------------------------------------------------------------#-----------------------------------------------#
@ -58,26 +57,31 @@
# Allowing us to craft the final payload: "aaaaaaaa\x0\x0\x0\x0\x0\x0\x0\x0\x47\x10\x40". # # Allowing us to craft the final payload: "aaaaaaaa\x0\x0\x0\x0\x0\x0\x0\x0\x47\x10\x40". #
#---------------------------------------------------------------------------------------------------------------# #---------------------------------------------------------------------------------------------------------------#
# Execution: bash -c 'printf "aaaaaaaa\x0\x0\x0\x0\x0\x0\x0\x0\x47\x10\x40" | ./bof.elf' # # Execution: bash -c 'printf "aaaaaaaa\x0\x0\x0\x0\x0\x0\x0\x0\x47\x10\x40" | ./bof.elf' #
#---------------------------------------------------------------#-----------------------------------------------#
nop #
leave #
ret #
#---------------------------------------------------------------#-----------------------------------------------# #---------------------------------------------------------------#-----------------------------------------------#
_get_rich_fast: # nop # #
push %rbp # leave # END OF FUNCTION #
mov %rsp, %rbp # ret # #
lea money_str, %rdi #
mov %rdi, %rax #
call printf@plt #
pop %rbp #
nop #
ret #
#---------------------------------------------------------------#-----------------------------------------------# #---------------------------------------------------------------#-----------------------------------------------#
_start: # _get_rich_fast: # #
push %rbp # push %rbp # void _get_rich_fast(void) { #
call _get_input # mov %rsp, %rbp # printf(money_str); // section .data #
pop %rbp # TODO: segfault lea money_str, %rdi # } #
xor %rax, %rax # mov %rdi, %rax # #
mov $1, %al # call printf@plt #-----------------------------------------------#
mov $0, %rbx # # Since this function is not called in the #
syscall # #---------------------------------------------------------------# program, the goal is to jump to this #
jmp _exit # function (_get_rich_fast) via overflow. #
#---------------------------------------------------------------#-----------------------------------------------#
_start: # #
push %rbp # push the frame pointer #
call _get_input # call our input retrieving function #
pop %rbp # cleanup, jump to our exit routine #
jmp _exit # #
#---------------------------------------------------------------#-----------------------------------------------#
_exit: # exit(0) #
mov $60, %al #-----------------------------------------------#
xor %rdi, %rdi # sys_exit = 60 (dec) #
syscall # exit code = 0 #
#---------------------------------------------------------------#-----------------------------------------------#
# #
#---------------------------------------------------------------------------------------------------------------#