Lab 5: Buffer Overflows

Binary Exploitation (Part 1)

For this lab you will be completing the first few challenges of the Binary Exploitation module and building buffer overflow-based attacks.

The challenges are designed to take an input on stdin then read out the flag based on how you’ve overflowed the buffer. In easy mode, you’ll have access to the source file of the binary to help you understand what the program is doing, but you will still likely need to start the program in gdb to get a complete understanding of the program’s memory layout at runtime.

Your goal will be to determine the memory layout, then craft a program input that will result in the win function being called and flag being red out.

What follows are some helpful commands and terminal tricks that you may find useful as you craft inputs and perform runtime analysis in gdb:

Writing arbitrary bytes to stdin in gdb: r < <(printf "\x00\x00\x00\x00\xef\xbe\xad\xde")
- This will restart the program and load the bytes 0x00 0x00 0x00 0x00 0xef 0xbe 0xad 0xde to stdin before the program is invoked.
- You will not be able to specify further data on stdin, and you will not be prompted for input when read gets invoked, as input will already be available on stdin.
You can provide the same input to the actual function outside of gdb with the following:
```
printf "\x00\x00\x00\x00\xef\xbe\xad\xde" | /challenge/<challenge_name>
```
- Note again, that you will not be prompted for further input
You may need to craft some very long strings. A nice trick for generating them is by using python from the command line: python -c "print('\x00' * 50)"
- This will produce the string representation of the null byte that you can feed to printf.
- You could also use python to call the challenge program using the pwntools package, as you learned in earlier labs.
It is a good idea to take notes as you reverse engineer binaries, as you will need to remember many important addresses and details that can be difficult to hold in your head all at once.

Task 1

From the “Binary Exploitation” module:

Complete Your First Overflow (easy)
Complete Your First Overflow (hard)
Complete Precision (easy)
Complete Precision (hard)

Hint 1

It would be a good idea to use gdb to disassemble the binary to figure out how many bytes are needed to actually overflow the buffer.

Hint 2

You can see the available functions symbols in the binary by using info functions in gdb. Then you can disassemble it to find out what is happening.

Hint 3

You are once again interested in finding out where the read library function is writing data to (You’ll need to do this at runtime). This time, however, you should also look for comparison operation that checks to see if a certain byte in the read buffer is nonzero. This may be a cmp or test instruction, followed by a conditional branch instruction.
Complete Variable Control (easy)

Hint 1

You should look for control flow instructions that lead to the win function being called, as well as the instructions that will terminate the program if the lose variable is set.