So I've been learning basics of hacking by the book Hacking: The Art of Exploitation, 2nd Edn by Jon Erickson (2008), since I wanna be a penetration tester in future. This book is great. Still there are problems, because all examples are being run on x86 processor. My processor is x64, and the output in gdb is completely different from what it is in the book. Besides that, the program even refuses to work as in the example and the output is different.
There is my gdb output:
avaxio@avaxio-Aspire-E5-573G:~/Desktop/hax$ gdb -q ./auth_overflow2
Reading symbols from ./auth_overflow2...done.
(gdb) list 1
1 #include <stdio.h>
2 #include <stdlib.h>
3 #include <string.h>
4
5 int check_authentication(char *password) {
6 char password_buffer[16];
7 int auth_flag = 0;
8
9 strcpy(password_buffer, password);
10
(gdb)
11 if(strcmp(password_buffer, "brillig") == 0)
12 auth_flag = 1;
13 if(strcmp(password_buffer, "outgrabe") == 0)
14 auth_flag = 1;
15
16 return auth_flag;
17 }
18
19 int main(int argc, char *argv[]) {
20 if(argc < 2) {
(gdb)
21 printf("Usage: %s <password>\n", argv[0]);
22 exit(0);
23 }
24 if(check_authentication(argv[1])) {
25 printf("\n-=-=-=-=-=-=-=-=-=-=-=-=-=-\n");
26 printf(" Access Granted.\n");
27 printf("-=-=-=-=-=-=-=-=-=-=-=-=-=-\n");
28 } else {
29 printf("\nAccess Denied.\n");
30 }
(gdb) break 24
Breakpoint 1 at 0x88e: file auth_overflow2.c, line 24.
(gdb) break 9
Breakpoint 2 at 0x7ec: file auth_overflow2.c, line 9.
(gdb) break 16
Breakpoint 3 at 0x83b: file auth_overflow2.c, line 16.
(gdb) run AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
Starting program: /home/avaxio/Desktop/hax/auth_overflow2 AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
Breakpoint 1, main (argc=2, argv=0x7fffffffe468) at auth_overflow2.c:24
24 if(check_authentication(argv[1])) {
(gdb) i r rsp
rsp 0x7fffffffe370 0x7fffffffe370
(gdb) x/32xw $rsp
0x7fffffffe370: 0xffffe468 0x00007fff 0x00000000 0x00000002
0x7fffffffe380: 0x555548e0 0x00005555 0xf7a05b97 0x00007fff
0x7fffffffe390: 0x00000002 0x00000000 0xffffe468 0x00007fff
0x7fffffffe3a0: 0x00008000 0x00000002 0x55554854 0x00005555
0x7fffffffe3b0: 0x00000000 0x00000000 0x7fa36084 0x1900eec9
0x7fffffffe3c0: 0x555546c0 0x00005555 0xffffe460 0x00007fff
0x7fffffffe3d0: 0x00000000 0x00000000 0x00000000 0x00000000
0x7fffffffe3e0: 0x29436084 0x4c55bb9c 0x58fd6084 0x4c55ab23
(gdb) c
Continuing.
Breakpoint 2, check_authentication (
password=0x7fffffffe6fc 'A' <repeats 35 times>) at auth_overflow2.c:9
9 strcpy(password_buffer, password);
(gdb) i r rsp
rsp 0x7fffffffe320 0x7fffffffe320
(gdb) x/32xw $rsp
0x7fffffffe320: 0x00000009 0x00000000 0xffffe6fc 0x00007fff
0x7fffffffe330: 0xffffe398 0x00007fff 0x00f0b6ff 0x00000000
0x7fffffffe340: 0x00000001 0x00000000 0x5555492d 0x00005555
0x7fffffffe350: 0xf7de59a0 0x00007fff 0x6f9c7600 0x3543fdb3
0x7fffffffe360: 0xffffe380 0x00007fff 0x555548a1 0x00005555
0x7fffffffe370: 0xffffe468 0x00007fff 0x00000000 0x00000002
0x7fffffffe380: 0x555548e0 0x00005555 0xf7a05b97 0x00007fff
0x7fffffffe390: 0x00000002 0x00000000 0xffffe468 0x00007fff
(gdb) x/s password_buffer
0x7fffffffe340: "\001"
So I know that if I use strcpy()
instead of strncpy()
it won't check the size of the data being copied into the password_buffer
variable. There I would like to ask a question about why exactly on the last line it says that password_buffer contains "\001"
instead of having enormous amount of rubbish sized 35 bytes (like it is in the book, where the x86 processor is being used)? By running the program further, it doesn't allow to continue and throws an error "core dumped". Is it because of some x64 architecture features or what exactly? Would love to know the reason why it happens.
User contributions licensed under CC BY-SA 3.0