For a security course in university I need to execute a shell via a data only vulnerability.
The c code contains a strcpy() statement, so I can overwrite a struct with the memory address of a certain buffer. Let's say this buffer is allocated at 0xbfffecfc
I need to enter the value 1 (0x00000001
) at this buffer address via the command line. This happens via the strcpy() function which writes directly to 0xbfffecfc
I already tried
python -c 'print "\x01\x00\x00\x00"
But this does not work, because the \x00
byte terminates the input.
How can I get this value of one into the buffer?
strcpy
is for copying strings, which are sequences of characters whose end is marked with a null character. Therefore, it cannot copy beyond the first null character.
memcpy
is for copying sequences of bytes of arbitrary length.
To copy "\0x01\0x00\0x00\0x00"
, which represents a four-byte 1 with little-endian byte order, use memcpy(destination, "\0x01\0x00\0x00\0x00", 4);
.
To copy an int
with value 1 in the native representation, use memcpy(destination, (int []) { 1 }, sizeof 1);
.
User contributions licensed under CC BY-SA 3.0