segmentation fault, buffer overflow

void lame (void) {
char small[30];
gets (small);
printf("%sn", small);
}
main() {
lame ();
return 0;
}

ocigledno obican program ..... ni malo komplikovan ali vrlo lagano exploitable.

# ./blah
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx <- vas input
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
# ./blah
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx <- vas input
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
Segmentation fault (core dumped)

greska segmentacije se desi kada funkcija "ret" koja se nalazi na adresi 0x80484d0 zeli da se vrati nazad na funkciju lame(); koja je na adresi 0x80484cb i u tom vremenu gde se desi greska segmentacije bude overwritten sa 0x787878 (0x78 = 'x').

mozda to sve nije bitno .. ali kako mogu da napravim code koji ce da me pusti da promenim adresu "ret" (return) funkcije i da mi omoguci da povecam "char small[30]" na 44 karaktera da mi se vrati nazad na adresu 0x80484cb dakle, da se nedesi greska segmentacije i ako na inputu stavim vise od 30 karaktera pa i vise od 44 karaktera.. neka bude 100.... al da mi se nedesi greska segmentacije ?

izvinjavam se ako je malo teze razumjeti jer nisam bas dobar sa naskim sprskim tehnickim rijecima lakse mi je na engleskom...


(gdb) disas main
Dump of assembler code for function main:
0x80484c8 <main>: pushl %ebp
0x80484c9 <main+1>: movl %esp,%ebp
0x80484cb <main+3>: call 0x80484a0 <lame>
0x80484d0 <main+8>: leave
0x80484d1 <main+9>: ret

Potpis

int mailme()
{
char email[21]="\x115\x110\x111\x111\x112\x64\x110\x111\x115\x116\x97\x108\x103\x105\x106\x97\x46\x99\x111";
return 0;
}

The important thing is not to stop questioning. Curiosity has its own reason for existing. (Albert Einstein) ;-)

Savi scanf("%20s",buf) i tako ce se u taj buffer staviti samo 20 char-a...
Inace gets() se ne preporucuje bas zbog oakog buffer overflow-a ;o)

[Ovu poruku je menjao predator dana 07-11-2001 u 06:57 PM GMT]

hvala mnogo :)
inace sam tek 18 :( .. ucim polako
nego samo reci mi sta si zavrsijo/zavrsavas ? :)

Potpis

int mailme()
{
char email[21]="\x115\x110\x111\x111\x112\x64\x110\x111\x115\x116\x97\x108\x103\x105\x106\x97\x46\x99\x111";
return 0;
}

The important thing is not to stop questioning. Curiosity has its own reason for existing. (Albert Einstein) ;-)

A on je 17 i završava gimnaziju u beogradu a poslednju godinu će u USA.

E gojko nemoj da vredjas !!! pre mesec dana sam napunio 18 godina ;o))

heeh i ja sam 18 :P~
nego stvarno moram da pohvalim nase momke..
pametni smo u pm do zla boga :)))))

Potpis

int mailme()
{
char email[21]="\x115\x110\x111\x111\x112\x64\x110\x111\x115\x116\x97\x108\x103\x105\x106\x97\x46\x99\x111";
return 0;
}

The important thing is not to stop questioning. Curiosity has its own reason for existing. (Albert Einstein) ;-)

de ces u USA
stipendija?

Potpis

Would you translate me on the other page in face = Da li biste me preveli na drugu stranu ulice

www.pax.org ;o) dalje ce ti se samo kasti

PAX-Program of Academic Exchange offers both inbound and
outbound high school/homestay programs. The programs are
built on the simple concept that we can best learn about
a different culture and best master a foreign language by
living as a family member in that country.

U.S families share their hearts
and home whit a "son" or "daughter"
from one of 30 different countries.

Potpis

RIZLU imash a lichnu kartu nemash mozda chesh nochash y stanici da dremash...

bice jebeno :)

Potpis

int mailme()
{
char email[21]="\x115\x110\x111\x111\x112\x64\x110\x111\x115\x116\x97\x108\x103\x105\x106\x97\x46\x99\x111";
return 0;
}

The important thing is not to stop questioning. Curiosity has its own reason for existing. (Albert Einstein) ;-)