Hacking: how to perform buffer overflow attack? - c

Question

I am stuck on a hacking exercise.
The program shows this when executed:
Build your own string!
Usage:
./4 length command...
Each command consist of a single character followed by its index.
Example:
./4 11 h0 e1 l2 l3 o4 w6 o7 r8 l9 d10
How can I perform a buffer overflow attack with command line arguments?
atoi converts the string argument str to an integer (type int).
memset copies the character c (an unsigned char) to the first n characters of the string pointed to, by the argument str.
Thank you for your insight!
#include <alloca.h>
#include <stdio.h>
#include <string.h>
#include <stdlib.h>
static void usage(const char *argv0) {
printf("Build your own string!\n");
printf("\n");
printf("Usage:\n");
printf(" %s length command...\n", argv0);
printf("\n");
printf("Each command consist of a single character followed by its index.\n");
printf("\n");
printf("Example:\n");
printf(" %s 11 h0 e1 l2 l3 o4 w6 o7 r8 l9 d10\n", argv0);
exit(1);
}
int main(int argc, char **argv) {
char *buffer;
unsigned short buffersize, i, index, length;
if (argc < 2) usage(argv[0]);
length = atoi(argv[1]);
if (length <= 0) {
fprintf(stderr, "bad length\n");
return 1;
}
buffersize = length + 1;
buffer = alloca(buffersize);
memset(buffer, ' ', buffersize);
buffer[buffersize - 1] = 0;
for (i = 2; i < argc; i++) {
if (strlen(argv[i]) < 2) {
fprintf(stderr, "bad command \"%s\"\n", argv[i]);
return 1;
}
index = atoi(argv[i] + 1);
if (index >= length) {
fprintf(stderr, "bad index in command \"%s\"\n", argv[i]);
return 1;
}
buffer[index] = argv[i][0];
}
printf("%s\n", buffer);
return 0;
}

Answer 1

Bufferoverflows from what i know is where you overwrite the buffer memory addresses to execute your code or to simply point to another address the good function! In your script i believe to get to the next level you have to point the memory address to printf("%s\n", buffer);. To do this use gdb to debug the code and overwrite the memory address to however many bit's away the printf function is. A decent tutoral is http://www.tenouk.com/Bufferoverflowc/Bufferoverflow4.html . But you should read about c programming and all the vulnerable code in the sourcecode. Which one is printf("im vulnerable");