subangkar/buffer-overflow-attack-seedlab

Buffer overflow exploitation to get root access from other users

Buffer Overflow Attack

This repo contains a C code to demonstrate exploitation of buffer overflow during unsafe copy operation.

OS Used:

• SEEDLAB, Ubuntu 16.04 32-bit (Should work on any 32-bit or i386 architecture)

Demonstration:

• Login as normal user(i.e. not as root)
• First disable virtual address randomization

sudo sysctl -w kernel.randomize_va_space=0

• Now debug demo.c with gdb to know the return address to exploit and its offset from buffer to exploit

debug.sh demo.c

• You should be in gdb console now. Finding address and offset from gdb using following commands

b foo
run
p $ebp
p &buffer
p/d $1-$2
q

Note address of ebp from p $ebp and offset from buffer from p/d $1-$2

• After quitting from gdb console modify ebp address, and offset updating following lines in exploit.py

ebp_offset = <offset_obtained_from_gdb>
addr_ebp = <address_of_ebp_obtained_from_gdb>

• Finally run the attack using run.sh

run.sh

• If everything is okay, a bash would be opened as root. Check using

whoami

Resources used:

• shellcode and demo.c from SEEDLAB