Application of reverse engineering 0x02
By: Gaurav Yadav
Tags: Cybersecurity, Buffer Overflow, Vulnerability, Reverse Engineering, Exploitation

The main partition window in the left is where we can see assembly code ,the partition window in upper right is where we can see the values of all the registers and flags and the partition window in lower right is showing our current stack frame.Now lets try to make sense of the assembly . Our main function starts at 0x00477AB0 because you can see some familiar strings getting pushed to stack before some function calls. There can be only one reason why the strings are getting pushed because they will be passed to function as a parameter. So we now know that these function at 0x00477ABB and 0x00477AC8 are printf function and if you see the C code for this assembly you can easily guess that function call at 0x00477AD9 is scanf which will take input from the user and will store it into name variable. So lets toggle a break point after scanf i.e 0x00477ADE by right clicking that address >> Breakpoint >> Toggle to immediately stop after providing the input so that we can check where our input is stored. Now lets execute our program through debugger by pressing F9 if it get stopped because of a entry breakpoint press F9 again now you can check the cmd it will be displaying the string and should be asking for a input.

Entry Breakpoint

Now lets provide the input of length 10 to analyze where is it getting stored . I will provide 10 A’s in the input so that it will be easy to locate the pattern on the stack. After pressing Enter the program stops because of our break point now lets analyze the stack.

Current stack frame

If you will look closely you can see many 41 on the stack 10 to be exact it is because value of A in hex is 0x41 so now we know where our input is stored. If you have a question why are the values only getting stored on the stack the answer is very simple as we have already seen local variables are stored on stacks and our input is stored in the memory allocated to the local variable name .Now lets step over the instruction to see what happen next by pressing F8 you can probably guess that instructions after 0x00477ADE are restoring the values of ebp,esp (epilogue) to what it was before the main function call you can read more about epilogue here.

mov esp,ebp // Restoring ESP pop ebp//Restoring EBP ret//Restoring EIP

Now lets step over till we reach ret because ret instruction is the one which restores EIP and you already know why we are after EIP because this register will help us executing the instruction that we want. Now look the stack closely stack pointer is pointing to a address .

Highlighted address 0x0019FF2C is our stack pointer

value of EIP after stepping over ret instruction

Now if you step over the ret instruction you will see that the value stored at the stack pointer will get stored onto EIP as well because that’s what ret instruction does it pop the address of instruction which should be executed after the called function get executed so that program can start executing where it left when function call happened. We now get the idea if we can overwrite the value stored at 0x0019FF2C by any address then we can execute whatever stored at the overwritten address. Now we just have to figure out how many A’s do we require to reach 0x0019FF2C so that we can overwrite with a address of our choice.It’s a simple calculation we just have to subtract 0x0019FF00 by 0x0019FF2C because 0x0019FF00 is the starting address where our input get stored the answer is 2C(44 in decimal) so our payload will be something like A*44 + address(44 A’s and address of instruction which we want to execute as ASCII) For the sake of example i have taken a random address 0x00477A74 to jump to but there is a secret function you can try to access it as well . Now to jump to address we will have to provide that hexadecimal address as ASCII because that’s what our input can be and it will be stored as hex automatically . ASCII of 0x477A74 is Gzt so according to this our payload should be

AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGzt

Lets try it out.