• caglararli@hotmail.com
  • 05386281520

How to return to main after performing stack buffer overflow

Çağlar Arlı      -    15 Views

How to return to main after performing stack buffer overflow

#include <stdio.h>
#include <stdlib.h>

void reading();
void reading_hexa(char*);
void secret();

int main()
{
    reading();
    printf("Input done\n");
    exit(0);
}

void reading() {
    char buf[16];
    reading_hexa(buf);
}

void reading_hexa(char* buf) {
    int it = 0;
    while (1) {
        char hexa[5];
        if (scanf("%4s", hexa) != 1) break;
        if (hexa[0] != '\\' || hexa[1] != 'x') exit(1);
        char c = (char) strtol(hexa + 2, NULL, 16);
        printf("buf[%d]@%p: %02hhX -> %02hhX\n", it, &buf[it], buf[it], c);
        buf[it++] = c;
    }
}

void secret() {
    printf("Secret obtained\n");
}

I am attempting an exercise on buffer overflows. I have managed to overwrite the return address on the stack once reading_hexa() finishes, by inputting 24 "A"s (16 for the buffer and 8 for overwriting the base pointer), and then overflowing with the address of secret(). (i.e. if the address was 0x12345678, my input would be "\x41" * 24 + "\x78\x56\34\12" accounting for little endian)

However, I wish to return to main after secret() has printed, such that I can print "Input done\n". How can I do this? I've tried many things including appending the address of main to my existing input, appending extra characters for overwriting the base pointer, but none have worked.

I'm consistently either getting segmentation fault, or ../sysdeps/nptl/libc_start_call_main.h: No such file or directory.