In your answer include a description of the assumption you have made about the binary code and memory layout of the program. Explain if it can be countered by randomizing the base address of the stack.
a) Explain a mechanism that can be used by the attacker to force the program to execute arbitrary code.
1 void printInput(char *input) {
2 char buffer[50];
3 char secret[20] = "Pwd123456";
4 if (strcmp(input, secret) == 0)
5 print(secret);
6 else
7 printf(input);
8 strcpy(buffer, input);
9 }
10 int main(int argc, char *argv[]) {
11 if (argc != 2) {
12 return 1;
13 }
14 printInput(argv[1]);
15 return 0;
16 }
What I don't understand:
The solution says that it can be countered by ASLR because we need the address of the buffer. I sort of understand that we need to inject our code somewhere in the buffer thus if we want to overwrite the return address to point to the beginning of the buffer, where our code is, we need to know the address? Although I wonder do we really need the address? Can we not use offset?
Either way the solution seems to suggest that we should overwrite the return address and put the code immediately after and set the return address to point right after it. So I am not at all sure what they mean. Can someone explain to me why ALSR works here? I'd appracite it.
Solution in the answer sheet:
If the input contains 50 bytes, then <address of return pointer + 8>, then binary code, strcpy at line 9 over- flows the stack variables and overwrites the return pointer with the address immediately after the return pointer. After the return pointer, the overflow additionally writes the bi- nary code. Therefore, when the function| returns it jumps to the address above the return pointer on the stack. This attack can be countered by base stack randomization, since it prevents the attacker from knowing the address of buffer and therefore the address where the binary code has been injected. This makes not possible to know the value that should be written in the return pointer.