Our preceding attacks have all caused the program to jump to the code for
some other function, which then causes the program to exit. As a result, it
was acceptable to use exploit strings that corrupt the stack, overwriting
the saved value of register
%ebp and the return pointer.
The most sophisticated form of buffer overflow attack causes the program to execute some exploit code that patches up the stack and makes the program return to the original calling function (test in this case). The calling function is oblivious to the attack. This style of attack is tricky, though, since you must:
Your job for this level is to supply an exploit string that will cause
getbuf to return your cookie back to
than the value 1. You can see in the code for test that this will cause the
program to go “Boom!” Your exploit code should set your cookie as the return
value, restore any corrupted state, push the correct return location on the
stack, and execute a
ret instruction to really return to test.
%ebp. However, it is important that this value is correctly restored before you return to test. You can do this by either
%ebpin the correct position, so that it never gets corrupted, or
gdbto get the information you need to construct your exploit string. Set a breakpoint within
getbufand run to this breakpoint. Determine parameters such as the saved return address and the saved value of
objdumpdo all of the work of generating a byte encoding of the instructions.
Once you complete this level, pause to reflect on what you have accomplished. You caused a program to execute machine code of your own design. You have done so in a sufficiently stealthy way that the program did not realize that anything was amiss.