We have successfully written and exploit that works against our vulnerable binary, our vulnerable binary
users, ECPA function, FDCPA function, terminate the buffer.
When Unallied is encountered in 1864, BIT processors currently only use the least significant 48 bits
of our chat address.
This means our return address to override RHP should be off 48 bits and the remaining higher 16 bits
must be filled with zeros.
Any instructions gadget's placed after the return address will not be executed as SDR.
SIPA will terminate the input once null bytes are encountered.
Now our goal for now is to understand some more variants of buffer overflow attacks on 64 bit Linux
binaries.
So let's update the source code of our 111 program.
To have its function instead of FDCPA.
Function gets function doesn't terminate the buffer when an element is encountered.
So we will be able to place more data on the stack even after overwriting IP register before we update
the source code.
Let me quickly show you what happens with FDCPA function.
I'm switching to my washing machine and let's copy our final exploit, which is exploit final dash Peire
and let's call it Nestea CPI dot p.m. and let's open it up and start SIPA p.m. and let's try to add
some more stuff after overwriting the return address.
So I'm just adding junk.
Let's probably add some seats here, let's say, for seats.
And let's save the file and let's produce the payload from this file, SDR, S.P.I, Dot p.m. and let's
call it a star CPI dash payload.
Now let's open up this payload using a hex editor expects the SDR, SIPA Dasch payload.
If you look at this, our payload has some NUL bytes in between.
If we try to exploit our current vulnerable binary using payload like this, it will terminate this
buffer when the first byte is encountered.
So the remaining buffer will not be copied by staff CPI.
That's the problem we are trying to avoid by using its function instead of FDCPA in our vulnerable program.
So let's update the vulnerable program.
The use gets function instead of ECPA.
I'm making a new directory here called GET and let's copy one notable dot C under gets and let's also
copy the Makefile into this directory and let's navigate to the gets directly.
And we have these two files available here.
Let me open up my vulnerable dot C and let's edit it to have guests function instead of FDCPA.
I'm going to make a few more changes as well.
Let's use print F.
Hi there.
And.
Let's remove this SDR S.P.I.
And that's right, and gets buffer.
And let's not pass any arguments to this.
Instead, we will be getting it from the street in.
All right, let's also change the declaration at the top.
We are not passing any arguments now, so let's just remove this.
All right.
So this looks fine to me.
Let's just quickly save the file and let's see if we can combine it.
I'm just going to use this makefile once again.
Looks like we have a garden available by now, we can use the same exploit that we have developed earlier
to exploit this winery, the IP address may need to be slightly adjusted if it causes a segmentation
fault.
So let's try the exploit against the new winery first.
Let's copy the final exploit we have.
Into the current military and let's try to run it this time, we will have to use a different way of
running the payload against the vulnerable binary because we are not using SDR CPI anymore.
We are using its function.
So we will have to pass the input from Estulin.
So to do that, I'm just using that exploit Basche final RPN and let's run Cat and let's fight this
into vulnerable and hitting.
Enter and let's hit enter once again.
Let's try to type any command.
Looks like there is a segmentation fault.
So let's open this code file gdb dash code code.
If you look at this, this is the address which is causing the segmentation fault.
So let's examine this tag.
If you observe the stack, the address that is pointing to the knob sled is here, which is ending with
the Aetate, but the address that we have used to override the return address is ending with DDH eight,
and that's exactly the reason why they might fail.
So let's copy this address.
And let's quit from Grib and let's update the exploit with the corporate address.
It has to be the était, let's save the exploit and let's try to execute it once again.
Let's hit enter, let's hit enter once again and let's type in any command to check if they explode,
would look at that, they explode word and we are able to execute system commands with some minor changes.
The same exploit that we have written for available binary, which is having FDCPA function, has worked
even for another binary which is having gets as its well and will function.
We are going to use this new binary as our target binary throughout the remaining course.
That's all for this video.
See you in the next one.