title: How to implement a buffer overflow
body: <p>I am trying to use a buffer overflow to gain access to the root user     (purely for educational purposes)</p>
  
  <p>I have written the following code to write the needed input to a bad file</p>
  
  <pre><code>int main(int argc, char **argv) {
      char buffer[512];
      FILE *badfile;
  
      /* Initialize buffer with 0x90 (NOP instruction) */
      memset(buffer, 0x90, 512);
  
      /*First 20 characters for buffer*/
      strcpy(buffer, "a b c d e f g h i j ");
  
      /*Over write the next 8 characters*/
      strcat(buffer, "a b c d ");
  
      /*Overwrite return address*/
      strcat(buffer, argv[1]);
  
      /* Save the contents to the file "badfile" */
      badfile = fopen("./badfile", "w");
      fwrite(buffer, 512, 1, badfile);
      fclose(badfile);
  }
  </code></pre>
  
  <p>And this is the code that should be executed by the program with root access</p>
  
  <pre><code>int bof(char *str){
      char buffer[20];
  
      /* The following allows buffer overflow */ 
      strcpy(buffer, str);
  
      return 1;
    }
  
  
  int main(int argc, char **argv) {
      char str[BSIZE];
      FILE *badfile;
      char *badfname = "badfile";
  
      badfile = fopen(badfname, "r");
      fread(str, sizeof(char), BSIZE, badfile);
      bof(str);
  
      printf("Returned Properly\n");
      return 1;
  }
  </code></pre>
  
  <p>I want the input read from badfile to change the return address of bof so that it will instead return to code that I have also written into the bad file input. However I am just getting seg faults with my current code. I know that this means I am writing my new return address to the wrong part of memory but I am unsure how to find the correct place to write too.
  I am running on a 32 bit Virtual Machine and have included the gdb disassemble of the second piece of code </p>
  
  <pre><code>Dump of assembler code for function main:
  0x080484d6 &lt;main+0&gt;:    lea    0x4(%esp),%ecx
  0x080484da &lt;main+4&gt;:    and    $0xfffffff0,%esp
  0x080484dd &lt;main+7&gt;:    pushl  -0x4(%ecx)
  0x080484e0 &lt;main+10&gt;:   push   %ebp
  0x080484e1 &lt;main+11&gt;:   mov    %esp,%ebp
  0x080484e3 &lt;main+13&gt;:   push   %ecx
  0x080484e4 &lt;main+14&gt;:   sub    $0x224,%esp
  0x080484ea &lt;main+20&gt;:   movl   $0x8048623,-0x8(%ebp)
  0x080484f1 &lt;main+27&gt;:   movl   $0x804862b,0x4(%esp)
  0x080484f9 &lt;main+35&gt;:   mov    -0x8(%ebp),%eax
  0x080484fc &lt;main+38&gt;:   mov    %eax,(%esp)
  0x080484ff &lt;main+41&gt;:   call   0x80483a0 &lt;fopen@plt&gt;
  0x08048504 &lt;main+46&gt;:   mov    %eax,-0xc(%ebp)
  0x08048507 &lt;main+49&gt;:   mov    -0xc(%ebp),%eax
  0x0804850a &lt;main+52&gt;:   mov    %eax,0xc(%esp)
  0x0804850e &lt;main+56&gt;:   movl   $0x200,0x8(%esp)
  0x08048516 &lt;main+64&gt;:   movl   $0x1,0x4(%esp)
  0x0804851e &lt;main+72&gt;:   lea    -0x20c(%ebp),%eax
  0x08048524 &lt;main+78&gt;:   mov    %eax,(%esp)
  0x08048527 &lt;main+81&gt;:   call   0x80483e0 &lt;fread@plt&gt;
  0x0804852c &lt;main+86&gt;:   lea    -0x20c(%ebp),%eax
  0x08048532 &lt;main+92&gt;:   mov    %eax,(%esp)
  ---Type &lt;return&gt; to continue, or q &lt;return&gt; to quit---
  0x08048535 &lt;main+95&gt;:   call   0x80484a4 &lt;bof&gt;
  0x0804853a &lt;main+100&gt;:  movl   $0x804862d,(%esp)
  0x08048541 &lt;main+107&gt;:  call   0x80483d0 &lt;puts@plt&gt;
  0x08048546 &lt;main+112&gt;:  mov    $0x1,%eax
  0x0804854b &lt;main+117&gt;:  add    $0x224,%esp
  0x08048551 &lt;main+123&gt;:  pop    %ecx
  0x08048552 &lt;main+124&gt;:  pop    %ebp
  0x08048553 &lt;main+125&gt;:  lea    -0x4(%ecx),%esp
  0x08048556 &lt;main+128&gt;:  ret    
  End of assembler dump.
  (gdb) 
  (gdb) disassemble bof
  Dump of assembler code for function bof:
  0x080484a4 &lt;bof+0&gt;: push   %ebp
  0x080484a5 &lt;bof+1&gt;: mov    %esp,%ebp
  0x080484a7 &lt;bof+3&gt;: sub    $0x28,%esp
  0x080484aa &lt;bof+6&gt;: mov    0x8(%ebp),%eax
  0x080484ad &lt;bof+9&gt;: mov    %eax,0x4(%esp)
  0x080484b1 &lt;bof+13&gt;:    lea    -0x14(%ebp),%eax
  0x080484b4 &lt;bof+16&gt;:    mov    %eax,(%esp)
  0x080484b7 &lt;bof+19&gt;:    call   0x80483b0 &lt;strcpy@plt&gt;
  0x080484bc &lt;bof+24&gt;:    lea    -0x14(%ebp),%eax
  0x080484bf &lt;bof+27&gt;:    mov    %eax,0x4(%esp)
  0x080484c3 &lt;bof+31&gt;:    movl   $0x8048620,(%esp)
  0x080484ca &lt;bof+38&gt;:    call   0x80483c0 &lt;printf@plt&gt;
  0x080484cf &lt;bof+43&gt;:    mov    $0x1,%eax
  0x080484d4 &lt;bof+48&gt;:    leave  
  0x080484d5 &lt;bof+49&gt;:    ret    
  End of assembler dump.
  </code></pre>