Phase 2: Injecting Some Code

In Phase 1, you forced getbuf to return to the touch1 function instead of returning to the test function it was called from.

Phase 2 is similar, but this time you'll be injecting a small amount of code as part of your exploit string.

As a reminder, here's the code for getbuf,

1
2
3
4
5
6

unsigned getbuf()
{
    char buf[BUFFER_SIZE];
    Gets(buf);
    return 1;
}

and for test:

1
2
3
4
5
6

void test()
{
    int val;
    val = getbuf();
    printf("No exploit.  Getbuf returned 0x%x\n", val);
}

ctarget includes a function called touch2 with the following C representation:

void touch2(unsigned val)
{
    vlevel = 2;       /* Part of validation protocol */
    if (val == cookie) {
    printf("Touch2!: You called touch2(0x%.8x)\n", val);
    validate(2);
    } else {
    printf("Misfire: You called touch2(0x%.8x)\n", val);
    fail(2);
    }
    exit(0);
}

Your task is to get ctarget to execute the code for touch2 instead of returning to test. To do so, you must make it appear to touch2 as if you have passed your cookie in as its argument.

Hints

• You will want to position a byte representation of the address of your injected code in such a way that the ret instruction at the end of the code for getbuf will transfer control to it.

• Recall that the first argument to a function is passed in register rdi.

• Your injected code should set the register to your cookie, and then use a ret instruction to transfer control to the first instruction in touch2.

• Do not attempt to use jmp or call instructions in your exploit code. The encodings of destination addresses for these instructions are difficult to formulate. Use ret instructions for all transfers of control, even when you are not returning from a call.

• See Generating Byte Codes on how to use tools to generate the byte-level representations of instruction sequences.

• There is a -q flag to ctarget that stops the program from talking to the grading server.

• There is an -i file option to ctarget that tells it to read from a file named file instead of from stdin.

(When logged in, completion status appears here.)