C# Stack Overflow Overwrite EIP

Question

I would like to write a vulnerable program, to better understand Stack Overflow (causes) in c#, and also for educational purposes. Basically, I "just" want a stack overflow, that overwrites the EIP, so I get control over it and can point to my own code. My problem is: Which objects do use the stack as memory location? For example: the Program parses a text file with recursive bytewise reading until a line break is found (yeah, I think nobody would do this, but as this is only for learning...). Currently, I'm appending a string with the hex value of chars in a text file. This string is a field of an object that is instanciated after calling main(). Using WinDbg, I got these values after the stack has overflown from (nearly) endless recursion:

(14a0.17e0): Break instruction exception - code 80000003 (first chance)
eax=00000000 ebx=00000000 ecx=0023f618 edx=778570b4 esi=fffffffe edi=00000000
eip=778b04f6 esp=0023f634 ebp=0023f660 iopl=0

BTW I'm using a Win7x86 AMD machine, if this is from interest. I've seen many C++ examples causing a stack overflow using strcpy, is there any similar method in c#?

Best Regards, NoMad

edit: I use this code to cause the stack overflow.

class FileTest
{
    FileStream fs = new FileStream("test.txt", FileMode.Open, FileAccess.Read);
    string line = String.Empty;
    public FileTest()
    {
        Console.WriteLine(ReadTillBreak());
    }

    private string ReadTillBreak()
    {
        int b = 0;
        b = fs.ReadByte();
        line += (char)b;
        if (b != 13)
            ReadTillBreak();
        return line;
    }
}

Is it possible to overflow the stack and write into the eip with the line string (so, content of test.txt)?

Answer 1

The reason you can do exploit stack corrupts in C and C++ is because you handle memory yourself and the language allows you to do all sorts of crazy stuff. C# runs in an environment that is specifically designed to prevent a lot of these problems. I.e. while you can easily generate a stack overflow in C# there's no way that you can modify the control flow of the program that way using managed code.

The way exploits against managed environments usually work is by breaking out of the sandbox so to speak. As long as the code runs in the sandbox there are a lot of these tricks that will simply not work.

If you want to learn about stack corruption I suggest you stick to C or C++.

Answer 2

I'm not entirely clear on you descriptions of what you have tried. Stack overflows do not generally "overwrite the EIP".

To cause a stack overflow, the most straight forward way is something like this.

void RecursiveMethod()
{
    RecursiveMethod();
}

Since each call to this method stores the return address on the stack, calling it endlessly like this without returning will eventually use up all stack space. Of course, modern Windows applications have tons of stack space so it could take a while. You could increase the amount of stack usage for each call by adding arguments or local variables within the method.