Exploiting Stack Buffer Overflow [closed]

Question

Closed. This question does not meet Stack Overflow guidelines. It is not currently accepting answers.

---

Closed 9 years ago.

• Questions asking us to recommend or find a tool, library or favorite off-site resource are off-topic for Stack Overflow as they tend to attract opinionated answers and spam. Instead, describe the problem and what has been done so far to solve it.
• This question appears to be off-topic because it lacks sufficient information to diagnose the problem. Describe your problem in more detail or include a minimal example in the question itself.

Improve this question

First off the computer I'm running this on is an Intel System running Linux on a 32-bit stack. My professor posed a challenge question to us in class.

Here is the code before I ask the question

// funWithFooAndBar.c
#include <stdio.h> 
#include <stdlib.h> 

void bar() 
{ 
 printf("Now inside bar()!\n"); 
} 

void foo() 
{ 
 void *addr[1]; 

 printf("Now inside foo()!\n"); 
 // this is where I need to modify my code, 
 //I was given the hint that it will only be two lines of code 
 // So something like: 
addr[1] = bar;
addr[5] = addr[4];
addr[4] = bar;;

} 

int main (int argc, char *argv[]) 
{ 
 foo(); 
 printf("Back in main\n"); 
 return 0; 
} 

The goal is to smash the stack by writing beyond the end of an array, and through that, overwrite the return address so that the function call to foo () returns to bar () on its way back to main. So my output is supposed to look like:

Now inside foo() !

Now inside bar() !

Back in main

In order to do this I have to overflow the array so that the return address is overwritten with the address of the bar.I'm pretty sure that it will have to involve the address of function bar() which will equate to &bar()

The question he posed was what two lines of code could we add (where I commented) to make the output as a shown above.

Thanks!

Edit: I was hoping more for an explanation than a direct answer, I know what I'm supposed to do, just not how to translate that to the c code.

Edit: made an attempt

Answer 1

After reading the article that R M linked:

addr[1] = bar;

addr[5] = addr[4];

addr[4] = bar;

Turns out to work.