Linux (x86) Exploit development series 3:off-by-one

What are Off-by-one bugs?

Copying source string to destination buffer could result in off-by-one when

1. Source string length is equal to destination buffer length.

When source string length was equal to destination buffer length, a single NULL byte gets copied just above the destination Buffer. Here since the destination buffer are located in stacks, the single NULL byte could overwrite the least significant bit (LSB ) of caller's EBP stored in the stacks and this could leads to arbitrary code execution. (on the stack, null covers the LSB of EBP)

How arbitrary code execution is achieved?

Arbitrary code execution is achieved using a technique called "EBP overwrite". If Callers's EBP is located just above the destination buffer and after strcpy, a single NULL byte would has overwritten The LSB of caller's EBP.

Snap To

Gcc-fno-stack-protector-z Execstack–mpreferred-stack-boundary=2-o Vuln vuln.c

Test Step 1:is EBP Overwrite and thus return address overwrite possible?

Test Step 2:what is the offset from destination buffer.

The stack address is different when you open the program with Python's subprocess call and run the program directly at the terminal

Child processes cause stack offsets

Linux (x86) Exploit development series 3:off-by-one