Contents
How to find address of libc in fflush?
I found libc’s address by using “ldd vuln”, and found system’s offset by using “readelf -s /lib/i386-linux-gnu/libc.so.6 | grep system”. I was struggling with finding the address of “sh” in the fflush command in the program.
How to find the base address of libc?
Assuming there is no ASLR protection, using gdb–>b main–>info proc mappings should give you the base address of the libc SO.
How to exploit buffer overflow using return to libc?
But being specific to using the “Return to Libc” method of exploitation I would try to cover majority the areas. Before proceeding, this blogpost expects you to know basics of what buffer overflow is, how it occurs and basic buffer overflow exploitation. Also, a spoiler alert for the CTF machine “Jigsaw: 1’s” privilege escalation part.
How is return to libc used for exploitation?
For the same we would be utilizing the “Return to libc” method of exploitation, where we would be using sys calls using the functions in libc. For this we would be leveraging system calls to gain shell on our local system first. Before acquiring the addresses, we would first turn off the ASLR protection on our local system.
How to find the address of a string in libc?
Here are two methods: 1. strings -t x -a /path/to/libc | grep “/bin/sh” –> this outputs the offset of the string in libc. Thanks for contributing an answer to Information Security Stack Exchange!
Is there a way to leak the address of libc?
First, before you can approach your problem, you need to check if the executable is running under ASLR ( https://en.wikipedia.org/wiki/Address_space_layout_randomization ) If that’s the case, you will need to find a way to leak the address from the program, as the address of libc will be different every time.
How to find the base address of an executable?
In order to find the base address of the executable module at runtime you can use use gdb or any other debugger and search for the entry point of the executable (or just search for your string after the executable is loaded into memory…). Basically any program that will load your executable to memory and allow you to view the memory will do.