I am trying to learn binary exploitation. I can modify the binary behaviour with gdb, but I have not understood how to exploit the binary in C.
I've found some references on "Hacking - the art of exploitation", but I cannot completely figure out how to exploit the binary. Could someone show me some examples or give me a guideline?
Below is the simple code I am trying to exploit (force the app to run execl):
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
int main(int argc, char *argv[])
{
int shell= 0;
if (shell==0) {
printf("Bye\n");
return 1;
}
execl("/bin/sh", "/bin/sh", "-p", (void *) NULL);
perror("exec");
return 1;
}
with objdump:
08048486 <main>:
8048486: 55 push %ebp
8048487: 89 e5 mov %esp,%ebp
8048489: 83 ec 04 sub $0x4,%esp
...
80484b4: 68 68 85 04 08 push $0x8048568
80484b9: 68 68 85 04 08 push $0x8048568
80484be: e8 8d fe ff ff call 8048350 <execl@plt>
80484c3: 83 c4 10 add $0x10,%esp
...
80484d8: c9 leave
80484d9: c3 ret
80484da: 66 90 xchg %ax,%ax
80484dc: 66 90 xchg %ax,%ax
80484de: 66 90 xchg %ax,%ax
Thank you
printf
andreturn 1
, then generate a hex diff, then use the script to apply that hex diff?