## https://sploitus.com/exploit?id=BAC2AC7F-5746-5BCE-A5E8-BAAC05EAD2B6
# Buffer Overflow Exploitation
**Student:** Sampson Edward Stobite
**Index Number:** FC.M.41.018.234.23
**Course:** CY 3A — CY376: Network Monitoring, Security and Auditing
**Lecturer:** Mr. Fredrick Broni
## Summary
This project demonstrates a classic stack-based buffer overflow (return-address
overwrite) against an intentionally unprotected 32-bit ELF binary, `vulnerable`.
The target is compiled without a stack canary, without PIE, and with an
executable stack, allowing precise EIP control and redirection of execution
into a `win()` function that is never called during normal program flow.
All work was performed in an isolated Kali Linux lab VM against a
self-compiled binary. No real or third-party systems were targeted.
## Tools Used
- **OS:** Kali GNU/Linux Rolling (kernel 7.0.12+kali-amd64) on VMware
- **GCC 15.3.0** — 32-bit multilib support, for compiling the unprotected target
- **GDB 17.2** (with GEF) — register and stack inspection
- **pwntools 4.15.0** — cyclic pattern generation, offset calculation, exploit scripting
## Repository Structure
```
.
├── src/
│ └── vuln.c # Vulnerable target source
├── scripts/
│ ├── eip_test.py # Confirms precise EIP control (offset 76 -> 'BBBB')
│ └── exploit.py # Final exploit: redirects execution to win()
├── configs/ # Compilation flags / environment notes
├── docs/
│ └── Buffer-Overflow-Exploitation.pdf # Final report
├── evidence/ # Screenshots / terminal captures referenced in the report
└── README.md
```
## How to Run
1. Compile the vulnerable binary inside an isolated 32-bit-capable lab VM:
```bash
gcc -m32 -fno-stack-protector -no-pie -z execstack -o vulnerable src/vuln.c
```
2. Confirm the absence of protections:
```bash
checksec --file=vulnerable
```
3. Confirm EIP control:
```bash
python3 scripts/eip_test.py
```
Then inspect the crash in GDB/GEF and confirm `EIP = 0x42424242`.
4. Recover the `win()` address:
```bash
objdump -d vulnerable | grep -A1 ':'
```
5. Run the final exploit:
```bash
python3 scripts/exploit.py
```
Expected output: `You got code execution`
## Key Findings
- **Offset to saved EIP:** 76 bytes (determined via cyclic pattern, confirmed with GDB/GEF)
- **win() address:** `0x08049186` (static and predictable due to no PIE)
- **No stack canary:** corrupted return address went undetected until the CPU fetched it
- **Executable stack / NX disabled:** not required for this return-to-function attack
## Mitigations Discussed
- Never use `gets()` — prefer `fgets()` with explicit bounds checking
- Enable `-fstack-protector-strong`, PIE, and NX at compile time
- Regular code review and penetration testing to catch these issues early
## Screenshots / Evidence
See `evidence/` for terminal captures referenced in the report (environment
setup, `checksec` output, GDB crash analysis, and exploit execution).
## Notes
- Lab and simulated data only; no real or third-party systems were tested.
- See `docs/Buffer-Overflow-Exploitation.pdf` for the full write-up with
screenshots, analysis, and conclusions.