WCU / Cybersecurity
HomeCSC 471CSC 472Search /
~/CSC 472/Lab 2
CSC 472 · Lab 2

Stack Buffer Overflow

higher addressessaved return addresshijack targetsaved RBPchar buffer[ ]local variablelower addresses (RSP)overflowwrites up
A stack frame: overflowing the buffer overwrites the saved return address.

Lab objectives:

  • Understand the fundamentals of stack buffer overflows.
  • Learn to hijack control flow by overwriting a saved return address.
  • Write a working exploit with pwntools.

After this lab you should be able to articulate the nature of stack overflows, the risk they pose, and the methodology for exploiting one — and demonstrate an attack that redirects execution in a small toy program on the Badger CTF server.

Background

The provided program lab2.c reads input into a fixed-size stack buffer with gets(), which performs no bounds checking. By supplying more bytes than the buffer holds, you overwrite adjacent stack memory — including the saved return address. When the function executes ret, the CPU jumps to whatever address you placed there. Our goal is to redirect it to the hacked() function.

Experiment Setup

  • Log in to Badger CTF and copy the source: cp /workdir/ss2026/lab2/lab2.c .
  • Edit lab2.c: set array[] to the last two digits of your student ID (use the last three digits if the last two are less than 10), and replace YOURNAME in hacked() with your name.
  • Compile with mitigations disabled: gcc lab2.c -o lab2 -fno-stack-protector -z execstack -no-pie # 32-bit variant: add -m32
  • Run it and feed a long line of characters; observe the segmentation fault — the saved return address has been overwritten.

Part 1: Return Hijack Attack (8 points)

Overwrite the return address with the address of hacked() so the program prints Hacked by Your Name!!!!. A pwntools skeleton (lab2_exploit.py) is provided.

  • Find the offset (the "magic number") from the start of the buffer to the saved return address. Use a cyclic pattern: (gdb) run # feed: python3 -c "from pwn import *; print(cyclic(200))" # after the crash, read the fault address and: # python3 -c "from pwn import *; print(cyclic_find(0x6161616c))"
  • Get the address of hacked() (elf.symbols["hacked"] or gdb).
  • Build payload = b"A"*OFFSET + p64(hacked) and send it.
Q1: Explain the method you used to determine the Magic Number (the length of the dummy string needed to reach the return address). (3 pts)
Q2: Provide your exploit.py and a screenshot of the successful run showing your "Hacked by ..." message. (3 pts)
Q3 (64-bit only): If your exploit crashes inside hacked() with a movaps fault, explain why, and how adding a ret gadget before the target address fixes it (16-byte stack alignment). (2 pts)

Part 2: Return-to-Shellcode (Bonus: 2 points)

Because you compiled with -z execstack, the stack is executable. Instead of returning to hacked(), place shellcode on the stack and overwrite the return address to jump to it, obtaining a shell. Then run whoami and date.

Bonus: Use shellcraft/asm() from pwntools to generate execve("/bin/sh") shellcode. Include your script and a screenshot of the shell running whoami and date.

Hint

Review Class 03: Buffer Overflows and Class 04: Shellcode.

Deliverables

A PDF report with your answers, your exploit.py, and screenshots of successful exploitation. Explain how you found the Magic Number.

Submission

  • The project due date is on our course website. Late submission will not be accepted.
  • Submit your assignment to D2L directly.
  • No copy or cheating is tolerated. If your work is based on others' or AI, please give clear attribution. Otherwise, you WILL FAIL this course.
BackCSC 472 home