Skip to content

Instantly share code, notes, and snippets.

@artem-smotrakov
Created December 31, 2017 15:21
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save artem-smotrakov/b5ec30cd841cac298d60fbf39e43a5b7 to your computer and use it in GitHub Desktop.
Save artem-smotrakov/b5ec30cd841cac298d60fbf39e43a5b7 to your computer and use it in GitHub Desktop.
Overwriting a function pointer in global memory, see detail on https://blog.gypsyengineer.com/fun/security/global-buffer-overflows.html
#include <stdlib.h>
#include <stdio.h>
#include <string.h>
void do_something(void) {
printf("this is not a secret\n");
}
void print_secret(void) {
printf("this is a secret\n");
}
// uninitialized function pointer
void (*func)(void);
// a buffer for password
char buffer[16];
int main(int argc, char **argv) {
if(argc < 2) {
printf("pass a password\n");
exit(-1);
}
func = &do_something;
// copy pass phrase to the buffer
strcpy(buffer, argv[1]);
// check if the password is correct
if (strcmp(buffer, "password") == 0) {
printf("access granted\n");
func = &print_secret;
}
func();
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment