How would you change a global variable with a buffer overflow?

Viewed 284

So I have this vulnerable piece of code in which I'm trying to exploit to print out Come on in.. Below is the code mentioned.

#include <stdlib.h>
#include <unistd.h>
#include <stdio.h>
#include <string.h>

int user_age;
void secretClub(){
  if(user_age<18){
    printf("Come back when your old enough!!");
  }
  else{
    printf("Come on in.");
}
}

int main(){
  char name[30];
  user_age = 17;
  gets(name);
  printf("Hello there ");
  printf(name);
}

Now, I'm aware that since the function secretClub is never called, I would need to overflow the buffer name in so that the return address points at the address for secretClub. I'm also aware that there exists a format string vulnerability in printf in main that could be exploited to change the variable user_age.

I'm struggling to see how you would piece this all together. Is it possible that the use of a format string attack is actually redundant here and you could just redirect with a buffer overflow so that it prints out "Come on in."?

I'm new to this and still learning, I'd really appreciate any form of guidance. Thank you!

0 Answers
Related