vuln.c

#include <stdbool.h>
#include <stdint.h>
#include <stdio.h>
#include <string.h>
#include <sys/mman.h>
#include <unistd.h>

typedef struct {
    char string[0x40];
    uint8_t len;
} fancystring;

typedef enum {
    CMD_EXIT = -1,
    CMD_UPDATE,
    CMD_READ,
} command;

/* print name */
void print_name(fancystring *name)
{
    write(STDOUT_FILENO, "name: ", sizeof("name: "));
    write(STDOUT_FILENO, name->string, name->len);
    write(STDOUT_FILENO, "\n", 1);
}

/* update name */
void update_name(fancystring *name)
{
    /* !! Stack buffer overflow !! */
    read(STDIN_FILENO, name->string, 0xf0);
}

command get_command(void)
{
    char command_buf[16];

    printf("what would you like to do?\n");
    printf("- print name (print)\n");
    printf("- update name (update)\n");
    printf("- exit (exit)\n> ");

    fgets(command_buf, sizeof(command_buf), stdin);
    command_buf[strcspn(command_buf, "\n")] = '\0';

    if (strncmp(command_buf, "print", sizeof("print")) == 0) { return CMD_READ; }
    else if (strncmp(command_buf, "update", sizeof("update")) == 0) { return CMD_UPDATE; }
    else { return CMD_EXIT; }
}

void run_service(void)
{
    fancystring name;

    printf("-----------------------------------------\n");
    printf("&name:\t\t%p\n", &name);
    printf("&mprotect:\t%p\n", mprotect);
    printf("-----------------------------------------\n");

    printf("what's your name?\n> ");
    /* read name into name, remove newline, set len */
    fgets(name.string, sizeof(name.string), stdin);
    name.string[strcspn(name.string, "\n")] = '\0';
    name.len = strlen(name.string);

    command user_choice = get_command();
    while (user_choice != CMD_EXIT)
    {
        switch (user_choice)
        {
            case CMD_READ:
                print_name(&name);
                break;
            case CMD_UPDATE:
                update_name(&name);
                break;
            default:
                break;
        }
        user_choice = get_command();
    }
}

int main(int argc, char *argv[])
{
    setvbuf(stdout, NULL, _IONBF, 0);
    run_service();
    return 0;
}