> For the complete documentation index, see [llms.txt](https://666isildur.gitbook.io/ethical-hacking/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://666isildur.gitbook.io/ethical-hacking/protostar/stack-0.md).

# Stack 0

## About

![](https://3889206050-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6DIEHtstePxj4NCmCC%2F-M7oYopRXnKXYEaJ2a6o%2F-M7tgwzNR4EttP2yurZe%2Fimage.png?alt=media\&token=32c35e0c-8a2c-4aa9-804b-c3c6f93238fe)

## Source Code

```c
#include <stdlib.h>
#include <unistd.h>
#include <stdio.h>

int main(int argc, char **argv)
{
  volatile int modified;
  char buffer[64];

  modified = 0;
  gets(buffer);

  if(modified != 0) {
      printf("you have changed the 'modified' variable\n");
  } else {
      printf("Try again?\n");
  }
}

```

## Analysing the Source Code

By looking at the source code we see that to solve  Stack 0 we need to find a way to set the `modified` variable to `not 0`. At line 8, a character array of 64 bytes is set, then modified is set to 0 and the program calls the `gets` function at line 11 which stores our user input.

Looking at the `gets` man page we can see that is a vulnerable function.

![](https://3889206050-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6DIEHtstePxj4NCmCC%2F-M7oYopRXnKXYEaJ2a6o%2F-M7tieDgAeIvrcL3e_Uv%2Fimage.png?alt=media\&token=5956bb8c-cd9b-4148-9cda-60bf4608915e)

## Debugging the binary with GDB

We run the binary on GDB, set the disassembly syntax to Intel with the command `set disassembly-flavor intel` and disassemble main with the command `disas main`.

![](https://3889206050-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6DIEHtstePxj4NCmCC%2F-M7oYopRXnKXYEaJ2a6o%2F-M7tkcwfsWrQAzSgFF20%2Fimage.png?alt=media\&token=c4b23eea-00cb-4ba5-928d-aac104172f5b)

Above we can see the instruction where `modified` is set to 0 before the call to the `gets` function, and after that `modified` is there stored on `eax` and then tested if its 0 with the instruction `test eax, eax`.&#x20;

We place a breakpoint at the address after the `gets` function and provide some `A` as input. What we want to analyse is where our `A`'s are placed on the stack, and what is the value of `esp+0x5c` which is our modified variable, as well as if we can change it.

![](https://3889206050-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6DIEHtstePxj4NCmCC%2F-M7oYopRXnKXYEaJ2a6o%2F-M7tpoYzglbaA1LNc9Nw%2Fimage.png?alt=media\&token=49cc8641-e56b-4128-8cc0-325e2f70b0e6)

The first thing we notice is that our `A`'s show up in the stack represented by their hexadecimal value `0x41`. Then when we see the content of `esp+0x5c` we can see that its still `0` , but we can see where it is stored on the stack. We count how many more character we need to overwirte the `modified` variable to overwrite the 64 char array and overflow the variable. So let's try it.

![](https://3889206050-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6DIEHtstePxj4NCmCC%2F-M7oYopRXnKXYEaJ2a6o%2F-M7triI1wl9X9o30wy__%2Fimage.png?alt=media\&token=de5c4b5c-6467-4e13-91aa-0ce59a69c558)

We have successfully modified the `modified` variable.  Using python we can modify the variable through the command line.

![](https://3889206050-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6DIEHtstePxj4NCmCC%2F-M7oYopRXnKXYEaJ2a6o%2F-M7tt8cO7RuPaNn7yIny%2Fimage.png?alt=media\&token=485a43f9-1982-411a-8575-ea653dab44ea)