EDIT: This post has become extremely popular and I would like to take a minute to discuss why this is here. This post was put here by me to help students solve and understand the extremely difficult bufbomb lab. It is not here to give students the answers, it is here to explain how to solve the answers and why these solutions work using assembly and GDB for students who might be struggling.
I have been working on the Bufbomb phase 0 and 1 recently and decided to share a basic idea of how to do them for anybody who is searching the internet for the answers.
Phase 0
This phase is really easy and you should probably be able to get it on your own, but it took me a while to get. Start by starting gdb and setting a break point for getbuf. Now run it until it hits the breakpoint. At this point you need to get the address of %ebp and %esp. Just type ‘info registers’ to get this. Subtract %esp from %ebp using this hex calculator. This gives us the distance to the end of the getbuf function in the stack. You should know that the last 4 segments of your input should be the address of the smoke function. Quit gdb by typing q and type objdump -d bufbomb. Find the smoke function in the output and write down the address. Now make your input file using nano, emacs or vi and name it something like candle.txt. You need to do a bit of calculation here. Subtract 4 from the distance you calculated between %esp and %ebp. Now type in numbers until you reach the new distance. For example if my distance between %esp and %ebp was 28 I would type:
01 02 03 04 05 06 07 08 09 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24
Now you need to reverse the address of the smoke function because the machine is little endian. For example, if the address of my smoke function was 12345678, I would put 78 56 34 12 into my input file. The input file would look like this:
01 02 03 04 05 06 07 08 09 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 78 56 34 12
Save your input file and use sendstring to encode it to binary with this command:
./sendstring < candle.txt > candle.bin
Now run the bufbomb:
./bufbomb -t *team name* < candle.bin
Phase 1
This phase is slightly harder and requires slightly more skill to solve. The goal is to call the fizz function and pass it your cookie as an argument. The first part is pretty much the same as Phase 0. Use ‘objdump -d bufbomb’ to find the address of the fizz function. Put the address of fizz in the place of the address of the smoke function in the same way as the first phase. If your address was 01122334 for fizz it would be 34 23 12 01.
01 02 03 04 05 06 07 08 09 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 34 23 12 01
Now add 4 numbers for padding (I used the number 30) and add your cookie reversed for a little endian machine. If my cookie was 56789123 it would be 23 91 78 56. using that logic add the cookie to the end of your string.
01 02 03 04 05 06 07 08 09 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 34 23 12 01 30 30 30 30 23 91 78 56
From there save and use sendstring to encode to a binary file again and run it like you did in the first step. I am pretty sure that this is how I completed the first two phases, but if anybody reading this needs more help hit up the comments and I will try to assist.
