CODEWITHSUNDEEP
clinuxbuffer-overflowlibc
marcofor10
marcofor10

Reputation: 76

Get the address of a function in libc (execve) without gdb

I'm trying to automate a return-to-libc attack based on the exploitation of a buffer overflow vulnerabulity (on a x86-32 linux machine). I need a way to find the address of execve function in libc without using gdb:

(gdb) p execve
$1 = {} 0xf7ec1b30

The ASLR protection is disabled so as to allow this technique.

Is there a way to get the address of a function in libc as execve? With a program or any other automatable way? (no gdb because isn't automatable in a bash script or a C program).

Any advice is welcome.

Upvotes: 2

Views: 3363

Answers (2)

Mahonri Moriancumer
Mahonri Moriancumer

Reputation: 96

If you are trying to get this information for a script, perhaps the nm utility would help?

example: nm {libraryPath} | grep execve

Upvotes: 0

abligh
abligh

Reputation: 25119

Is this a trick question or does something like this not work:

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>

int
main (int argc, char **argv)
{
  void *a = execv;
  printf ("execv is at %p\n", a);
  exit (0);
}

Works here.

Upvotes: 1

Related Questions