I have a buffer overflow assignment like this, I set the correct varaible to the HEX value of 1 (31) and still nothing, how do I solve this

Question

How do I set the value of correct to 1 with an buffer overflow exploit? When I pass nothing to this the value of temper is 4D2 which is hex for 1234, but when I overflow the buffer with lets say 10 A's followed by 1234 -> AAAAAAAAAA1234 temper gets changed to 0x34333231, I don't understand this, can somebody help?

#include <stdlib.h>
#include <unistd.h>
#include <stdio.h>
#include <string.h>
#include <signal.h>


int main(int argc, char **argv)
{
 volatile int correct = 0;
 volatile int tamper = 1234;
 char buffer[10];

 gets(buffer);

 if(strcmp(buffer, [REDACTED])==0) {
   correct = 1;
 }

 if(tamper!=1234) {
     printf("Alert! You hit the tamper switch!\n\n<!--correct = 0x%08x-->\n<!--tamper = 0x%08x-->\n", correct, tamper);
     exit(0);
 }

 if(correct==1) {
  printf("Login successful.\n\n<b>flag{REDACTED}</b>\n\nThe credentials to access this machine are \n\n<b>user:</b>REDACTED\n<b>password:</b>REDACTED\n");

 } else {
  printf("Sorry, password incorrect.\n\n<!--correct = 0x%08x-->\n<!--tamper = 0x%08x-->\n", correct, tamper);
 }

}

Answer 1

To exploit this program (if it's an assignment it will surely be compilated corretly to have buffer before correct) you need to overwrite correct with the int value 1.

The hex value of 1 is 0x1, the hex value of 1234 is 0x4D2

The structure of the stack will have to be:

        ________________
       |                |
       |      0x1       |  correct (sizeof(int) = 4)
       |                |
       |________________|
       |                |
       |     0x4D2      |  tamper (sizeof(int) = 4)
       |                |
       |________________|
       |                |
       |                |
       |                |
       |                |
       |    gibberish   |  buffer (10 * sizeof(char) = 10)
       |                |
       |                |
       |                |
       |                |
       |________________|
       |                |
       ..................
       ..................
       ..................

Unfortunately you will have to be aware of endianness, too: 0x1 will be in memory as 0x01000000 (x-86 architectures) or 0x0100000000000000(x-86_64 architectures). The same will be applied to tamper.

NB: If you don't want to convert indianness yourself you can just use functions p32 or p64 in pwntools library

Also notice that a lot of values inside the tamper and correct will be non-printable.