Another buffer overflow through command line argument on Windows 10

This is a demo of buffer overflow through a command line argument. In this example, a function f() other than main() is vulnerbale. I could not find a good example with Python for Windows so I created one.

Experiment setup:

Windows 10 with all Exploit Protection disabled
mingw-w64! installed
nasm! installed
arwin! installed
Windows Sysinternals/listdlls! installed
buffer_strcpy2.c: the victim C code with the vulnerable strcpy() in a function f() other than main(), which copies the user input (from argv[1]) into a buffer

calc-shell.asm: the assembly code for shellcode, which pops up a caculator

exploit2.py: In the python code exploit2.py, we save the shell code and other necessary parts into an environment variable, and then open a command shell, which inherits all environment variables including the one we created. In the newly opened command shell, the environment variable is fed into a victim program as a command line argument, which causes the buffer overflow and pops up the calculator.

In this exploit, we use the address of jmp esp to overwrite the return address. The malicious string contains the shellcode, which will be put above the return address. So the malcious string has this format, padding || address of jmp esp || shellcode, where || means concatenation. The reason we need to use the address of jmp esp is the stack address starts with a null byte in Windows.

GitHub code: https://github.com/xinwenfu/Malware-Analysis/tree/main/Buffer-Overflow/BOF-jmpesp