Slashdot Mirror
How To Conduct Your Very Own Buffer Overflow
Adam writes "If you've ever wanted to create your own buffer overflow or just to see how one works, check out this tutorial. The article talks about how a buffer overflow works and gives a guided example through an exploit to help you on your way. Definitely worth checking out." From the article: "Every now and again we all hear about an exploit that takes place thanks to a buffer overflow, but what is a buffer overflow? By definition it is when a program attempts to store more data in an array (buffer) than it was intended to hold, thus overwriting the return address of the function. To show how this is actually done, I'll explain how to do a simple attack on a fairly small program."
Zonk posts a story from a submitter that wrote the page being submitted for the story, who, as it turns out, blatantly plagarized the content from Bryant and O'Hallaron's Computer Systems book.
As a matter of fact, on the webpage itself, the very first response to the post calls Adam out about this, but apparently, it is still suffficiently 'news' to merit posting here.
Way to go, Zonk...once again, you've lowered the standard.
What's next, "How To Conduct Your Very Own Segmentation Fault"?
Obliteracy: Words with explosions
Is the tutorial correct?
It doesn't seem to wo----
Tutorials are for wimps.
Real men create buffer overflows by accident.
What we need are more and better ways of providing defenses against them.
Another good reference is the Tao of Windows Buffer Overflow by the Cult of the Dead Cow. A very detailed explanation how to exploit stack overflows on Windows.
Test your net with Netalyzr
Now buffer overflow exploits can be written by everyday common script kiddies now that there is this wonderful tutorial featured on slashdot.
Expect a flood of security patches in the next 30 days, and a strong new virus in the same time frame.
I agree,
If anything, one should use this classic text:
http://www.shmoo.com/phrack/Phrack49/p49-14
Just when you thought it was safe to leave your buffer uncapped.
Job? I don't have time to get a job! Who will sit around and bitch about being broke and unemployed then?
This even has great source code and explains the theory quite well.
t .pdf
http://www.gergltd.com/IATAC-BufferOverflowExploi
... if you have recommendations or pros/cons, reply to this...
did anyone else notice the comments on the site regarding the blog, how can you take a site seriously with comments like that...
/. seriously)
(oh, and no I do not take
[n8.r0n] http://petesweb.spymac.net/
It definitely works, I just compil..0xdeadbeef
The best article about buffer overflows is the well-known "Smashing the Stack for Fun and Profit" by Aleph One in Phrack. Here's the first link google gave me.
Everything else (like this article) pales in comparison.
http://www.talknerdy.org
I can overflow buffers quite well on my own without any help.
That is all.
Great article on countering buffer overflows.
Just teach yourself C! You'll discover every possible way in which things can go wrong, and in no time at all.
Fred
"A fool and his freedom are soon parted"
-RMS
Didn't Aleph One describe this years ago?
the author of the article states: "-o tells gcc to compile the file"
but fortunately he didnt write the example, its taken from Bryant and O'Hallaron's Computer Systems.
-mr silver
By imposing array bound checking at every operation? I know that the check is redundant for a tight linear algebra loop that is obviously bug free, but I think that I'm in a position to mandate that all these people take the penality hit just because I like the idea of imposing my view on people that are smarter than me. Oh yeah and mandate training wheels on all bicycles too.
1 - Choose random windows version.
;-)
2 - Choose random exe or dll that cames with the OS.
3 - Choose a random base address.
4 - Write your code
5 - ???
6 - Profit!
It's like trying to throw a rock to the floor, you just can't miss
WTF am I doing replying to an AC at 5 A.M on a Friday night?
You've Been Zonked!
now back to work...
Get your Unix fortune now!
Read what I consider the seminal hacker work on this subject by Aleph One over at phrack.org
http://www.phrack.org/show.php?p=49&a=14
A little on the detailed side, especially the gdb stuff, but a GREAT article.
"The greatest dangers to liberty lurk in insidious encroachment by men of zeal, well-meaning but without understanding."
This kid is just trying to drum up visitors to his site. The site itself is pretty much devoid of content and the code is taken without citation.
Slashdot: News for ScriptKiddies. Stuff that doesn't matter.
#include
/* this function should never return, in fact it
/* deliberately copy from a larger buffer to a stack segment buffer more than it can hold */
#include <string.h>
char bigBuffer[4096];
void overflowMe();
main()
{
memset(bigBuffer, 0, sizeof(bigBuffer));
overflowMe();
}
should/might SIGSEGV as the return address will be esentially reset to IP=0x00000000 */
void overflowMe()
{
char localBuffer[256];
memcpy(localBuffer, bigBuffer, sizeof(bigBuffer));
}
Leave it there.
Why people does care so much about creating buffer overflows. Just write programs in C/C++, you WILL create buffer overflows. It seems that most of programmers can't avoid them and "buffer-overflow vulnerabilities" are found all the time. Why not care instead about the methods created to fix (most of) them? The ones that many distros are still not shipping despite of being quite obvious that they're need more than the latest KDENOME shit?
Just check the debian security mailing list and look how many buffer overflow security bugs are there: Too many. Too many for something which is know to be (partially) fixable with kernel/compiler tricks. Did GCC 4.0 included finally that FORTIFY thing that includes both compile-time and run-time "buffer overflow protections" BTW? That is interesting, not learning how to create buffer overflows.
First, you bash a respected university for offering a course on malware, and now you link instructions on how to exploit a buffer overflow from the main page.
If you're reading this and you don't already know what a "buffer overflow" is, turn in your geek card and leave Slashdot immediately.
What's next? "Ever wonder what what Linux was? Here's a great book which (blah, blah, blah)..."
time of death...
1744 CST
DJ Bernstein Will Tell You Why
Among my favorite advice of his is to completely give up on the standard C library. Really, everybody should have done it a while ago. It's one of those things like the unix pipe model that was a good start, but now that it has hung around for 25 years, it needs an upgrade. How about everybody stop using the standard C library and switch to something like the Apache Portable Runtime?
Write bug-free code. I've mostly given up on the standard C library. Many of its facilities, particularly stdio, seem designed to encourage bugs. A big chunk of qmail is stolen from a basic C library that I've been developing for several years for a variety of applications. The stralloc concept and getln() make it very easy to avoid buffer overruns, memory leaks, and artificial line length limits.
Dose ne1 hav a pr0g that can do dis 4 me? I g0t 2 much hw to lern it. k thx. OMG!!11one one !@1
...but I know for a fact that his server is fighting for it's life right about now! The Slashdot Effect is killing it...
Slashdot's going to show us how to make our very own Hello World program - yay!
#include <stdio.h>
#include <string.h>
int main()
{
struct
{
unsigned char buffer[4];
unsigned char overrun;
} data;
data.overrun = 0xFF;
printf("Initial: %u\n", data.overrun);
memset(&data.buffer[0], 0, 5);
printf("Final: %u\n", data.overrun);
}
5 bytes get pushed onto the stack to reserve memory for the structure data when main is invoked. Memset starts writing to the base address of the structure at data.buffer[0] for 5 bytes. The space allocated for buffer, however is only 4 bytes, which causes the operation to leak into the variable overrun. When the output is displayed, overrun should change from 255 to 0.
from the downtime-of-my-very-own dept.
Adam writes "If you've ever wanted to create your own Slashdot effect or just to see how one works, check out this tutorial. The article talks about how a Slashdotting works and gives a guided example through an exploit to help you on your way. Definitely worth checking out." From the article: "Every now and again we all hear about an exploit that takes place thanks to the Slashdot effect, but what is the Slashdot effect? By definition it is when a website attempts to service more users than it was intended to hold, thus returning an error message from the server. To show how this is actually done, I'll explain how to do a simple attack on a fairly small Slashdot post."
Step 1 : Submit your site to Slashdot.
Step 2 : Sit back and relax while your server melts.
I loaded up this article and what do I see?
This ad from Microsoft staring back at me.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
Boom. Instant buffer overflow. You're a rogue hacker.
I've been hearing about reuse of code and the development of stable shared libraries for the past 20 years and its probably been going on for longer than that. Why don't people, especially OS and application people, create, debug, and reuse a set of overflow-proof buffer-handling libraries? The libraries could include a range of forked versions for different usage patterns (e.g., big buffers of small data objects, small buffers of big data objects, buffers optimized for variable or fixed size, buffers optimized for frequent writes/sorts/reads/etc. Why is that so hard?
Every buffer-overflow exploit is just evidence of re-invention of a bug-filled wheel.
Two wrongs don't make a right, but three lefts do.
Zonk writes "If you've ever wanted to slashdot your own server or just to see how one works, check out this tutorial. The article talks about how the slashdot effect works and gives a guided example through an exploit to help you on your way. Definitely worth checking out." From the article: "Every now and again we all hear about a server disappearing from the face of the earth thanks to the slashdot effect, but what is the slashdot effect? By definition it is when a slashdot editor posts a link on the frontpage to a small server without using coral cache and zillions of slashdotters click on the link the minute the story is published, thus hammering the server into oblivion. To show how this is actually done, I'll explain how to submit a story with a link to your own server by praising Apple, dissing Microsoft or revealing more SCO conspiracies."
Without further ado, here are some corrections:
To compile this code into an object file, type into the shell gcc -O2 -c assembly.s and then dissemble it by typing objdump -d assembly.o > input.txt.
For example, if %ebp equaled bf ff ef d8 it would become d8 ef ff bf. Once this is all done you can test your exploit by saving input.txt and then typing in
I once used a buffer overrun in a ps2 game I was working on to allow me to download a patch when no patching mechanism was in place.
This was very handy for creating some small additions to the game.
Never patched the hole. But then again, the game didn't sell that well.
Most programmers compile separately from linking, so they might do a command process like:They can now run "myprogram" to test their code. They do this, because compiling takes a lot of time and programmers don't want to have to recompile their entire program if they only modified one file. If they only modified myfile2.c in the above example, then they can simply recompile the one file and relink:
The /. effect knocked the account out of existence!
"Account Suspended
Your account has been suspended for 1 of 2 reasons.
1. Your bill is over due. In this case please email billing@vizaweb.com
2. You account what causing a problem of some sort. In this case please contact CustomerCare@vizaweb.com"
hmm... Even Slashdotted sites can't spell!
Let me be the first to welcome our new Von Neuyman overlords.
Internal Server Error
The server encountered an internal error or misconfiguration and was unable to complete your request.
Please contact the server administrator, webmaster@collegebums.org and inform them of the time the error occurred, and anything you might have done that may have caused the error.
More information about this error may be available in the server error log.
Additionally, a 500 Internal Server Error error was encountered while trying to use an ErrorDocument to handle the request.
Let's queue up all of the comments written by people who are going to balk at this for being elementary while secretly pawing through the article for notes.
If you were about to write such a comment: Since people who tend to write such comments tend to be rather unmoved by anything anyone else says or does unless the purveyor of information happens to either be a hot woman or be the coolest mall-goth in their pack at the moment, I am relatively certain that my initial comment pointing out your activity will not dissuade you from posting; however, you can make your post a happier place for other peoples eyes to accidentally crash into if you simply remember that 3's are not E's, 7's are not T's, etc. etc. etc.
If this is a bit over your head, or you'd like some more general information on posting, please view the following film strip:
http://pyro.buildtolearn.net/misc/posting.swf
Seems like the server's buffers where overflowed. Oh! the irony!
For the easiest buffer overflow ever, just fireup good ol' Windows 95. That'll give you more buffer overflows than you could shake a stick at.
Open Windows
The submitter's full name is Adam Piquepaille.
Boss design?
Ignorance is curable, stupid is forever.
Was that the demonstration? Was the 'fairly small programm' the server itself, maybe on a floppy disk?
The grass is always greener on the other side of the light cone.
This gets published, and my submission on "Court blocks U.S. rules for anti-piracy TV technology" has been pending all day?
Homer no function beer well without.
Isn't that Slashdot policy? I mean, what with Roland and all? If /. history is any indication, get set to hear a lot more from this boy!
"Who are in control, they are not in control of anything - they don't even control themselves!" - Glen Beck
you think you've had something pending for a while, check out the pending story (it's a poll, and I didn't even save my own copy, but maybe I'll see it again SOMEDAY...) in my 'recent submissions' http://hardware.slashdot.org/~antispam_ben/
OOTC: I recall intentional buffer overflows and similar hacks in FORTRAN from 25 years ago. I suppose it's good Pascal was never used for a system language, the language definition has array bounds checking built-in. OTOH, pointers can point to anything (IIRC it's called coercion in Pascal - amazing what stuff I remember that's totally useless now).
Now where's that slashdot mirror site???
Tag lost or not installed.
Ingenious! I'll have to intergrate this brilliant new feature into all of our new products!
--Bill
Now run the program. Its really cool! Ok, here goes! user-b signed off. (Buffer overflow) Hahaha
>
Ok, now run the code
Here goes...
user-b signoff: (Ping Timeout)
Bwahaha, he fell for the old "Buffer Overrun" trick.
>
I guess that's what we should call the /. effect :)
-Palal
but, I blew my mod points on the Al Gore article. ...And I just posted.
I find it ironic that this is giving me an "Internal Server Error" =P
Deserves him right for posting a Phrack article from 97 (or somewhere around then, IIRC).
There's a better CDC (that's Cult of the Dead Cow for you young fellows) one out there, I just don't have a link to it.
It was actually a web-based tutorial, not a g-file (that's a text page to you young-un's).
Don't think that a small group of dedicated individuals can't change the world. It's the only thing that ever has.
Just a stupid question: Wouldn't it be harder to get damage from accidental buffer overflows, if the stack grew _up_ instead of down?
Here is another tutorial on that (my own, of course):w _en.pdf
http://www.hakin9.org/en/attachments/stackoverflo
Hope somebody will like it.
This one is basic, but it's always good to know how to mess up a program. Great if you can make it, but if you know how to mess it up really badly, it's easier to patch and fix. Of course, most C libs out there in the OSS world have better functions for the most commonly buffer-overflowed functions, but I know there are other ways.
I know they said the best way to learn is through examples, but maybe this guy's approach is a little too rough.
let me try to program a calculator in C++!
(based on a real story)
My new blog
The guy that owns vizaweb is a good personal friend of mine. You can be sure this site will come up next time I see him.
A community-oriented lyrics site
So his site is DEVOID of Content eh? That's an interesting observation. Conversely, my site is JAMMED with stuff... about 180 pages. Anyone, anyone? http://tinyurl.com/bevf9 . Just funning wit you. Have a great weekend everybody. Don't buy any used clusters. Woody
One of the first rules I teach my students:
Never, never ever, call a program test.
I've just seen too many people wondering that their nice new program appears to just do nothing...