Slashdot Mirror
How To Conduct Your Very Own Buffer Overflow
Adam writes "If you've ever wanted to create your own buffer overflow or just to see how one works, check out this tutorial. The article talks about how a buffer overflow works and gives a guided example through an exploit to help you on your way. Definitely worth checking out." From the article: "Every now and again we all hear about an exploit that takes place thanks to a buffer overflow, but what is a buffer overflow? By definition it is when a program attempts to store more data in an array (buffer) than it was intended to hold, thus overwriting the return address of the function. To show how this is actually done, I'll explain how to do a simple attack on a fairly small program."
Zonk posts a story from a submitter that wrote the page being submitted for the story, who, as it turns out, blatantly plagarized the content from Bryant and O'Hallaron's Computer Systems book.
As a matter of fact, on the webpage itself, the very first response to the post calls Adam out about this, but apparently, it is still suffficiently 'news' to merit posting here.
Way to go, Zonk...once again, you've lowered the standard.
What's next, "How To Conduct Your Very Own Segmentation Fault"?
Obliteracy: Words with explosions
Is the tutorial correct?
It doesn't seem to wo----
Tutorials are for wimps.
Real men create buffer overflows by accident.
Another good reference is the Tao of Windows Buffer Overflow by the Cult of the Dead Cow. A very detailed explanation how to exploit stack overflows on Windows.
Test your net with Netalyzr
I agree,
If anything, one should use this classic text:
http://www.shmoo.com/phrack/Phrack49/p49-14
This even has great source code and explains the theory quite well.
t .pdf
http://www.gergltd.com/IATAC-BufferOverflowExploi
did anyone else notice the comments on the site regarding the blog, how can you take a site seriously with comments like that...
/. seriously)
(oh, and no I do not take
[n8.r0n] http://petesweb.spymac.net/
It definitely works, I just compil..0xdeadbeef
The best article about buffer overflows is the well-known "Smashing the Stack for Fun and Profit" by Aleph One in Phrack. Here's the first link google gave me.
Everything else (like this article) pales in comparison.
http://www.talknerdy.org
I can overflow buffers quite well on my own without any help.
That is all.
Great article on countering buffer overflows.
Just teach yourself C! You'll discover every possible way in which things can go wrong, and in no time at all.
Fred
"A fool and his freedom are soon parted"
-RMS
the author of the article states: "-o tells gcc to compile the file"
but fortunately he didnt write the example, its taken from Bryant and O'Hallaron's Computer Systems.
-mr silver
By their nature, script-kiddies won't bother reading TFA and writing such an exploit. By their nature, they just download and run them.
By imposing array bound checking at every operation? I know that the check is redundant for a tight linear algebra loop that is obviously bug free, but I think that I'm in a position to mandate that all these people take the penality hit just because I like the idea of imposing my view on people that are smarter than me. Oh yeah and mandate training wheels on all bicycles too.
1 - Choose random windows version.
;-)
2 - Choose random exe or dll that cames with the OS.
3 - Choose a random base address.
4 - Write your code
5 - ???
6 - Profit!
It's like trying to throw a rock to the floor, you just can't miss
WTF am I doing replying to an AC at 5 A.M on a Friday night?
You've Been Zonked!
now back to work...
Get your Unix fortune now!
Read what I consider the seminal hacker work on this subject by Aleph One over at phrack.org
http://www.phrack.org/show.php?p=49&a=14
A little on the detailed side, especially the gdb stuff, but a GREAT article.
"The greatest dangers to liberty lurk in insidious encroachment by men of zeal, well-meaning but without understanding."
This kid is just trying to drum up visitors to his site. The site itself is pretty much devoid of content and the code is taken without citation.
Slashdot: News for ScriptKiddies. Stuff that doesn't matter.
#include
/* this function should never return, in fact it
/* deliberately copy from a larger buffer to a stack segment buffer more than it can hold */
#include <string.h>
char bigBuffer[4096];
void overflowMe();
main()
{
memset(bigBuffer, 0, sizeof(bigBuffer));
overflowMe();
}
should/might SIGSEGV as the return address will be esentially reset to IP=0x00000000 */
void overflowMe()
{
char localBuffer[256];
memcpy(localBuffer, bigBuffer, sizeof(bigBuffer));
}
Why people does care so much about creating buffer overflows. Just write programs in C/C++, you WILL create buffer overflows. It seems that most of programmers can't avoid them and "buffer-overflow vulnerabilities" are found all the time. Why not care instead about the methods created to fix (most of) them? The ones that many distros are still not shipping despite of being quite obvious that they're need more than the latest KDENOME shit?
Just check the debian security mailing list and look how many buffer overflow security bugs are there: Too many. Too many for something which is know to be (partially) fixable with kernel/compiler tricks. Did GCC 4.0 included finally that FORTIFY thing that includes both compile-time and run-time "buffer overflow protections" BTW? That is interesting, not learning how to create buffer overflows.
Yeah. You have a web site that makes it onto Slashdot, and you have a comment system with no size limit on your comments, and comments can be made every 15 seconds per connection. Wow, that's a pretty bad idea.
I am scientifically inaccurate.
It would get the ball rolling at Microsoft to finally patch those holes.
In the land of the blind, the one eyed man is King.
DJ Bernstein Will Tell You Why
Among my favorite advice of his is to completely give up on the standard C library. Really, everybody should have done it a while ago. It's one of those things like the unix pipe model that was a good start, but now that it has hung around for 25 years, it needs an upgrade. How about everybody stop using the standard C library and switch to something like the Apache Portable Runtime?
Write bug-free code. I've mostly given up on the standard C library. Many of its facilities, particularly stdio, seem designed to encourage bugs. A big chunk of qmail is stolen from a basic C library that I've been developing for several years for a variety of applications. The stralloc concept and getln() make it very easy to avoid buffer overruns, memory leaks, and artificial line length limits.
Check out the Java Virtual Machine. It executes arbitrary code.
Free of Flash! Free of Flash!
...but I know for a fact that his server is fighting for it's life right about now! The Slashdot Effect is killing it...
Slashdot's going to show us how to make our very own Hello World program - yay!
#include <stdio.h>
#include <string.h>
int main()
{
struct
{
unsigned char buffer[4];
unsigned char overrun;
} data;
data.overrun = 0xFF;
printf("Initial: %u\n", data.overrun);
memset(&data.buffer[0], 0, 5);
printf("Final: %u\n", data.overrun);
}
5 bytes get pushed onto the stack to reserve memory for the structure data when main is invoked. Memset starts writing to the base address of the structure at data.buffer[0] for 5 bytes. The space allocated for buffer, however is only 4 bytes, which causes the operation to leak into the variable overrun. When the output is displayed, overrun should change from 255 to 0.
from the downtime-of-my-very-own dept.
Adam writes "If you've ever wanted to create your own Slashdot effect or just to see how one works, check out this tutorial. The article talks about how a Slashdotting works and gives a guided example through an exploit to help you on your way. Definitely worth checking out." From the article: "Every now and again we all hear about an exploit that takes place thanks to the Slashdot effect, but what is the Slashdot effect? By definition it is when a website attempts to service more users than it was intended to hold, thus returning an error message from the server. To show how this is actually done, I'll explain how to do a simple attack on a fairly small Slashdot post."
I loaded up this article and what do I see?
This ad from Microsoft staring back at me.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
Boom. Instant buffer overflow. You're a rogue hacker.
I've been hearing about reuse of code and the development of stable shared libraries for the past 20 years and its probably been going on for longer than that. Why don't people, especially OS and application people, create, debug, and reuse a set of overflow-proof buffer-handling libraries? The libraries could include a range of forked versions for different usage patterns (e.g., big buffers of small data objects, small buffers of big data objects, buffers optimized for variable or fixed size, buffers optimized for frequent writes/sorts/reads/etc. Why is that so hard?
Every buffer-overflow exploit is just evidence of re-invention of a bug-filled wheel.
Two wrongs don't make a right, but three lefts do.
Zonk writes "If you've ever wanted to slashdot your own server or just to see how one works, check out this tutorial. The article talks about how the slashdot effect works and gives a guided example through an exploit to help you on your way. Definitely worth checking out." From the article: "Every now and again we all hear about a server disappearing from the face of the earth thanks to the slashdot effect, but what is the slashdot effect? By definition it is when a slashdot editor posts a link on the frontpage to a small server without using coral cache and zillions of slashdotters click on the link the minute the story is published, thus hammering the server into oblivion. To show how this is actually done, I'll explain how to submit a story with a link to your own server by praising Apple, dissing Microsoft or revealing more SCO conspiracies."
Without further ado, here are some corrections:
To compile this code into an object file, type into the shell gcc -O2 -c assembly.s and then dissemble it by typing objdump -d assembly.o > input.txt.
For example, if %ebp equaled bf ff ef d8 it would become d8 ef ff bf. Once this is all done you can test your exploit by saving input.txt and then typing in
I once used a buffer overrun in a ps2 game I was working on to allow me to download a patch when no patching mechanism was in place.
This was very handy for creating some small additions to the game.
Never patched the hole. But then again, the game didn't sell that well.
The /. effect knocked the account out of existence!
"Account Suspended
Your account has been suspended for 1 of 2 reasons.
1. Your bill is over due. In this case please email billing@vizaweb.com
2. You account what causing a problem of some sort. In this case please contact CustomerCare@vizaweb.com"
hmm... Even Slashdotted sites can't spell!
Seems like the server's buffers where overflowed. Oh! the irony!
For the easiest buffer overflow ever, just fireup good ol' Windows 95. That'll give you more buffer overflows than you could shake a stick at.
Open Windows
The submitter's full name is Adam Piquepaille.
Boss design?
Ignorance is curable, stupid is forever.
Well, sort of. Most programmers use make to automate all that stuff.
LOAD "SIG",8,1
This gets published, and my submission on "Court blocks U.S. rules for anti-piracy TV technology" has been pending all day?
Homer no function beer well without.
Isn't that Slashdot policy? I mean, what with Roland and all? If /. history is any indication, get set to hear a lot more from this boy!
"Who are in control, they are not in control of anything - they don't even control themselves!" - Glen Beck
you think you've had something pending for a while, check out the pending story (it's a poll, and I didn't even save my own copy, but maybe I'll see it again SOMEDAY...) in my 'recent submissions' http://hardware.slashdot.org/~antispam_ben/
OOTC: I recall intentional buffer overflows and similar hacks in FORTRAN from 25 years ago. I suppose it's good Pascal was never used for a system language, the language definition has array bounds checking built-in. OTOH, pointers can point to anything (IIRC it's called coercion in Pascal - amazing what stuff I remember that's totally useless now).
Now where's that slashdot mirror site???
Tag lost or not installed.
Now run the program. Its really cool! Ok, here goes! user-b signed off. (Buffer overflow) Hahaha
>
Ok, now run the code
Here goes...
user-b signoff: (Ping Timeout)
Bwahaha, he fell for the old "Buffer Overrun" trick.
>
I guess that's what we should call the /. effect :)
-Palal
but, I blew my mod points on the Al Gore article. ...And I just posted.
Deserves him right for posting a Phrack article from 97 (or somewhere around then, IIRC).
There's a better CDC (that's Cult of the Dead Cow for you young fellows) one out there, I just don't have a link to it.
It was actually a web-based tutorial, not a g-file (that's a text page to you young-un's).
Don't think that a small group of dedicated individuals can't change the world. It's the only thing that ever has.
This one is basic, but it's always good to know how to mess up a program. Great if you can make it, but if you know how to mess it up really badly, it's easier to patch and fix. Of course, most C libs out there in the OSS world have better functions for the most commonly buffer-overflowed functions, but I know there are other ways.
I know they said the best way to learn is through examples, but maybe this guy's approach is a little too rough.
let me try to program a calculator in C++!
(based on a real story)
My new blog
The guy that owns vizaweb is a good personal friend of mine. You can be sure this site will come up next time I see him.
A community-oriented lyrics site
One of the first rules I teach my students:
Never, never ever, call a program test.
I've just seen too many people wondering that their nice new program appears to just do nothing...