Slashdot Mirror
How To Conduct Your Very Own Buffer Overflow
Adam writes "If you've ever wanted to create your own buffer overflow or just to see how one works, check out this tutorial. The article talks about how a buffer overflow works and gives a guided example through an exploit to help you on your way. Definitely worth checking out." From the article: "Every now and again we all hear about an exploit that takes place thanks to a buffer overflow, but what is a buffer overflow? By definition it is when a program attempts to store more data in an array (buffer) than it was intended to hold, thus overwriting the return address of the function. To show how this is actually done, I'll explain how to do a simple attack on a fairly small program."
Zonk posts a story from a submitter that wrote the page being submitted for the story, who, as it turns out, blatantly plagarized the content from Bryant and O'Hallaron's Computer Systems book.
As a matter of fact, on the webpage itself, the very first response to the post calls Adam out about this, but apparently, it is still suffficiently 'news' to merit posting here.
Way to go, Zonk...once again, you've lowered the standard.
What's next, "How To Conduct Your Very Own Segmentation Fault"?
Obliteracy: Words with explosions
Is the tutorial correct?
It doesn't seem to wo----
Tutorials are for wimps.
Real men create buffer overflows by accident.
Another good reference is the Tao of Windows Buffer Overflow by the Cult of the Dead Cow. A very detailed explanation how to exploit stack overflows on Windows.
Test your net with Netalyzr
This even has great source code and explains the theory quite well.
t .pdf
http://www.gergltd.com/IATAC-BufferOverflowExploi
The best article about buffer overflows is the well-known "Smashing the Stack for Fun and Profit" by Aleph One in Phrack. Here's the first link google gave me.
Everything else (like this article) pales in comparison.
http://www.talknerdy.org
I can overflow buffers quite well on my own without any help.
That is all.
Great article on countering buffer overflows.
Just teach yourself C! You'll discover every possible way in which things can go wrong, and in no time at all.
Fred
"A fool and his freedom are soon parted"
-RMS
the author of the article states: "-o tells gcc to compile the file"
but fortunately he didnt write the example, its taken from Bryant and O'Hallaron's Computer Systems.
-mr silver
By their nature, script-kiddies won't bother reading TFA and writing such an exploit. By their nature, they just download and run them.
1 - Choose random windows version.
;-)
2 - Choose random exe or dll that cames with the OS.
3 - Choose a random base address.
4 - Write your code
5 - ???
6 - Profit!
It's like trying to throw a rock to the floor, you just can't miss
WTF am I doing replying to an AC at 5 A.M on a Friday night?
Read what I consider the seminal hacker work on this subject by Aleph One over at phrack.org
http://www.phrack.org/show.php?p=49&a=14
A little on the detailed side, especially the gdb stuff, but a GREAT article.
"The greatest dangers to liberty lurk in insidious encroachment by men of zeal, well-meaning but without understanding."
This kid is just trying to drum up visitors to his site. The site itself is pretty much devoid of content and the code is taken without citation.
#include
/* this function should never return, in fact it
/* deliberately copy from a larger buffer to a stack segment buffer more than it can hold */
#include <string.h>
char bigBuffer[4096];
void overflowMe();
main()
{
memset(bigBuffer, 0, sizeof(bigBuffer));
overflowMe();
}
should/might SIGSEGV as the return address will be esentially reset to IP=0x00000000 */
void overflowMe()
{
char localBuffer[256];
memcpy(localBuffer, bigBuffer, sizeof(bigBuffer));
}
Yeah. You have a web site that makes it onto Slashdot, and you have a comment system with no size limit on your comments, and comments can be made every 15 seconds per connection. Wow, that's a pretty bad idea.
I am scientifically inaccurate.
DJ Bernstein Will Tell You Why
Among my favorite advice of his is to completely give up on the standard C library. Really, everybody should have done it a while ago. It's one of those things like the unix pipe model that was a good start, but now that it has hung around for 25 years, it needs an upgrade. How about everybody stop using the standard C library and switch to something like the Apache Portable Runtime?
Write bug-free code. I've mostly given up on the standard C library. Many of its facilities, particularly stdio, seem designed to encourage bugs. A big chunk of qmail is stolen from a basic C library that I've been developing for several years for a variety of applications. The stralloc concept and getln() make it very easy to avoid buffer overruns, memory leaks, and artificial line length limits.
#include <stdio.h>
#include <string.h>
int main()
{
struct
{
unsigned char buffer[4];
unsigned char overrun;
} data;
data.overrun = 0xFF;
printf("Initial: %u\n", data.overrun);
memset(&data.buffer[0], 0, 5);
printf("Final: %u\n", data.overrun);
}
5 bytes get pushed onto the stack to reserve memory for the structure data when main is invoked. Memset starts writing to the base address of the structure at data.buffer[0] for 5 bytes. The space allocated for buffer, however is only 4 bytes, which causes the operation to leak into the variable overrun. When the output is displayed, overrun should change from 255 to 0.
from the downtime-of-my-very-own dept.
Adam writes "If you've ever wanted to create your own Slashdot effect or just to see how one works, check out this tutorial. The article talks about how a Slashdotting works and gives a guided example through an exploit to help you on your way. Definitely worth checking out." From the article: "Every now and again we all hear about an exploit that takes place thanks to the Slashdot effect, but what is the Slashdot effect? By definition it is when a website attempts to service more users than it was intended to hold, thus returning an error message from the server. To show how this is actually done, I'll explain how to do a simple attack on a fairly small Slashdot post."
I loaded up this article and what do I see?
This ad from Microsoft staring back at me.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
I've been hearing about reuse of code and the development of stable shared libraries for the past 20 years and its probably been going on for longer than that. Why don't people, especially OS and application people, create, debug, and reuse a set of overflow-proof buffer-handling libraries? The libraries could include a range of forked versions for different usage patterns (e.g., big buffers of small data objects, small buffers of big data objects, buffers optimized for variable or fixed size, buffers optimized for frequent writes/sorts/reads/etc. Why is that so hard?
Every buffer-overflow exploit is just evidence of re-invention of a bug-filled wheel.
Two wrongs don't make a right, but three lefts do.
Zonk writes "If you've ever wanted to slashdot your own server or just to see how one works, check out this tutorial. The article talks about how the slashdot effect works and gives a guided example through an exploit to help you on your way. Definitely worth checking out." From the article: "Every now and again we all hear about a server disappearing from the face of the earth thanks to the slashdot effect, but what is the slashdot effect? By definition it is when a slashdot editor posts a link on the frontpage to a small server without using coral cache and zillions of slashdotters click on the link the minute the story is published, thus hammering the server into oblivion. To show how this is actually done, I'll explain how to submit a story with a link to your own server by praising Apple, dissing Microsoft or revealing more SCO conspiracies."
The /. effect knocked the account out of existence!
"Account Suspended
Your account has been suspended for 1 of 2 reasons.
1. Your bill is over due. In this case please email billing@vizaweb.com
2. You account what causing a problem of some sort. In this case please contact CustomerCare@vizaweb.com"
hmm... Even Slashdotted sites can't spell!
The submitter's full name is Adam Piquepaille.