Slashdot Mirror
How To Conduct Your Very Own Buffer Overflow
Adam writes "If you've ever wanted to create your own buffer overflow or just to see how one works, check out this tutorial. The article talks about how a buffer overflow works and gives a guided example through an exploit to help you on your way. Definitely worth checking out." From the article: "Every now and again we all hear about an exploit that takes place thanks to a buffer overflow, but what is a buffer overflow? By definition it is when a program attempts to store more data in an array (buffer) than it was intended to hold, thus overwriting the return address of the function. To show how this is actually done, I'll explain how to do a simple attack on a fairly small program."
Zonk posts a story from a submitter that wrote the page being submitted for the story, who, as it turns out, blatantly plagarized the content from Bryant and O'Hallaron's Computer Systems book.
As a matter of fact, on the webpage itself, the very first response to the post calls Adam out about this, but apparently, it is still suffficiently 'news' to merit posting here.
Way to go, Zonk...once again, you've lowered the standard.
What's next, "How To Conduct Your Very Own Segmentation Fault"?
Obliteracy: Words with explosions
Is the tutorial correct?
It doesn't seem to wo----
Tutorials are for wimps.
Real men create buffer overflows by accident.
Another good reference is the Tao of Windows Buffer Overflow by the Cult of the Dead Cow. A very detailed explanation how to exploit stack overflows on Windows.
Test your net with Netalyzr
This even has great source code and explains the theory quite well.
t .pdf
http://www.gergltd.com/IATAC-BufferOverflowExploi
The best article about buffer overflows is the well-known "Smashing the Stack for Fun and Profit" by Aleph One in Phrack. Here's the first link google gave me.
Everything else (like this article) pales in comparison.
http://www.talknerdy.org
I can overflow buffers quite well on my own without any help.
That is all.
Great article on countering buffer overflows.
Just teach yourself C! You'll discover every possible way in which things can go wrong, and in no time at all.
Fred
"A fool and his freedom are soon parted"
-RMS
Read what I consider the seminal hacker work on this subject by Aleph One over at phrack.org
http://www.phrack.org/show.php?p=49&a=14
A little on the detailed side, especially the gdb stuff, but a GREAT article.
"The greatest dangers to liberty lurk in insidious encroachment by men of zeal, well-meaning but without understanding."
This kid is just trying to drum up visitors to his site. The site itself is pretty much devoid of content and the code is taken without citation.
#include
/* this function should never return, in fact it
/* deliberately copy from a larger buffer to a stack segment buffer more than it can hold */
#include <string.h>
char bigBuffer[4096];
void overflowMe();
main()
{
memset(bigBuffer, 0, sizeof(bigBuffer));
overflowMe();
}
should/might SIGSEGV as the return address will be esentially reset to IP=0x00000000 */
void overflowMe()
{
char localBuffer[256];
memcpy(localBuffer, bigBuffer, sizeof(bigBuffer));
}
The submitter's full name is Adam Piquepaille.