How To Conduct Your Very Own Buffer Overflow

Adam writes "If you've ever wanted to create your own buffer overflow or just to see how one works, check out this tutorial. The article talks about how a buffer overflow works and gives a guided example through an exploit to help you on your way. Definitely worth checking out." From the article: "Every now and again we all hear about an exploit that takes place thanks to a buffer overflow, but what is a buffer overflow? By definition it is when a program attempts to store more data in an array (buffer) than it was intended to hold, thus overwriting the return address of the function. To show how this is actually done, I'll explain how to do a simple attack on a fairly small program."

Comments

Once again, Zonk lowers the bar.

[Anonymous Coward]

Zonk posts a story from a submitter that wrote the page being submitted for the story, who, as it turns out, blatantly plagarized the content from Bryant and O'Hallaron's Computer Systems book.

As a matter of fact, on the webpage itself, the very first response to the post calls Adam out about this, but apparently, it is still suffficiently 'news' to merit posting here.

Way to go, Zonk...once again, you've lowered the standard.

Re:Once again, Zonk lowers the bar.

[reynaert]

The standard text is still Smashing The Stack For Fun And Profit, I think.

Re:Once again, Zonk lowers the bar.

[Anonymous Coward]

Mods should have the guts to mod the parent insightful. Speaking up is the only way to prevent our favorite reading forum devolving into a tool for people to drive hits to their websites. I come to /. because I can depend on it doing the filtering for me. If the standards are lowered here, I stop visiting and so will others. For those who say "just don't read it if you don't like it," you're missing the point--the beauty of /. is that we can come here and be assured of a quality read, not a vast dumping ground that we then have to further sift. When abusers like Roland Piqupaille (or whatever his impossible last name is) or this guy (who cribbed it from a book) can make Slashdot do their bidding, we all lose.

News?

[American AC in Paris]

Look, this may be useful information, but it's not even remotely newsworthy. It's a freakin' intro-level homework exercise.

What's next, "How To Conduct Your Very Own Segmentation Fault"?

Hmm

[Dante Shamest]

Is the tutorial correct?

It doesn't seem to wo----

Tutorials?

[Anonymous Coward]

Tutorials are for wimps.

Real men create buffer overflows by accident.

Re:Tutorials?

[chucks86]

I accidentally created a tutorial once...

Buffer Overflows

[joeytsai]

The best article about buffer overflows is the well-known "Smashing the Stack for Fun and Profit" by Aleph One in Phrack. Here's the first link google gave me.

Everything else (like this article) pales in comparison.

Re:Buffer Overflows

[Stalyn]

I'm sorry but the article you mention is not within the blogosphere and therefore meaningless to today's society. Please either contact this "Aleph One" to create a blog and post his/her article there or remove it from your message. Thank You.

No Guide Needed!

[ThisIsFred]

Just teach yourself C! You'll discover every possible way in which things can go wrong, and in no time at all.

Smashing The Stack For Fun And Profit

[bajan_on_ice]

Read what I consider the seminal hacker work on this subject by Aleph One over at phrack.org

http://www.phrack.org/show.php?p=49&a=14

A little on the detailed side, especially the gdb stuff, but a GREAT article.

Here's a sample...

[pg110404]

#include
#include <string.h>

char bigBuffer[4096];

void overflowMe();

main()
{
memset(bigBuffer, 0, sizeof(bigBuffer));
overflowMe();
}

/* this function should never return, in fact it
should/might SIGSEGV as the return address will be esentially reset to IP=0x00000000 */
void overflowMe()
{
char localBuffer[256];

/* deliberately copy from a larger buffer to a stack segment buffer more than it can hold */
memcpy(localBuffer, bigBuffer, sizeof(bigBuffer));
}

Re:Here's a sample...

[pg110404]

There's a security bug in your code.

Yeah, I know. Here's the patch

#include <stdio.h>
main()
{
}