RE: Buffer overflow on a vulnerable C program. 07-21-2013, 04:14 PM
#7
Let me add something to your explaination.
Once you found an unsecure function like C get() function and you identified a buffer overflow vulnerability (specifically stack buffer overflow), the main goal is to redirect the program's execution to a memory area in which you shellcode will be executed.
In my opinion the way you find out eip and esp values should be clarified a little bit. Assuming that the way stack works and stack allocation is well understood, when your input overflows the allocated buffer, the EIP register value will be overwritten. The goal here is to find which memory address we can overwrite EIP with (EIP = extended instruction pointer, so changing its value with a proper one will determine the execution of our code). In order to identify the bytes that overwrite EIP a debugger should be used and same reasoning for ESP. When creating a buffer overflow usually it is enough to overwrite the EIP with ESP value. The mothod you proposed in your tutorial is likely to be working only once as you are assigning an absolute memory address which will obviously change upon reboot or in other machines.
Once, using a debugger, you identified which bytes should overwrite the EIP. To overwrite EIP memory address an obvious solution should be to make it JUMP (shove an ASM command) to the ESP so that EIP will be given ESP address, this however can't be done as EIP holds memory addresses and not command.
When crafting a buffer overflow you have to find a general way to overwrite the EIP (as i explained before, assigning absolute address to EIP will work once as the registry values and memory allocation will change from machine to machine). The solution is to overwrite the EIP with the address of a dll. Why? Because dll are statically placed in memory it means that (eg in windows systems) they will be always allocated in the same memory address. More over, dll's first instruction is JMP ESP which will redirect the flow to the ESP that is where our shellcode will be placed. I hope i explained well, if there's something not clear just ask.
EDIT: works on windows until SP3 included (not with Vista and further)
Once you found an unsecure function like C get() function and you identified a buffer overflow vulnerability (specifically stack buffer overflow), the main goal is to redirect the program's execution to a memory area in which you shellcode will be executed.
In my opinion the way you find out eip and esp values should be clarified a little bit. Assuming that the way stack works and stack allocation is well understood, when your input overflows the allocated buffer, the EIP register value will be overwritten. The goal here is to find which memory address we can overwrite EIP with (EIP = extended instruction pointer, so changing its value with a proper one will determine the execution of our code). In order to identify the bytes that overwrite EIP a debugger should be used and same reasoning for ESP. When creating a buffer overflow usually it is enough to overwrite the EIP with ESP value. The mothod you proposed in your tutorial is likely to be working only once as you are assigning an absolute memory address which will obviously change upon reboot or in other machines.
Once, using a debugger, you identified which bytes should overwrite the EIP. To overwrite EIP memory address an obvious solution should be to make it JUMP (shove an ASM command) to the ESP so that EIP will be given ESP address, this however can't be done as EIP holds memory addresses and not command.
When crafting a buffer overflow you have to find a general way to overwrite the EIP (as i explained before, assigning absolute address to EIP will work once as the registry values and memory allocation will change from machine to machine). The solution is to overwrite the EIP with the address of a dll. Why? Because dll are statically placed in memory it means that (eg in windows systems) they will be always allocated in the same memory address. More over, dll's first instruction is JMP ESP which will redirect the flow to the ESP that is where our shellcode will be placed. I hope i explained well, if there's something not clear just ask.
EDIT: works on windows until SP3 included (not with Vista and further)
Everything is relative
![[+]](https://sinister.ly/images/modern/collapse_collapsed.png)
