Ch03.4.3-Buffer Overflow Attack

Buffer Overflow Attack
Md. Shadmim Hasan Sifat

Lecturer,CSE,SUST
● From Morris worm in 1988, Code
Red worm in 2001, SQL Slammer in
2003, to Stage-fright attack against
Android phones in 2015,
Why to be concerned
● The buffer overflow attack has played
with Buffer Overflow a significant role in the history of
Attack? computer security.
● It is a classic attack that is still

effective against many of the
computer systems and applications.
Program Memory Layout (address space)
● Text segment : stores executable
program
○ executable
○ Read - only
● Data segment: static/global variables
initialized by programmer
● BSS (block started by symbol)
segment:
○ Stores uninitialized global/static variables
○ So, all the uninitialized variables are
initialized with zeros by OS
● Heap : Provides space for dynamic
memory allocation
● Stack
Program Memory Layout
● Stack
○ Stores arguments data of function call
○ Stores local variables of function
○ Stores return address of the parent
function
○ By default non-executable
Program Memory Layout
Stack and Function Invocation
Buffer Overflow
Other vulnerable functions like gets() which copy user input without checking its length.
Buffer Overflow
Buffer Overflow Attack
● Normal Flow Vs Exploited Flow

Buffer Overflow
Attacking successfully is it guaranteed?
● First, the new address, which is a virtual address, may not be mapped to any physical
address, so the return instruction will fail and the program will crash.
● Second, the address may be mapped to a physical address, but the address space is
protected, such as those used by the operating system kernel; the jump will fail, and the
program will crash.
● Third, the address may be mapped to a physical address, but the data in that address is not
a valid machine instruction (e.g. it may be a data region); the return will again fail and the
program will crash.
● Fourth, the data in the address may happen to be a valid machine instruction, so the program
will continue running, but the logic of the program will be different from the original one.
Buffer Overflow : NOP Sledding
Conducting Buffer Overflow
Attack With Unknown Buffer Size
Goal of Buffer-Overflow Attack
● Our goal is to exploit the buffer
overflow vulnerability in the
vulnerable program stack.c,
○ which runs with the root privilege.
● We need to construct the badfile

such that
○ when the program copies the file
contents into a buffer, the buffer is
overflown,
○ and our injected malicious code can
be executed,
○ allowing us to obtain a root shell.
● Once an attacker has crafted a stack-
based buffer overflow exploit, they
have the ability to execute arbitrary
code on the machine.
Shellcode ● Attackers often choose to execute

code that spawns a terminal or shell,
allowing them to issue further
commands.
● For this reason, the malicious code

included in an exploit is often known
as shellcode.
● Since this code is executed directly on the
stack by the CPU, it must be written in
assembly language, low-level processor
instructions, known as opcodes, that vary
by CPU architecture.
● Writing usable shellcode can be difficult.
Why???
● For example, ordinary assembly code may
Shellcode frequently contain the null character, 0x00.
However, this code cannot be used in
most buffer overflow exploits, because this
character typically denotes the end of a
string, which would prevent an attacker
from successfully copying his payload into
a vulnerable buffer.
● Hence, shellcode attackers employ tricks
to avoid null characters.
Constructing *badfile*
Steps:
● Fill the content with NOPs
● Put the shellcode at the end
● Put the address at an offset
● Write the content to a file
Solution/Measures to avoid the attack
The safer strncpy() function should be used, instead of strcpy()
● With Vulnerability ● Without Vulnerability

● Incorporates a canary, a
value that is placed between
a buffer and control data
(which plays a similar role to a
canary in a coal mine).
● The system regularly checks
the integrity of this canary
value, and
● if it has been changed, it
knows that the buffer has
been overflowed and it should
prevent malicious code
execution.
● Prevent running code on the stack by enforcing a no-execution permission

on the stack segment of memory. If the attacker’s shellcode were not able to
run, then exploiting an application would be difficult.
● Finally, many operating systems now feature address space layout

randomization (ASLR), which rearranges the data of a process’s address
space at random, making it extremely difficult to predict where to jump in
order to execute code.
○ If you want to turn it off, then do like this

Ch03.4.3-Buffer Overflow Attack

Uploaded by

Copyright:

Available Formats

Ch03.4.3-Buffer Overflow Attack

Uploaded by

Document Information

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Ch03.4.3-Buffer Overflow Attack

Uploaded by

Copyright:

Available Formats

Buffer Overflow Attack

Md. Shadmim Hasan Sifat

● It is a classic attack that is still

● Normal Flow Vs Exploited Flow

● We need to construct the badfile

Shellcode ● Attackers often choose to execute

● For this reason, the malicious code

● With Vulnerability ● Without Vulnerability

● Prevent running code on the stack by enforcing a no-execution permission

● Finally, many operating systems now feature address space layout

You might also like