Location via proxy:   [ UP ]  
[Report a bug]   [Manage cookies]                
SlideShare a Scribd company logo

Buffer Overflow - Smashing the Stack

•
•
ironSource
ironSource

ironSource's security application expert, Tomer Zait, shares his insights on engineering in the stack. Tomer, an Ort Singalovsky alumnus himself, gave this presentation to the Ort Singalovsky students on their tour of ironSource's headquarters in Tel Aviv. Want to learn more about ironSource? Visit our website: www.ironsrc.com Follow us on Twitter @ironSource ironSource is looking for new talent! Check out our openings: http://bit.ly/Work-at-ironSource

Related slideshows

Buffer Overflow Demo by Saurabh Sharma
Buffer Overflow Demo by Saurabh SharmaBuffer Overflow Demo by Saurabh Sharma
Buffer Overflow Demo by Saurabh Sharma
 
Buffer overflow attacks
Buffer overflow attacksBuffer overflow attacks
Buffer overflow attacks
 
Offensive cyber security: Smashing the stack with Python
Offensive cyber security: Smashing the stack with PythonOffensive cyber security: Smashing the stack with Python
Offensive cyber security: Smashing the stack with Python
 
1 of 33
BUFFER OVERFLOW – SMASHING THE STACK Tomer Zait - Application Security Engineer
∙ Application Security Engineer at ironSource ∙ Practical Software Engineer (Ort Singalovsky) ∙ Offensive Security Certified Professional (OSCP) ∙ OpenSource Projects: ∘ PyMultitor ∘ HackMe Credit ∘ AutoBrowser ∘ SubDomain Analyzer ∘ Proxist ∙ 1st Place at The Israeli Cyber Challenge, 2014 TOMER ZAIT root@kali:~# whoami
TODAY WE WILL FOCUS ON: ∙ Past Events ∙ What Is Stack ∙ Assembly - Registers ∙ Stack Overflow ∙ Shell Code ∙ Exploit Development
PAST EVENTS
BLASTER WORM ∙ Exploits a buffer overflow vulnerability in Microsoft DCOM RPC interface. ∙ Worm downloads a copy of mblast.exe to compromised host from infecting host via TFTP and runs commands to execute it. ∙ mblast.exe attempts to carry out SYN flood attack on windows update.com as well as scanning/infecting other hosts. Hex dump of the Blaster worm
BLASTER WORM - EFFECTS ∙ DOS attack on windowsupdate.com failed - the regular domain name is windowsupdate.microsoft.com. ∙ Windowsupdate.com was just a pointer to the windowsupdate.microsoft.com - so Microsoft just decommissioned it.
BLASTER WORM - TIMELINE ∙ August 11, 2003: Original version of the worm appears on the internet. ∙ August 12, 2003: The number of infected systems is reported at 30,000. ∙ August 15, 2003: The number of infected systems is reported at 423,000. ∙ August 16, 2003: DDoS attack against windowsupdate.com starts. (Largely unsuccessful because that url is merely a redirect to the real site, windowsupdate.microsoft.com). ∙ January 28, 2005: The creator of the "B" variant of MSBlaster is sentenced to 18 months in jail.
CONFICKER WORM ∙ Exploits a buffer overflow vulnerability in Microsoft NET BIOS interface (MS08-067). ∙ Dictionary attack on ADMIN$ shares. ∙ Creates DLL-based AutoRun trojan on attached removable drives. ∙ Downloads daily from any of 250 pseudo-random domains over 5 TLDs (Top-level domains). ∙ Updates self to Conficker B, C or D
CONFICKER WORM - EFFECTS ∙ Account lockout policies being reset automatically. ∙ Certain Microsoft Windows services such as Automatic Updates, Background Intelligent Transfer Service (BITS), Windows Defender and Windows Error Reporting disabled. ∙ Domain controllers responding slowly to client requests. ∙ Congestion on local area networks (ARP flood as consequence of network scan). ∙ Web sites related to antivirus software or the Windows Update service becoming inaccessible.
CONFICKER WORM - TIMELINE ∙ Discovered in early November 2008. ∙ The French Navy computer network, was infected with Conficker on 15 January 2009. ∙ An infection of Manchester City Council's IT system caused an estimated £1.5m worth of disruption in February 2009. ∙ The estimated number of infected computers ranged from almost 9 million to 15 million. ∙ Microsoft has reported the total number of infected computers detected by its antimalware products has remained steady at around 1.7 million from mid-2010 to mid-2011.
WHAT IS STACK
STACK - EXPLANATION It's a region of your computer's memory that stores temporary variables created by each function (including the main() function), The stackspecial is a “LIFO” (last in , first out) data structure. Principal operations: ∙ push adds an element to the collection. ∙ pop removes the last element that was added. Stack Real Life example is weapon's magazine Push Pop
ASSEMBLY – REGISTERS
On today’s average WinTel CPU you have 9 32bit registers (w/o flag registers). Their names are: EAX: Extended Accumulator Register EBX: Extended Base Register ECX: Extended Counter Register EDX: Extended Data Register ESI: Extended Source Index EDI: Extended Destination Index EBP: Extended Base Pointer ESP: Extended Stack Pointer EIP: Extended Instruction Pointer CPU REGISTERS
The ESP register serves as an indirect memory operand pointing to the top of the stack at any time. WORD takes 2 bytes In memory. ∙ When a word value is pushed onto the stack, the assembler decreases the ESP (Stack Pointer) register by 2. ∙ When a word value is popped off the stack, the assembler increases the ESP register by 2. ESP REGISTER
The instruction pointer register points to the memory address which the processor will next attempt to execute. it cannot be directly accessed in 16-bit or 32-bit mode, but a sequence like the following can be written to put the address of next_line into eax: call next_line next_line: pop eax This sequence of instructions generates position-independent code because call takes an instruction-pointer-relative immediate operand describing the offset in bytes of the target instruction from the next instruction (in this case 0). EIP REGISTER
STACK OVERFLOW
STACK - EXPLANATION A stack overflow is an undesirable condition in which a particular computer program tries to use more memory space than the call stack has available. In programming, the call stack is a buffer that stores requests that need to be handled. The size of a call stack depends on various factors. It is usually defined at the start of a program. Its size can depend on the architecture of the computer on which the program runs, the language in which the program is written, and the total amount of available memory in the system. When a stack overflow occurs as a result of a program's excessive demand for memory space, that program (and sometimes the entire computer) may crash.
SHELL CODE
SHELLCODE - WINDOWS XP PRO SP2 32BIT (1) # Metasploit generated – write.exe – x86 – Windows XP Pro SP2 shellcode="x68x97x4Cx80x7CxB8x4Dx11x86x7CxFFxD0”; Let’s disassemble these bytes into instructions : C:shellcode>"c:program filesnasmndisasm.exe" -b 32 c:tmpshellcode.bin 00000000 68974C807C push dword 0x7c804c97 00000005 B84D11867C mov eax,0x7c86114d 0000000A FFD0 call eax You don’t need to run this code to figure out what it will do.
SHELLCODE - WINDOWS XP PRO SP2 32BIT (2) If the exploit is indeed written for Windows XP Pro SP2 then this will happen: at 0x7c804c97 on XP SP2, we find (windbg output): 0:001> d 0x7c804c97 7c804c97 57 72 69 74 65 00 42 61-73 65 43 68 65 63 6b 41 Write.BaseCheckA 7c804ca7 70 70 63 6f 6d 70 61 74-43 61 63 68 65 00 42 61 ppcompatCache.Ba 7c804cb7 73 65 43 6c 65 61 6e 75-70 41 70 70 63 6f 6d 70 seCleanupAppcomp 7c804cc7 61 74 43 61 63 68 65 00-42 61 73 65 43 6c 65 61 atCache.BaseClea 7c804cd7 6e 75 70 41 70 70 63 6f-6d 70 61 74 43 61 63 68 nupAppcompatCach 7c804ce7 65 53 75 70 70 6f 72 74-00 42 61 73 65 44 75 6d eSupport.BaseDum 7c804cf7 70 41 70 70 63 6f 6d 70-61 74 43 61 63 68 65 00 pAppcompatCache. 7c804d07 42 61 73 65 46 6c 75 73-68 41 70 70 63 6f 6d 70 BaseFlushAppcomp So push dword 0x7c804c97 will push “Write” onto the stack.
SHELLCODE - WINDOWS XP PRO SP2 32BIT (3) Next, 0x7c86114d is moved into eax and a call eax is made. At 0x7c86114d, we find: 0:001> ln 0x7c86114d (7c86114d) kernel32!WinExec | (7c86123c) kernel32!`string' Exact matches: kernel32!WinExec = Conclusion : this code will execute “write” (=wordpad).
SHELLCODE TEST - WINDOWS XP PRO SP2 32BIT char code[] = "x68x97x4Cx80x7CxB8x4Dx11x86x7CxFFxD0"; int main(int argc, char **argv) { int (*func)(); func = (int (*)()) code; (int)(*func)(); }
EXPLOIT DEVELOPMENT
VULNERABLE CODE - EXAMPLE #include <string.h> void foo (char *bar) { char c[12]; strcpy(c, bar); // no bounds checking } int main (int argc, char **argv) { foo(argv[1]); }
Buffer Overflow - Smashing the Stack
VULNERABLE CODE - EXPLOSION This code takes an argument from the command line and copies it to a local stack variable c. This works fine for command line arguments smaller than 12 characters (as you can see in figure B below). Any arguments larger than 11 characters long will result in corruption of the stack. (The maximum number of characters that is safe is one less than the size of the buffer here because in the C programming language strings are terminated by a zero byte character. A twelve-character input thus requires thirteen bytes to store, the input followed by the sentinel zero byte. The zero byte then ends up overwriting a memory location that's one byte beyond the end of the buffer ).
A. - Before data is copied. THE PROGRAM STACK IN foo() WITH VARIOUS INPUTS (1)
B. - "hello" is the first command line argument. THE PROGRAM STACK IN foo() WITH VARIOUS INPUTS (2)
A. - Before data is copied. THE PROGRAM STACK IN foo() WITH VARIOUS INPUTS (3)
VULNERABLE CODE - SUMMARY Notice in figure C above, when an argument larger than 11 bytes is supplied on the command line foo() overwrites local stack data, the saved frame pointer, and most importantly, the return address. When foo() returns it pops the return address off the stack and jumps to that address (i.e. starts executing instructions from that address). Thus, the attacker has overwritten the return address with a pointer to the stack buffer char c[12], which now contains attacker-supplied data. In an actual stack buffer overflow exploit the string of "A"'s would instead be shellcode suitable to the platform and desired function. If this program had special privileges (e.g. the SUID bit set to run as the superuser), then the attacker could use this vulnerability to gain superuser privileges on the affected machine.
THANK YOU
BIBLIOGRAPHY 1. Wikipedia - http://www.wikipedia.org/ 2. Corelan Team - https://www.corelan.be/ 3. Natashenka - http://natashenka.ca/

More Related Content

What's hot

Buffer Overflow Demo by Saurabh Sharma
Buffer Overflow Demo by Saurabh SharmaBuffer Overflow Demo by Saurabh Sharma
Buffer Overflow Demo by Saurabh Sharma
n|u - The Open Security Community
 
Buffer overflow attacks
Buffer overflow attacksBuffer overflow attacks
Buffer overflow attacks
Japneet Singh
 
Offensive cyber security: Smashing the stack with Python
Offensive cyber security: Smashing the stack with PythonOffensive cyber security: Smashing the stack with Python
Offensive cyber security: Smashing the stack with Python
Malachi Jones
 
Indicators of compromise: From malware analysis to eradication
Indicators of compromise: From malware analysis to eradicationIndicators of compromise: From malware analysis to eradication
Indicators of compromise: From malware analysis to eradication
Michael Boman
 
Embedded device hacking Session i
Embedded device hacking Session iEmbedded device hacking Session i
Embedded device hacking Session i
Malachi Jones
 
.NET for hackers
.NET for hackers.NET for hackers
.NET for hackers
Antonio Parata
 
Ceh v8 labs module 10 denial of service
Ceh v8 labs module 10 denial of serviceCeh v8 labs module 10 denial of service
Ceh v8 labs module 10 denial of service
Asep Sopyan
 
Ceh v8 labs module 05 system hacking
Ceh v8 labs module 05 system hackingCeh v8 labs module 05 system hacking
Ceh v8 labs module 05 system hacking
Asep Sopyan
 
How security broken? - Android internals and malware infection possibilities
How security broken? - Android internals and malware infection possibilitiesHow security broken? - Android internals and malware infection possibilities
How security broken? - Android internals and malware infection possibilities
FFRI, Inc.
 
Exploitation techniques and fuzzing
Exploitation techniques and fuzzingExploitation techniques and fuzzing
Exploitation techniques and fuzzing
G Prachi
 
Ceh v8 labs module 05 system hacking
Ceh v8 labs module 05 system hackingCeh v8 labs module 05 system hacking
Ceh v8 labs module 05 system hacking
Mehrdad Jingoism
 
Ceh v8 labs module 11 session hijacking
Ceh v8 labs module 11 session hijackingCeh v8 labs module 11 session hijacking
Ceh v8 labs module 11 session hijacking
Asep Sopyan
 
Secure Coding Practices for Middleware
Secure Coding Practices for MiddlewareSecure Coding Practices for Middleware
Secure Coding Practices for Middleware
Manuel Brugnoli
 
Ceh v8 labs module 03 scanning networks
Ceh v8 labs module 03 scanning networksCeh v8 labs module 03 scanning networks
Ceh v8 labs module 03 scanning networks
Asep Sopyan
 
How to find_vulnerability_in_software
How to find_vulnerability_in_softwareHow to find_vulnerability_in_software
How to find_vulnerability_in_software
sanghwan ahn
 
Ceh v8 labs module 04 enumeration
Ceh v8 labs module 04 enumerationCeh v8 labs module 04 enumeration
Ceh v8 labs module 04 enumeration
Asep Sopyan
 
Hunting Rootkit From the Dark Corners Of Memory
Hunting Rootkit From the Dark Corners Of MemoryHunting Rootkit From the Dark Corners Of Memory
Hunting Rootkit From the Dark Corners Of Memory
securityxploded
 
Shusei tomonaga pac_sec_20171026
Shusei tomonaga pac_sec_20171026Shusei tomonaga pac_sec_20171026
Shusei tomonaga pac_sec_20171026
PacSecJP
 
The Future of Automated Malware Generation
The Future of Automated Malware GenerationThe Future of Automated Malware Generation
The Future of Automated Malware Generation
Stephan Chenette
 
Reversing and Decrypting the Communications of APT Malware (Etumbot)
Reversing and Decrypting the Communications of APT Malware (Etumbot)Reversing and Decrypting the Communications of APT Malware (Etumbot)
Reversing and Decrypting the Communications of APT Malware (Etumbot)
securityxploded
 

What's hot (20)

Buffer Overflow Demo by Saurabh Sharma
Buffer Overflow Demo by Saurabh SharmaBuffer Overflow Demo by Saurabh Sharma
Buffer Overflow Demo by Saurabh Sharma
 
Buffer overflow attacks
Buffer overflow attacksBuffer overflow attacks
Buffer overflow attacks
 
Offensive cyber security: Smashing the stack with Python
Offensive cyber security: Smashing the stack with PythonOffensive cyber security: Smashing the stack with Python
Offensive cyber security: Smashing the stack with Python
 
Indicators of compromise: From malware analysis to eradication
Indicators of compromise: From malware analysis to eradicationIndicators of compromise: From malware analysis to eradication
Indicators of compromise: From malware analysis to eradication
 
Embedded device hacking Session i
Embedded device hacking Session iEmbedded device hacking Session i
Embedded device hacking Session i
 
.NET for hackers
.NET for hackers.NET for hackers
.NET for hackers
 
Ceh v8 labs module 10 denial of service
Ceh v8 labs module 10 denial of serviceCeh v8 labs module 10 denial of service
Ceh v8 labs module 10 denial of service
 
Ceh v8 labs module 05 system hacking
Ceh v8 labs module 05 system hackingCeh v8 labs module 05 system hacking
Ceh v8 labs module 05 system hacking
 
How security broken? - Android internals and malware infection possibilities
How security broken? - Android internals and malware infection possibilitiesHow security broken? - Android internals and malware infection possibilities
How security broken? - Android internals and malware infection possibilities
 
Exploitation techniques and fuzzing
Exploitation techniques and fuzzingExploitation techniques and fuzzing
Exploitation techniques and fuzzing
 
Ceh v8 labs module 05 system hacking
Ceh v8 labs module 05 system hackingCeh v8 labs module 05 system hacking
Ceh v8 labs module 05 system hacking
 
Ceh v8 labs module 11 session hijacking
Ceh v8 labs module 11 session hijackingCeh v8 labs module 11 session hijacking
Ceh v8 labs module 11 session hijacking
 
Secure Coding Practices for Middleware
Secure Coding Practices for MiddlewareSecure Coding Practices for Middleware
Secure Coding Practices for Middleware
 
Ceh v8 labs module 03 scanning networks
Ceh v8 labs module 03 scanning networksCeh v8 labs module 03 scanning networks
Ceh v8 labs module 03 scanning networks
 
How to find_vulnerability_in_software
How to find_vulnerability_in_softwareHow to find_vulnerability_in_software
How to find_vulnerability_in_software
 
Ceh v8 labs module 04 enumeration
Ceh v8 labs module 04 enumerationCeh v8 labs module 04 enumeration
Ceh v8 labs module 04 enumeration
 
Hunting Rootkit From the Dark Corners Of Memory
Hunting Rootkit From the Dark Corners Of MemoryHunting Rootkit From the Dark Corners Of Memory
Hunting Rootkit From the Dark Corners Of Memory
 
Shusei tomonaga pac_sec_20171026
Shusei tomonaga pac_sec_20171026Shusei tomonaga pac_sec_20171026
Shusei tomonaga pac_sec_20171026
 
The Future of Automated Malware Generation
The Future of Automated Malware GenerationThe Future of Automated Malware Generation
The Future of Automated Malware Generation
 
Reversing and Decrypting the Communications of APT Malware (Etumbot)
Reversing and Decrypting the Communications of APT Malware (Etumbot)Reversing and Decrypting the Communications of APT Malware (Etumbot)
Reversing and Decrypting the Communications of APT Malware (Etumbot)
 

Similar to Buffer Overflow - Smashing the Stack

Buffer overflow – Smashing The Stack
Buffer overflow – Smashing The StackBuffer overflow – Smashing The Stack
Buffer overflow – Smashing The Stack
Tomer Zait
 
Shellcoding in linux
Shellcoding in linuxShellcoding in linux
Shellcoding in linux
Ajin Abraham
 
Dive into exploit development
Dive into exploit developmentDive into exploit development
Dive into exploit development
Payampardaz
 
Writing Metasploit Plugins
Writing Metasploit PluginsWriting Metasploit Plugins
Writing Metasploit Plugins
amiable_indian
 
Post Exploitation Bliss: Loading Meterpreter on a Factory iPhone, Black Hat U...
Post Exploitation Bliss: Loading Meterpreter on a Factory iPhone, Black Hat U...Post Exploitation Bliss: Loading Meterpreter on a Factory iPhone, Black Hat U...
Post Exploitation Bliss: Loading Meterpreter on a Factory iPhone, Black Hat U...
Vincenzo Iozzo
 
PVS-Studio, a solution for resource intensive applications development
PVS-Studio, a solution for resource intensive applications developmentPVS-Studio, a solution for resource intensive applications development
PVS-Studio, a solution for resource intensive applications development
OOO "Program Verification Systems"
 
Blast off!
Blast off!Blast off!
Blast off!
UltraUploader
 
You're Off the Hook: Blinding Security Software
You're Off the Hook: Blinding Security SoftwareYou're Off the Hook: Blinding Security Software
You're Off the Hook: Blinding Security Software
Cylance
 
Code Red Security
Code Red SecurityCode Red Security
Code Red Security
Amr Ali
 
Low Level Exploits
Low Level ExploitsLow Level Exploits
Low Level Exploits
hughpearse
 
[2007 CodeEngn Conference 01] dual5651 - Windows 커널단의 후킹
[2007 CodeEngn Conference 01] dual5651 - Windows 커널단의 후킹[2007 CodeEngn Conference 01] dual5651 - Windows 커널단의 후킹
[2007 CodeEngn Conference 01] dual5651 - Windows 커널단의 후킹
GangSeok Lee
 
Track c-High speed transaction-based hw-sw coverification -eve
Track c-High speed transaction-based hw-sw coverification -eveTrack c-High speed transaction-based hw-sw coverification -eve
Track c-High speed transaction-based hw-sw coverification -eve
chiportal
 
Shellcode Disassembling - Reverse Engineering
Shellcode Disassembling - Reverse EngineeringShellcode Disassembling - Reverse Engineering
Shellcode Disassembling - Reverse Engineering
Sumutiu Marius
 
Web (dis)assembly
Web (dis)assemblyWeb (dis)assembly
Web (dis)assembly
Shakacon
 
Penetrating Windows 8 with syringe utility
Penetrating Windows 8 with syringe utilityPenetrating Windows 8 with syringe utility
Penetrating Windows 8 with syringe utility
IOSR Journals
 
Stuxnet dc9723
Stuxnet dc9723Stuxnet dc9723
Stuxnet dc9723
Iftach Ian Amit
 
Chapter 1SyllabusCatalog Description Computer structu
Chapter 1SyllabusCatalog Description Computer structuChapter 1SyllabusCatalog Description Computer structu
Chapter 1SyllabusCatalog Description Computer structu
EstelaJeffery653
 
Smash the Stack: Writing a Buffer Overflow Exploit (Win32)
Smash the Stack: Writing a Buffer Overflow Exploit (Win32)Smash the Stack: Writing a Buffer Overflow Exploit (Win32)
Smash the Stack: Writing a Buffer Overflow Exploit (Win32)
Elvin Gentiles
 
Software Security
Software SecuritySoftware Security
Software Security
Roman Oliynykov
 
Swug July 2010 - windows debugging by sainath
Swug July 2010 - windows debugging by sainathSwug July 2010 - windows debugging by sainath
Swug July 2010 - windows debugging by sainath
Dennis Chung
 

Similar to Buffer Overflow - Smashing the Stack (20)

Buffer overflow – Smashing The Stack
Buffer overflow – Smashing The StackBuffer overflow – Smashing The Stack
Buffer overflow – Smashing The Stack
 
Shellcoding in linux
Shellcoding in linuxShellcoding in linux
Shellcoding in linux
 
Dive into exploit development
Dive into exploit developmentDive into exploit development
Dive into exploit development
 
Writing Metasploit Plugins
Writing Metasploit PluginsWriting Metasploit Plugins
Writing Metasploit Plugins
 
Post Exploitation Bliss: Loading Meterpreter on a Factory iPhone, Black Hat U...
Post Exploitation Bliss: Loading Meterpreter on a Factory iPhone, Black Hat U...Post Exploitation Bliss: Loading Meterpreter on a Factory iPhone, Black Hat U...
Post Exploitation Bliss: Loading Meterpreter on a Factory iPhone, Black Hat U...
 
PVS-Studio, a solution for resource intensive applications development
PVS-Studio, a solution for resource intensive applications developmentPVS-Studio, a solution for resource intensive applications development
PVS-Studio, a solution for resource intensive applications development
 
Blast off!
Blast off!Blast off!
Blast off!
 
You're Off the Hook: Blinding Security Software
You're Off the Hook: Blinding Security SoftwareYou're Off the Hook: Blinding Security Software
You're Off the Hook: Blinding Security Software
 
Code Red Security
Code Red SecurityCode Red Security
Code Red Security
 
Low Level Exploits
Low Level ExploitsLow Level Exploits
Low Level Exploits
 
[2007 CodeEngn Conference 01] dual5651 - Windows 커널단의 후킹
[2007 CodeEngn Conference 01] dual5651 - Windows 커널단의 후킹[2007 CodeEngn Conference 01] dual5651 - Windows 커널단의 후킹
[2007 CodeEngn Conference 01] dual5651 - Windows 커널단의 후킹
 
Track c-High speed transaction-based hw-sw coverification -eve
Track c-High speed transaction-based hw-sw coverification -eveTrack c-High speed transaction-based hw-sw coverification -eve
Track c-High speed transaction-based hw-sw coverification -eve
 
Shellcode Disassembling - Reverse Engineering
Shellcode Disassembling - Reverse EngineeringShellcode Disassembling - Reverse Engineering
Shellcode Disassembling - Reverse Engineering
 
Web (dis)assembly
Web (dis)assemblyWeb (dis)assembly
Web (dis)assembly
 
Penetrating Windows 8 with syringe utility
Penetrating Windows 8 with syringe utilityPenetrating Windows 8 with syringe utility
Penetrating Windows 8 with syringe utility
 
Stuxnet dc9723
Stuxnet dc9723Stuxnet dc9723
Stuxnet dc9723
 
Chapter 1SyllabusCatalog Description Computer structu
Chapter 1SyllabusCatalog Description Computer structuChapter 1SyllabusCatalog Description Computer structu
Chapter 1SyllabusCatalog Description Computer structu
 
Smash the Stack: Writing a Buffer Overflow Exploit (Win32)
Smash the Stack: Writing a Buffer Overflow Exploit (Win32)Smash the Stack: Writing a Buffer Overflow Exploit (Win32)
Smash the Stack: Writing a Buffer Overflow Exploit (Win32)
 
Software Security
Software SecuritySoftware Security
Software Security
 
Swug July 2010 - windows debugging by sainath
Swug July 2010 - windows debugging by sainathSwug July 2010 - windows debugging by sainath
Swug July 2010 - windows debugging by sainath
 

More from ironSource

ironSource A/Bテストツール利用ガイド
ironSource A/Bテストツール利用ガイドironSource A/Bテストツール利用ガイド
ironSource A/Bテストツール利用ガイド
ironSource
 
The Developer Tour - Ho Chi Minh City
The Developer Tour - Ho Chi Minh City The Developer Tour - Ho Chi Minh City
The Developer Tour - Ho Chi Minh City
ironSource
 
The Developer Tour - Hanoi
The Developer Tour - HanoiThe Developer Tour - Hanoi
The Developer Tour - Hanoi
ironSource
 
Nadav Ashkenazy - Casual Connect Europe 2018
Nadav Ashkenazy - Casual Connect Europe 2018Nadav Ashkenazy - Casual Connect Europe 2018
Nadav Ashkenazy - Casual Connect Europe 2018
ironSource
 
Who is playing your game?
Who is playing your game?Who is playing your game?
Who is playing your game?
ironSource
 
3*3 Developer Tour
3*3 Developer Tour3*3 Developer Tour
3*3 Developer Tour
ironSource
 
Aura for advertisers
Aura for advertisersAura for advertisers
Aura for advertisers
ironSource
 
Developer Series 6x6 Tour: UA Strategy and Case Studies
Developer Series 6x6 Tour: UA Strategy and Case StudiesDeveloper Series 6x6 Tour: UA Strategy and Case Studies
Developer Series 6x6 Tour: UA Strategy and Case Studies
ironSource
 
Developer Series 6x6 Tour: User Acquisition and ROI Strategy
Developer Series 6x6 Tour: User Acquisition and ROI StrategyDeveloper Series 6x6 Tour: User Acquisition and ROI Strategy
Developer Series 6x6 Tour: User Acquisition and ROI Strategy
ironSource
 
Developer Series 6x6 Tour: The power of interactive ads
Developer Series 6x6 Tour: The power of interactive adsDeveloper Series 6x6 Tour: The power of interactive ads
Developer Series 6x6 Tour: The power of interactive ads
ironSource
 
Enhancing user experience with rewarded ad monetization
Enhancing user experience with rewarded ad monetizationEnhancing user experience with rewarded ad monetization
Enhancing user experience with rewarded ad monetization
ironSource
 
ironSource Developer Series: UA (Korean)
ironSource Developer Series: UA (Korean)ironSource Developer Series: UA (Korean)
ironSource Developer Series: UA (Korean)
ironSource
 
How To Monetize Your Game By Ads, Globally (Chinese)
How To Monetize Your Game By Ads, Globally (Chinese)How To Monetize Your Game By Ads, Globally (Chinese)
How To Monetize Your Game By Ads, Globally (Chinese)
ironSource
 
The Complete Guide to Fighting Mobile Ad Fraud
The Complete Guide to Fighting Mobile Ad FraudThe Complete Guide to Fighting Mobile Ad Fraud
The Complete Guide to Fighting Mobile Ad Fraud
ironSource
 
A Snapshot of UA Trends
A Snapshot of UA TrendsA Snapshot of UA Trends
A Snapshot of UA Trends
ironSource
 
Rewarded Video: Benefits and Best Practices
Rewarded Video: Benefits and Best PracticesRewarded Video: Benefits and Best Practices
Rewarded Video: Benefits and Best Practices
ironSource
 
How To Maximise ROI With Creative Optimization
How To Maximise ROI With Creative OptimizationHow To Maximise ROI With Creative Optimization
How To Maximise ROI With Creative Optimization
ironSource
 
Developer State: Challenges facing app developers
Developer State: Challenges facing app developersDeveloper State: Challenges facing app developers
Developer State: Challenges facing app developers
ironSource
 
How is Asia Changing the Mobile Landscape? | Omer Kaplan, ironSource CMO | Ca...
How is Asia Changing the Mobile Landscape? | Omer Kaplan, ironSource CMO | Ca...How is Asia Changing the Mobile Landscape? | Omer Kaplan, ironSource CMO | Ca...
How is Asia Changing the Mobile Landscape? | Omer Kaplan, ironSource CMO | Ca...
ironSource
 
11 Creative Tips for Effective CPE Campaigns - ironSource | Casual Connect Te...
11 Creative Tips for Effective CPE Campaigns - ironSource | Casual Connect Te...11 Creative Tips for Effective CPE Campaigns - ironSource | Casual Connect Te...
11 Creative Tips for Effective CPE Campaigns - ironSource | Casual Connect Te...
ironSource
 

More from ironSource (20)

ironSource A/Bテストツール利用ガイド
ironSource A/Bテストツール利用ガイドironSource A/Bテストツール利用ガイド
ironSource A/Bテストツール利用ガイド
 
The Developer Tour - Ho Chi Minh City
The Developer Tour - Ho Chi Minh City The Developer Tour - Ho Chi Minh City
The Developer Tour - Ho Chi Minh City
 
The Developer Tour - Hanoi
The Developer Tour - HanoiThe Developer Tour - Hanoi
The Developer Tour - Hanoi
 
Nadav Ashkenazy - Casual Connect Europe 2018
Nadav Ashkenazy - Casual Connect Europe 2018Nadav Ashkenazy - Casual Connect Europe 2018
Nadav Ashkenazy - Casual Connect Europe 2018
 
Who is playing your game?
Who is playing your game?Who is playing your game?
Who is playing your game?
 
3*3 Developer Tour
3*3 Developer Tour3*3 Developer Tour
3*3 Developer Tour
 
Aura for advertisers
Aura for advertisersAura for advertisers
Aura for advertisers
 
Developer Series 6x6 Tour: UA Strategy and Case Studies
Developer Series 6x6 Tour: UA Strategy and Case StudiesDeveloper Series 6x6 Tour: UA Strategy and Case Studies
Developer Series 6x6 Tour: UA Strategy and Case Studies
 
Developer Series 6x6 Tour: User Acquisition and ROI Strategy
Developer Series 6x6 Tour: User Acquisition and ROI StrategyDeveloper Series 6x6 Tour: User Acquisition and ROI Strategy
Developer Series 6x6 Tour: User Acquisition and ROI Strategy
 
Developer Series 6x6 Tour: The power of interactive ads
Developer Series 6x6 Tour: The power of interactive adsDeveloper Series 6x6 Tour: The power of interactive ads
Developer Series 6x6 Tour: The power of interactive ads
 
Enhancing user experience with rewarded ad monetization
Enhancing user experience with rewarded ad monetizationEnhancing user experience with rewarded ad monetization
Enhancing user experience with rewarded ad monetization
 
ironSource Developer Series: UA (Korean)
ironSource Developer Series: UA (Korean)ironSource Developer Series: UA (Korean)
ironSource Developer Series: UA (Korean)
 
How To Monetize Your Game By Ads, Globally (Chinese)
How To Monetize Your Game By Ads, Globally (Chinese)How To Monetize Your Game By Ads, Globally (Chinese)
How To Monetize Your Game By Ads, Globally (Chinese)
 
The Complete Guide to Fighting Mobile Ad Fraud
The Complete Guide to Fighting Mobile Ad FraudThe Complete Guide to Fighting Mobile Ad Fraud
The Complete Guide to Fighting Mobile Ad Fraud
 
A Snapshot of UA Trends
A Snapshot of UA TrendsA Snapshot of UA Trends
A Snapshot of UA Trends
 
Rewarded Video: Benefits and Best Practices
Rewarded Video: Benefits and Best PracticesRewarded Video: Benefits and Best Practices
Rewarded Video: Benefits and Best Practices
 
How To Maximise ROI With Creative Optimization
How To Maximise ROI With Creative OptimizationHow To Maximise ROI With Creative Optimization
How To Maximise ROI With Creative Optimization
 
Developer State: Challenges facing app developers
Developer State: Challenges facing app developersDeveloper State: Challenges facing app developers
Developer State: Challenges facing app developers
 
How is Asia Changing the Mobile Landscape? | Omer Kaplan, ironSource CMO | Ca...
How is Asia Changing the Mobile Landscape? | Omer Kaplan, ironSource CMO | Ca...How is Asia Changing the Mobile Landscape? | Omer Kaplan, ironSource CMO | Ca...
How is Asia Changing the Mobile Landscape? | Omer Kaplan, ironSource CMO | Ca...
 
11 Creative Tips for Effective CPE Campaigns - ironSource | Casual Connect Te...
11 Creative Tips for Effective CPE Campaigns - ironSource | Casual Connect Te...11 Creative Tips for Effective CPE Campaigns - ironSource | Casual Connect Te...
11 Creative Tips for Effective CPE Campaigns - ironSource | Casual Connect Te...
 

Recently uploaded

Gurugram Meetup Salesforce integration patterns - 20 July 2024.pptx
Gurugram Meetup Salesforce integration patterns - 20 July 2024.pptxGurugram Meetup Salesforce integration patterns - 20 July 2024.pptx
Gurugram Meetup Salesforce integration patterns - 20 July 2024.pptx
Gupta Pryank
 
How to Choose the Right Partner for Outsource Website Development
How to Choose the Right Partner for Outsource Website DevelopmentHow to Choose the Right Partner for Outsource Website Development
How to Choose the Right Partner for Outsource Website Development
Rollout IT
 
SOCRadar-2024-Mid-Year-Cybersecurity-Report.pdf
SOCRadar-2024-Mid-Year-Cybersecurity-Report.pdfSOCRadar-2024-Mid-Year-Cybersecurity-Report.pdf
SOCRadar-2024-Mid-Year-Cybersecurity-Report.pdf
SOCRadar
 
Learning Rust with Advent of Code 2023 - Princeton
Learning Rust with Advent of Code 2023 - PrincetonLearning Rust with Advent of Code 2023 - Princeton
Learning Rust with Advent of Code 2023 - Princeton
Henry Schreiner
 
Asset Management software Technologies.pdf
Asset Management software Technologies.pdfAsset Management software Technologies.pdf
Asset Management software Technologies.pdf
Hr365.us smith
 
Viswanath_Cover letter_Scrum Master_10+yrs
Viswanath_Cover letter_Scrum Master_10+yrsViswanath_Cover letter_Scrum Master_10+yrs
Viswanath_Cover letter_Scrum Master_10+yrs
cviswanathsai
 
CrushFTP 10.4.0.29 PC Software - WhizNews
CrushFTP 10.4.0.29 PC Software - WhizNewsCrushFTP 10.4.0.29 PC Software - WhizNews
CrushFTP 10.4.0.29 PC Software - WhizNews
Eman Nisar
 
Healthcare software development made easy_ A step-by-step guide.pdf
Healthcare software development made easy_ A step-by-step guide.pdfHealthcare software development made easy_ A step-by-step guide.pdf
Healthcare software development made easy_ A step-by-step guide.pdf
mohitd6
 
Software Development Company in Florida.pdf
Software Development Company in Florida.pdfSoftware Development Company in Florida.pdf
Software Development Company in Florida.pdf
Getweys
 
WordPress Getting Started: WordPress block themes
WordPress Getting Started: WordPress block themesWordPress Getting Started: WordPress block themes
WordPress Getting Started: WordPress block themes
Kyra Pieterse
 
My Bully Is My Lover Apk CH1 EP4 (Gallery Unlock, MOD)
My Bully Is My Lover Apk CH1 EP4 (Gallery Unlock, MOD)My Bully Is My Lover Apk CH1 EP4 (Gallery Unlock, MOD)
My Bully Is My Lover Apk CH1 EP4 (Gallery Unlock, MOD)
Apk2me
 
Guide to Improving QA Testing with Gen AI.pdf
Guide to Improving QA Testing with Gen AI.pdfGuide to Improving QA Testing with Gen AI.pdf
Guide to Improving QA Testing with Gen AI.pdf
kalichargn70th171
 
FINAL_ ARECANUT_CNN_PPT PHASE 2_of.pptx
FINAL_ ARECANUT_CNN_PPT PHASE 2_of.pptxFINAL_ ARECANUT_CNN_PPT PHASE 2_of.pptx
FINAL_ ARECANUT_CNN_PPT PHASE 2_of.pptx
PramodaS10
 
Cal Girls Fort Chandragupt Jaipur 8445551418 Khusi Top Class Girls Call Jaipu...
Cal Girls Fort Chandragupt Jaipur 8445551418 Khusi Top Class Girls Call Jaipu...Cal Girls Fort Chandragupt Jaipur 8445551418 Khusi Top Class Girls Call Jaipu...
Cal Girls Fort Chandragupt Jaipur 8445551418 Khusi Top Class Girls Call Jaipu...
Trisha Kumari
 
call bomber software for call centers.pdf
call bomber software for call centers.pdfcall bomber software for call centers.pdf
call bomber software for call centers.pdf
Asfera Technologies
 
Mastering MicroStation DGN: How to Integrate CAD and GIS
Mastering MicroStation DGN: How to Integrate CAD and GISMastering MicroStation DGN: How to Integrate CAD and GIS
Mastering MicroStation DGN: How to Integrate CAD and GIS
Safe Software
 
4. The Build System _ Embedded Android.pdf
4. The Build System _ Embedded Android.pdf4. The Build System _ Embedded Android.pdf
4. The Build System _ Embedded Android.pdf
VishalKumarJha10
 
A House In The Rift 0.7.10 b1 (Gallery Unlock, MOD)
A House In The Rift 0.7.10 b1 (Gallery Unlock, MOD)A House In The Rift 0.7.10 b1 (Gallery Unlock, MOD)
A House In The Rift 0.7.10 b1 (Gallery Unlock, MOD)
Apk2me
 
How Odoo Accounting Can Save Your Business, Time and Money.pdf
How Odoo Accounting Can Save Your Business, Time and Money.pdfHow Odoo Accounting Can Save Your Business, Time and Money.pdf
How Odoo Accounting Can Save Your Business, Time and Money.pdf
Banibro IT Solutions
 
How and Why Developers Migrate Python Tests (SANER 2022)
How and Why Developers Migrate Python Tests (SANER 2022)How and Why Developers Migrate Python Tests (SANER 2022)
How and Why Developers Migrate Python Tests (SANER 2022)
Andre Hora
 

Recently uploaded (20)

Gurugram Meetup Salesforce integration patterns - 20 July 2024.pptx
Gurugram Meetup Salesforce integration patterns - 20 July 2024.pptxGurugram Meetup Salesforce integration patterns - 20 July 2024.pptx
Gurugram Meetup Salesforce integration patterns - 20 July 2024.pptx
 
How to Choose the Right Partner for Outsource Website Development
How to Choose the Right Partner for Outsource Website DevelopmentHow to Choose the Right Partner for Outsource Website Development
How to Choose the Right Partner for Outsource Website Development
 
SOCRadar-2024-Mid-Year-Cybersecurity-Report.pdf
SOCRadar-2024-Mid-Year-Cybersecurity-Report.pdfSOCRadar-2024-Mid-Year-Cybersecurity-Report.pdf
SOCRadar-2024-Mid-Year-Cybersecurity-Report.pdf
 
Learning Rust with Advent of Code 2023 - Princeton
Learning Rust with Advent of Code 2023 - PrincetonLearning Rust with Advent of Code 2023 - Princeton
Learning Rust with Advent of Code 2023 - Princeton
 
Asset Management software Technologies.pdf
Asset Management software Technologies.pdfAsset Management software Technologies.pdf
Asset Management software Technologies.pdf
 
Viswanath_Cover letter_Scrum Master_10+yrs
Viswanath_Cover letter_Scrum Master_10+yrsViswanath_Cover letter_Scrum Master_10+yrs
Viswanath_Cover letter_Scrum Master_10+yrs
 
CrushFTP 10.4.0.29 PC Software - WhizNews
CrushFTP 10.4.0.29 PC Software - WhizNewsCrushFTP 10.4.0.29 PC Software - WhizNews
CrushFTP 10.4.0.29 PC Software - WhizNews
 
Healthcare software development made easy_ A step-by-step guide.pdf
Healthcare software development made easy_ A step-by-step guide.pdfHealthcare software development made easy_ A step-by-step guide.pdf
Healthcare software development made easy_ A step-by-step guide.pdf
 
Software Development Company in Florida.pdf
Software Development Company in Florida.pdfSoftware Development Company in Florida.pdf
Software Development Company in Florida.pdf
 
WordPress Getting Started: WordPress block themes
WordPress Getting Started: WordPress block themesWordPress Getting Started: WordPress block themes
WordPress Getting Started: WordPress block themes
 
My Bully Is My Lover Apk CH1 EP4 (Gallery Unlock, MOD)
My Bully Is My Lover Apk CH1 EP4 (Gallery Unlock, MOD)My Bully Is My Lover Apk CH1 EP4 (Gallery Unlock, MOD)
My Bully Is My Lover Apk CH1 EP4 (Gallery Unlock, MOD)
 
Guide to Improving QA Testing with Gen AI.pdf
Guide to Improving QA Testing with Gen AI.pdfGuide to Improving QA Testing with Gen AI.pdf
Guide to Improving QA Testing with Gen AI.pdf
 
FINAL_ ARECANUT_CNN_PPT PHASE 2_of.pptx
FINAL_ ARECANUT_CNN_PPT PHASE 2_of.pptxFINAL_ ARECANUT_CNN_PPT PHASE 2_of.pptx
FINAL_ ARECANUT_CNN_PPT PHASE 2_of.pptx
 
Cal Girls Fort Chandragupt Jaipur 8445551418 Khusi Top Class Girls Call Jaipu...
Cal Girls Fort Chandragupt Jaipur 8445551418 Khusi Top Class Girls Call Jaipu...Cal Girls Fort Chandragupt Jaipur 8445551418 Khusi Top Class Girls Call Jaipu...
Cal Girls Fort Chandragupt Jaipur 8445551418 Khusi Top Class Girls Call Jaipu...
 
call bomber software for call centers.pdf
call bomber software for call centers.pdfcall bomber software for call centers.pdf
call bomber software for call centers.pdf
 
Mastering MicroStation DGN: How to Integrate CAD and GIS
Mastering MicroStation DGN: How to Integrate CAD and GISMastering MicroStation DGN: How to Integrate CAD and GIS
Mastering MicroStation DGN: How to Integrate CAD and GIS
 
4. The Build System _ Embedded Android.pdf
4. The Build System _ Embedded Android.pdf4. The Build System _ Embedded Android.pdf
4. The Build System _ Embedded Android.pdf
 
A House In The Rift 0.7.10 b1 (Gallery Unlock, MOD)
A House In The Rift 0.7.10 b1 (Gallery Unlock, MOD)A House In The Rift 0.7.10 b1 (Gallery Unlock, MOD)
A House In The Rift 0.7.10 b1 (Gallery Unlock, MOD)
 
How Odoo Accounting Can Save Your Business, Time and Money.pdf
How Odoo Accounting Can Save Your Business, Time and Money.pdfHow Odoo Accounting Can Save Your Business, Time and Money.pdf
How Odoo Accounting Can Save Your Business, Time and Money.pdf
 
How and Why Developers Migrate Python Tests (SANER 2022)
How and Why Developers Migrate Python Tests (SANER 2022)How and Why Developers Migrate Python Tests (SANER 2022)
How and Why Developers Migrate Python Tests (SANER 2022)
 

Buffer Overflow - Smashing the Stack

  • 1. BUFFER OVERFLOW – SMASHING THE STACK Tomer Zait - Application Security Engineer
  • 2. ∙ Application Security Engineer at ironSource ∙ Practical Software Engineer (Ort Singalovsky) ∙ Offensive Security Certified Professional (OSCP) ∙ OpenSource Projects: ∘ PyMultitor ∘ HackMe Credit ∘ AutoBrowser ∘ SubDomain Analyzer ∘ Proxist ∙ 1st Place at The Israeli Cyber Challenge, 2014 TOMER ZAIT root@kali:~# whoami
  • 3. TODAY WE WILL FOCUS ON: ∙ Past Events ∙ What Is Stack ∙ Assembly - Registers ∙ Stack Overflow ∙ Shell Code ∙ Exploit Development
  • 5. BLASTER WORM ∙ Exploits a buffer overflow vulnerability in Microsoft DCOM RPC interface. ∙ Worm downloads a copy of mblast.exe to compromised host from infecting host via TFTP and runs commands to execute it. ∙ mblast.exe attempts to carry out SYN flood attack on windows update.com as well as scanning/infecting other hosts. Hex dump of the Blaster worm
  • 6. BLASTER WORM - EFFECTS ∙ DOS attack on windowsupdate.com failed - the regular domain name is windowsupdate.microsoft.com. ∙ Windowsupdate.com was just a pointer to the windowsupdate.microsoft.com - so Microsoft just decommissioned it.
  • 7. BLASTER WORM - TIMELINE ∙ August 11, 2003: Original version of the worm appears on the internet. ∙ August 12, 2003: The number of infected systems is reported at 30,000. ∙ August 15, 2003: The number of infected systems is reported at 423,000. ∙ August 16, 2003: DDoS attack against windowsupdate.com starts. (Largely unsuccessful because that url is merely a redirect to the real site, windowsupdate.microsoft.com). ∙ January 28, 2005: The creator of the "B" variant of MSBlaster is sentenced to 18 months in jail.
  • 8. CONFICKER WORM ∙ Exploits a buffer overflow vulnerability in Microsoft NET BIOS interface (MS08-067). ∙ Dictionary attack on ADMIN$ shares. ∙ Creates DLL-based AutoRun trojan on attached removable drives. ∙ Downloads daily from any of 250 pseudo-random domains over 5 TLDs (Top-level domains). ∙ Updates self to Conficker B, C or D
  • 9. CONFICKER WORM - EFFECTS ∙ Account lockout policies being reset automatically. ∙ Certain Microsoft Windows services such as Automatic Updates, Background Intelligent Transfer Service (BITS), Windows Defender and Windows Error Reporting disabled. ∙ Domain controllers responding slowly to client requests. ∙ Congestion on local area networks (ARP flood as consequence of network scan). ∙ Web sites related to antivirus software or the Windows Update service becoming inaccessible.
  • 10. CONFICKER WORM - TIMELINE ∙ Discovered in early November 2008. ∙ The French Navy computer network, was infected with Conficker on 15 January 2009. ∙ An infection of Manchester City Council's IT system caused an estimated £1.5m worth of disruption in February 2009. ∙ The estimated number of infected computers ranged from almost 9 million to 15 million. ∙ Microsoft has reported the total number of infected computers detected by its antimalware products has remained steady at around 1.7 million from mid-2010 to mid-2011.
  • 12. STACK - EXPLANATION It's a region of your computer's memory that stores temporary variables created by each function (including the main() function), The stackspecial is a “LIFO” (last in , first out) data structure. Principal operations: ∙ push adds an element to the collection. ∙ pop removes the last element that was added. Stack Real Life example is weapon's magazine Push Pop
  • 14. On today’s average WinTel CPU you have 9 32bit registers (w/o flag registers). Their names are: EAX: Extended Accumulator Register EBX: Extended Base Register ECX: Extended Counter Register EDX: Extended Data Register ESI: Extended Source Index EDI: Extended Destination Index EBP: Extended Base Pointer ESP: Extended Stack Pointer EIP: Extended Instruction Pointer CPU REGISTERS
  • 15. The ESP register serves as an indirect memory operand pointing to the top of the stack at any time. WORD takes 2 bytes In memory. ∙ When a word value is pushed onto the stack, the assembler decreases the ESP (Stack Pointer) register by 2. ∙ When a word value is popped off the stack, the assembler increases the ESP register by 2. ESP REGISTER
  • 16. The instruction pointer register points to the memory address which the processor will next attempt to execute. it cannot be directly accessed in 16-bit or 32-bit mode, but a sequence like the following can be written to put the address of next_line into eax: call next_line next_line: pop eax This sequence of instructions generates position-independent code because call takes an instruction-pointer-relative immediate operand describing the offset in bytes of the target instruction from the next instruction (in this case 0). EIP REGISTER
  • 18. STACK - EXPLANATION A stack overflow is an undesirable condition in which a particular computer program tries to use more memory space than the call stack has available. In programming, the call stack is a buffer that stores requests that need to be handled. The size of a call stack depends on various factors. It is usually defined at the start of a program. Its size can depend on the architecture of the computer on which the program runs, the language in which the program is written, and the total amount of available memory in the system. When a stack overflow occurs as a result of a program's excessive demand for memory space, that program (and sometimes the entire computer) may crash.
  • 20. SHELLCODE - WINDOWS XP PRO SP2 32BIT (1) # Metasploit generated – write.exe – x86 – Windows XP Pro SP2 shellcode="x68x97x4Cx80x7CxB8x4Dx11x86x7CxFFxD0”; Let’s disassemble these bytes into instructions : C:shellcode>"c:program filesnasmndisasm.exe" -b 32 c:tmpshellcode.bin 00000000 68974C807C push dword 0x7c804c97 00000005 B84D11867C mov eax,0x7c86114d 0000000A FFD0 call eax You don’t need to run this code to figure out what it will do.
  • 21. SHELLCODE - WINDOWS XP PRO SP2 32BIT (2) If the exploit is indeed written for Windows XP Pro SP2 then this will happen: at 0x7c804c97 on XP SP2, we find (windbg output): 0:001> d 0x7c804c97 7c804c97 57 72 69 74 65 00 42 61-73 65 43 68 65 63 6b 41 Write.BaseCheckA 7c804ca7 70 70 63 6f 6d 70 61 74-43 61 63 68 65 00 42 61 ppcompatCache.Ba 7c804cb7 73 65 43 6c 65 61 6e 75-70 41 70 70 63 6f 6d 70 seCleanupAppcomp 7c804cc7 61 74 43 61 63 68 65 00-42 61 73 65 43 6c 65 61 atCache.BaseClea 7c804cd7 6e 75 70 41 70 70 63 6f-6d 70 61 74 43 61 63 68 nupAppcompatCach 7c804ce7 65 53 75 70 70 6f 72 74-00 42 61 73 65 44 75 6d eSupport.BaseDum 7c804cf7 70 41 70 70 63 6f 6d 70-61 74 43 61 63 68 65 00 pAppcompatCache. 7c804d07 42 61 73 65 46 6c 75 73-68 41 70 70 63 6f 6d 70 BaseFlushAppcomp So push dword 0x7c804c97 will push “Write” onto the stack.
  • 22. SHELLCODE - WINDOWS XP PRO SP2 32BIT (3) Next, 0x7c86114d is moved into eax and a call eax is made. At 0x7c86114d, we find: 0:001> ln 0x7c86114d (7c86114d) kernel32!WinExec | (7c86123c) kernel32!`string' Exact matches: kernel32!WinExec = Conclusion : this code will execute “write” (=wordpad).
  • 23. SHELLCODE TEST - WINDOWS XP PRO SP2 32BIT char code[] = "x68x97x4Cx80x7CxB8x4Dx11x86x7CxFFxD0"; int main(int argc, char **argv) { int (*func)(); func = (int (*)()) code; (int)(*func)(); }
  • 25. VULNERABLE CODE - EXAMPLE #include <string.h> void foo (char *bar) { char c[12]; strcpy(c, bar); // no bounds checking } int main (int argc, char **argv) { foo(argv[1]); }
  • 27. VULNERABLE CODE - EXPLOSION This code takes an argument from the command line and copies it to a local stack variable c. This works fine for command line arguments smaller than 12 characters (as you can see in figure B below). Any arguments larger than 11 characters long will result in corruption of the stack. (The maximum number of characters that is safe is one less than the size of the buffer here because in the C programming language strings are terminated by a zero byte character. A twelve-character input thus requires thirteen bytes to store, the input followed by the sentinel zero byte. The zero byte then ends up overwriting a memory location that's one byte beyond the end of the buffer ).
  • 28. A. - Before data is copied. THE PROGRAM STACK IN foo() WITH VARIOUS INPUTS (1)
  • 29. B. - "hello" is the first command line argument. THE PROGRAM STACK IN foo() WITH VARIOUS INPUTS (2)
  • 30. A. - Before data is copied. THE PROGRAM STACK IN foo() WITH VARIOUS INPUTS (3)
  • 31. VULNERABLE CODE - SUMMARY Notice in figure C above, when an argument larger than 11 bytes is supplied on the command line foo() overwrites local stack data, the saved frame pointer, and most importantly, the return address. When foo() returns it pops the return address off the stack and jumps to that address (i.e. starts executing instructions from that address). Thus, the attacker has overwritten the return address with a pointer to the stack buffer char c[12], which now contains attacker-supplied data. In an actual stack buffer overflow exploit the string of "A"'s would instead be shellcode suitable to the platform and desired function. If this program had special privileges (e.g. the SUID bit set to run as the superuser), then the attacker could use this vulnerability to gain superuser privileges on the affected machine.
  • 33. BIBLIOGRAPHY 1. Wikipedia - http://www.wikipedia.org/ 2. Corelan Team - https://www.corelan.be/ 3. Natashenka - http://natashenka.ca/