This chapter discusses stack overflows in Linux. It explains buffers, the stack, functions and how the stack is used. It shows how a stack buffer overflow can be exploited by overwriting the return address on the stack to redirect program flow. The document demonstrates this by having a program read user input into a buffer without bounds checking, allowing input longer than the buffer to overwrite the return address and cause a crash. gdb is used to debug the program and examine the stack.
1 of 44
Download to read offline
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
More Related Content
127 Ch 2: Stack overflows on Linux
1. CNIT 127: Exploit Development
Ch 2: Stack Overflows in Linux
Updated 2-1-22
2. Topics
• Buffers in C
• Information Disclosure
• gdb: Gnu Debugger
• Segmentation Fault
• The Stack
• Functions and the Stack
• Stack Buffer Overflow
3. Stack-Based Buffer Overflows
• Most popular and best understood
exploitation method
• Aleph One's "Smashing the Stack for Fun
and Profit" (1996)
– Link Ch 2a
• Buffer
– A limited, contiguously allocated set of
memory
– In C, usually an array
4. Preparing a Debian Machine
• Tools needed to compile in 32-bit and debug
sudo apt updat
e
sudo apt install build-essential gcc-multilib gdb -y
6. C and C++ Lack Bounds-Checking
• It is the programmer's responsibility to ensure
that array indices remain in the valid range
#include <stdio.h>
int main()
{
int array[5] = {1, 2, 3, 4, 5};
printf("%dn", array[5]);
}
7. Reading Past End of Array
• We can read data that we shouldn't be seeing
• Information disclosure vulnerabilty
8. Using gdb (GNU Debugger)
• Source code debugging
• Because we compiled with gcc -g
9. Using gdb (GNU Debugger)
• gdb commands
list
show source code
run
execute program
break
insert breakpoint
x
examine memory
18. LIFO (Last-In, First-Out)
• ESP (Extended Stack Pointer) register
points to the top of the stack
• PUSH puts items on the stack
– push 1
– push addr var
20. EBP (Extended Base Pointer)
• EBP is typically used for calculated
addresses on the stack
– mov eax, [ebp+10h]
• Copies the data 16 bytes down the stack
into the EAX register
22. Purpose
• The stack's primary purpose is to make the
use of functions more efficient
• When a function is called, these things occur:
– Calling routine stops processing its instructions
– Saves its current state
– Transfers control to the function
– Function processes its instructions
– Function exits
– State of the calling function is restored
– Calling routine's execution resumes
24. Functions and the Stack
• Primary purpose of the stack
– To make functions more efficient
• When a function is called
– Push function's arguments onto the stack
– Call function, which pushes the return address
RET onto the stack, which is the EIP at the
time the function is called
25. Functions and the Stack
– Before function starts, a prolog executes,
pushing EBP onto the stack
– It then copies ESP into EBP
– Calculates size of local variables
– Reserves that space on the stack, by
subtracting the size from ESP
– Pushes local variables onto stack
26. Functions and the Stack
#include <stdio.h>
void function(int a, int b)
{
int array[5];
}
main()
{
function(1,2);
printf("This is where the
return address pointsn");
}
31. Examine the Stack Frame
• Highlighted region is the stack frame of
function()
• The next word is the return pointer
32. Disassemble Main
• To call a function:
• push arguments onto the stack
• call the function
33. Disassemble Function
• Prolog:
• push ebp onto stack
• mov esp into ebp, starting a new stack frame
• sub from esp, reserving room for local variables
34. Saved Return Address
• Next word
after stack
frame
• Address of
next
instruction to
be executed
in main()
43. gdb Commands
list
show source code
run
execute program
break
insert breakpoint
x
examine memory
disassemble
show asssembly code
continue
resume execution
info registers
see registers
info proc mapping
see memory map