Download as PDF, PPTX
Uploaded bysecurityxploded
Buffer Overflow Attacks
The document is an introduction to buffer overflow attacks, emphasizing the risks and legal implications of hacking. It covers technical aspects such as stack smashing, function call arrangements, and includes practical examples and demonstrations without promoting illegal activities. The presentation also acknowledges various security resources and platforms for further learning.
Buffer Overflow Attacks
- 1. Buffer Overflow Attacks A humbleintroduction
- 2. $whoami • Security Enthusiastwith an interest in knowing things inside out.
- 3. DISCLAIMER Without rwx-r-x-r • Breakingsoftware is ILLEGAL • Hacking into networks is ILLEGAL • Launching worms/virus attacks is ILLEGAL • Governed by Indian Law - Information Technology Act, 2000. • Section 65/66/66A…F/67 etc. • This ppt is only for demo purposes and I am in no way responsible for any damage done through this knowledge to self or otherwise.
- 4. What is itabout? • Buffer overflow • Stack smashing
- 5. Don’t Expect • Toolinternals • Tool tutorials • Tool specifications • Social engineering techniques • Exploit/Payload writing
- 6. Live Attack Demo •Real life attacks are actually REAL ! • Vulnerable Unzip Utility • Impact • What do you loose if you are “NAIVE”
- 8. Some useful basics? •ESP, EIP • Return address • EBP • Environment - 32bit Ubuntu 15 - ASLR disabled and gcc - stack smashing protection - disabled.
- 9. Function call andstack arrangement ? • ESP, EIP • Return address • EBP • funcall.c • funCall gdb analysis
- 10. GOAL • Control executionflow • How ? • Control EIP • Where ? • Control it in the stack (for stack smashing) • Why ? • User input makes it’s way to the buffers in the stack • CALL and RET instruction auto-handle what goes in the EIP
- 11. writing exit shellcode • justQuit.c • disassemble justQuit and figure out _exit • exitInAsm.s • objdump exitInAsm to get the shell code
- 12. using the exitshell code • exitShellCode.c • exitShellCode gdb analysis
- 13. attacker-vicim demo • actualshell code - spawning a shell • check in exitShellCode.c • attack crafting concept • default address to anything • gdb analysis - address change and exploit
- 14. The $M ?“Who & Why” • Several flaws in VLC • GHOST in glibc • getaddrinfo in glibc • Several flaws in Apache/IIS/nginx • All of this for FUN and PROFIT.
- 15. HUGE Thanks • SecurityTube • Numerous blogs • StackOverflow • Null.co.in • SecurityXploded • Sans.org • LinuxFoundation.org