CNIT 127: Ch 2: Stack Overflows in Linux
0 likes301 views
The document discusses stack buffer overflows in Linux. It explains how functions use the stack, with arguments and return addresses pushed onto the stack. A stack buffer overflow occurs when a program writes past the end of a fixed-length buffer on the stack. This can overwrite the return address, allowing arbitrary code execution. The document demonstrates this by having a program read user input into a buffer without bounds checking. Entering more data than the buffer size crashes the program by overwriting the return address. This vulnerability can be exploited to gain control of a program's execution flow.
![C and C++ Lack Bounds-Checking
• It is the programmer's responsibility to ensure
that array indices remain in the valid range
#include <stdio.h>
int main()
{
int array[5] = {1, 2, 3, 4, 5};
printf("%dn", array[5]);
}](https://image.slidesharecdn.com/127-ch2-210209002525/85/CNIT-127-Ch-2-Stack-Overflows-in-Linux-6-320.jpg)
![EBP (Extended Base Pointer)
• EBP is typically used for calculated
addresses on the stack
– mov eax, [ebp+10h]
• Copies the data 16 bytes down the stack
into the EAX register](https://image.slidesharecdn.com/127-ch2-210209002525/85/CNIT-127-Ch-2-Stack-Overflows-in-Linux-19-320.jpg)
![Functions and the Stack
#include <stdio.h>
void function(int a, int b)
{
int array[5];
}
main()
{
function(1,2);
printf("This is where the
return address pointsn");
}](https://image.slidesharecdn.com/127-ch2-210209002525/85/CNIT-127-Ch-2-Stack-Overflows-in-Linux-25-320.jpg)
CNIT 127: Ch 2: Stack Overflows in Linux
- 1. CNIT 127: Exploit Development Ch 2: Stack Overflows in Linux Updated 2-8-21
- 2. Topics • Buffers in C • Information Disclosure • gdb: Gnu Debugger • Segmentation Fault • The Stack • Functions and the Stack • Stack Buffer Overflow
- 3. Stack-Based Buffer Overflows • Most popular and best understood exploitation method • Aleph One's "Smashing the Stack for Fun and Profit" (1996) – Link Ch 2a • Buffer – A limited, contiguously allocated set of memory – In C, usually an array
- 4. Preparing a Debian Machine • Tools needed to compile in 32-bit and debug sudo apt updat e sudo apt install build-essential gcc- multilib gdb -y
- 5. Exploit A: Information Disclosure
- 6. C and C++ Lack Bounds-Checking • It is the programmer's responsibility to ensure that array indices remain in the valid range #include <stdio.h> int main() { int array[5] = {1, 2, 3, 4, 5}; printf("%dn", array[5]); }
- 7. Reading Past End of Array • We can read data that we shouldn't be seeing • Information disclosure vulnerabilty
- 8. Using gdb (GNU Debugger) • Source code debugging • Because we compiled with gcc -g
- 9. Using gdb (GNU Debugger) • gdb commands list show source code run execute program break insert breakpoint x examine memory
- 10. Exploit B: Denial of Service
- 11. Reading Past End of Array • printf uses a format string • %x means print in hexadecimal
- 12. Reading Past End of Array • Program has crashed • Denial of service
- 13. Debug Insert breakpoint and run
- 14. Memory Map • Stack ends at 0xffffe000
- 15. Memory Map • Stack ends at 0xffffe000 • Trying to read past this address caused a segmentation fault
- 16. The Stack
- 17. LIFO (Last-In, First-Out) • ESP (Extended Stack Pointer) register points to the top of the stack • PUSH puts items on the stack – push 1 – push addr var
- 18. Stack • POP takes items off the stack – pop eax – pop ebx
- 19. EBP (Extended Base Pointer) • EBP is typically used for calculated addresses on the stack – mov eax, [ebp+10h] • Copies the data 16 bytes down the stack into the EAX register
- 20. Functions and the Stack
- 21. Purpose • The stack's primary purpose is to make the use of functions more efficient • When a function is called, these things occur: – Calling routine stops processing its instructions – Saves its current state – Transfers control to the function – Function processes its instructions – Function exits – State of the calling function is restored – Calling routine's execution resumes
- 23. Functions and the Stack • Primary purpose of the stack – To make functions more efficient • When a function is called – Push function's arguments onto the stack – Call function, which pushes the return address RET onto the stack, which is the EIP at the time the function is called
- 24. Functions and the Stack – Before function starts, a prolog executes, pushing EBP onto the stack – It then copies ESP into EBP – Calculates size of local variables – Reserves that space on the stack, by subtracting the size from ESP – Pushes local variables onto stack
- 25. Functions and the Stack #include <stdio.h> void function(int a, int b) { int array[5]; } main() { function(1,2); printf("This is where the return address pointsn"); }
- 26. Example of a Function
- 27. Debug and Set Breakpoints
- 28. In main() Stack frame goes from esp to ebp
- 29. In function() Stack frame goes from esp to ebp
- 30. Examine the Stack Frame • Highlighted region is the stack frame of function() • The next word is the return pointer
- 31. Disassemble Main • To call a function: • push arguments onto the stack • call the function
- 32. Disassemble Function • Prolog: • push ebp onto stack • mov esp into ebp, starting a new stack frame • sub from esp, reserving room for local variables
- 33. Saved Return Address • Next word after stack frame • Address of next instruction to be executed in main()
- 34. Stack Buffer Overflow Exploit
- 35. Stack Buffer Overflow Vulnerability gets() reads user input Does not limit its length
- 36. Compile and Run Segmentation fault indicates an illegal operation
- 37. Debug and Set Breakpoint Break after gets()
- 38. Stack After HELLO • ASCII values for HELLO appear in the words outlined in red • Return value is outlined in green
- 39. ASCII •Google "ASCII" •0x41 is A •0x42 is B •etc.
- 40. Stack After AAAAA... • Stack frame is filled with letters • Return value is overwritten with 0x45454545
- 41. Examining the Crash • eip value is 0x45454545 • Controlled by user input!
- 42. gdb Commands list show source code run execute program break insert breakpoint x examine memory disassemble show asssembly code continue resume execution info registers see registers info proc mapping see memory map