Chapter six buffer overflow attacks
the unauthorized reproduction in whole or in part of this publication in any form is prohibited.
We will now copy the required files from the enclosed discs to the hard disk.
Here is our first example program.
It shows the content of the I.A. a variable which is visible in the program code.
Let's can pilot
as we can see after transferring the second argument of the call The I.A. a variable has been overwritten
with the value 0 x 41 corresponding to the letter A to discover how the overwriting of the i n t a variable
was possible.
We will now look at the program examples using gdb
as we can see in the case of the car BAAF 10 variable the stack has been increased to 24 bytes 0 x 18
and the hexadecimal system
in the case of the I NTA variable the stack has been increased to 8 bytes by transferring 32 characters
24 plus 8 to our first program we have overwritten the valuable of the i n t a variable.
The next task will be to overwrite The I.A. OK variable which controls access to secure resources
after transferring the long character chain.
It was possible to crack the program
but how can we do this.
If the variable controlling access does not exist
let's test our next example program.
We will now use gdb to find out what happens at the moment.
A program called paramita that is too long is transferred.
As we can see the program wanted to jump to the address 0 x 41 41 41 41 which does not belong to its
memory area.
Let's now try to tell the program to jump to the correct address which will allow it to skip to the
procedure of log in and password verification.
This will be the address 0 x 0 8 0 48 for C-7
the address of the past to be written in reverse order starting from the last byte
as we can see.
Everything went as expected.
We managed to fool the application.
Now we will analyze another example to exploit using the shell code.
In this case a ready address that we can transfer does not exist.
We will need to create our own show code and add it to our program.
Unfortunately a shellcode containing indirect closing function calls is not appropriate.
It is necessary to create a code containing system function calls.
We will obtain a ready made show code from the binary program image using a LBJ dump tool.
The final version of our shell code looks like this.
We will therefore use a ready made exploit that takes advantage of the techniques we learned while reading
this chapter.
As we can see the operation has been successful we gained access to the shell.