Binary Exploitation (Buffer Overflow) - Revision history

AKofranek: /* Overview */

2024-12-11T19:00:35Z

Overview

← Older revision		Revision as of 19:00, 11 December 2024
Line 1:		Line 1:
	== Overview ==		== Overview ==

	This Pentesting ~~documentation~~ features 3 examples, ~~on how to exploit a binary with a~~ buffer overflow.		This Pentesting article features 3 examples on exploiting different binaries, that have buffer overflow vulnerabilities.

	The examples range from very simple ones to more ~~advanced and~~ complex versions.		The examples range from very simple ones to more complex versions.

	All examples were created in Linux and written in C.		All examples were created in Linux and written in C.

	To compile the C Code into an executable program the GNU Compiler Collection (GCC) was used.		To compile the C Code into an executable program the GNU Compiler Collection (GCC) was used.
	To debug binaries the GNU Debugger (GDB) was used.		To debug binaries the GNU Debugger (GDB) was used.

AKofranek at 18:58, 11 December 2024

2024-12-11T18:58:41Z

← Older revision		Revision as of 18:58, 11 December 2024
Line 1:		Line 1:
	== ~~Summary~~ ==		== Overview ==

	This Pentesting documentation features 3 examples, on how to exploit a binary with a buffer overflow.		This Pentesting documentation features 3 examples, on how to exploit a binary with a buffer overflow.

	The examples range from very simple ones to more advanced and complex versions.		The examples range from very simple ones to more advanced and complex versions.

	~~== Description ==~~

	All examples were created in Linux and written in C.		All examples were created in Linux and written in C.

AKofranek at 18:57, 11 December 2024

2024-12-11T18:57:06Z

← Older revision		Revision as of 18:57, 11 December 2024
Line 4:		Line 4:

	The examples range from very simple ones to more advanced and complex versions.		The examples range from very simple ones to more advanced and complex versions.

			== Description ==

			All examples were created in Linux and written in C.
			To compile the C Code into an executable program the GNU Compiler Collection (GCC) was used.
			To debug binaries the GNU Debugger (GDB) was used.

	== Requirements ==		== Requirements ==
Line 21:		Line 27:

	The theoretical part is required to understand basic concepts needed for the examples.		The theoretical part is required to understand basic concepts needed for the examples.

	~~== Description ==~~

	~~All examples were created in Linux and written in C. To compile the C Code into an executable program the GNU Compiler Collection (GCC) was used. To debug binaries the GNU Debugger (GDB) was used.~~

	== Example 1: Simple Game to Overwrite an Integer==		== Example 1: Simple Game to Overwrite an Integer==

AKofranek: /* Example 2: Execute your own shellcode */

2024-12-11T18:55:12Z

Example 2: Execute your own shellcode

← Older revision		Revision as of 18:55, 11 December 2024
Line 71:		Line 71:
	</pre>		</pre>

	== Example 2: Execute ~~your own shellcode~~ ==		== Example 2: Execute Your Own Shellcode ==

	This example uses a special method of buffer overflows called “stack smashing”. The goal is to execute shellcode by redirecting the execution flow. The return addres will be altered to the start of the buffer.		This example uses a special method of buffer overflows called “stack smashing”. The goal is to execute shellcode by redirecting the execution flow. The return addres will be altered to the start of the buffer.

AKofranek: /* Example 1: Simple game to overwrite an integer */

2024-12-11T18:54:54Z

Example 1: Simple game to overwrite an integer

← Older revision		Revision as of 18:54, 11 December 2024
Line 26:		Line 26:
	All examples were created in Linux and written in C. To compile the C Code into an executable program the GNU Compiler Collection (GCC) was used. To debug binaries the GNU Debugger (GDB) was used.		All examples were created in Linux and written in C. To compile the C Code into an executable program the GNU Compiler Collection (GCC) was used. To debug binaries the GNU Debugger (GDB) was used.

	== Example 1: Simple ~~game~~ to ~~overwrite~~ an ~~integer~~==		== Example 1: Simple Game to Overwrite an Integer==

	This example is quite simple and should only demonstrate that a buffer overflow is possible in general. The buffer itself has a fixed length of 8 bytes. The user input is written to the buffer with the gets() function, which doesn’t check boundaries. Any input that is longer than 8 characters will therefore overwrite what comes after it. In this case the volatile integer will get overwritten. The program acts as a game and reveals a flag if the integer is successfully changed.		This example is quite simple and should only demonstrate that a buffer overflow is possible in general. The buffer itself has a fixed length of 8 bytes. The user input is written to the buffer with the gets() function, which doesn’t check boundaries. Any input that is longer than 8 characters will therefore overwrite what comes after it. In this case the volatile integer will get overwritten. The program acts as a game and reveals a flag if the integer is successfully changed.

AKofranek: /* Description */

2024-12-11T18:54:11Z

Description

← Older revision		Revision as of 18:54, 11 December 2024
Line 26:		Line 26:
	All examples were created in Linux and written in C. To compile the C Code into an executable program the GNU Compiler Collection (GCC) was used. To debug binaries the GNU Debugger (GDB) was used.		All examples were created in Linux and written in C. To compile the C Code into an executable program the GNU Compiler Collection (GCC) was used. To debug binaries the GNU Debugger (GDB) was used.

	=== Example 1: Simple game to overwrite an integer===		== Example 1: Simple game to overwrite an integer==

	This example is quite simple and should only demonstrate that a buffer overflow is possible in general. The buffer itself has a fixed length of 8 bytes. The user input is written to the buffer with the gets() function, which doesn’t check boundaries. Any input that is longer than 8 characters will therefore overwrite what comes after it. In this case the volatile integer will get overwritten. The program acts as a game and reveals a flag if the integer is successfully changed.		This example is quite simple and should only demonstrate that a buffer overflow is possible in general. The buffer itself has a fixed length of 8 bytes. The user input is written to the buffer with the gets() function, which doesn’t check boundaries. Any input that is longer than 8 characters will therefore overwrite what comes after it. In this case the volatile integer will get overwritten. The program acts as a game and reveals a flag if the integer is successfully changed.
Line 71:		Line 71:
	</pre>		</pre>

	=== Example 2: Execute your own shellcode ===		== Example 2: Execute your own shellcode ==

	This example uses a special method of buffer overflows called “stack smashing”. The goal is to execute shellcode by redirecting the execution flow. The return addres will be altered to the start of the buffer.		This example uses a special method of buffer overflows called “stack smashing”. The goal is to execute shellcode by redirecting the execution flow. The return addres will be altered to the start of the buffer.
Line 173:		Line 173:
	[[File:Example2-hacked.png \| 900px]]		[[File:Example2-hacked.png \| 900px]]

	=== Example 3: Control Flow Alteration via Stack Buffer Overflow Exploitation ===		== Example 3: Control Flow Alteration via Stack Buffer Overflow Exploitation ==
	The following program is vulnerable to stack-based buffer overflows due to the usage of		The following program is vulnerable to stack-based buffer overflows due to the usage of
	the insecure gets()-function. gets() is used to write user input into a character array. In		the insecure gets()-function. gets() is used to write user input into a character array. In

EMeisl: headings

2024-12-11T18:26:05Z

headings

← Older revision		Revision as of 18:26, 11 December 2024
Line 26:		Line 26:
	All examples were created in Linux and written in C. To compile the C Code into an executable program the GNU Compiler Collection (GCC) was used. To debug binaries the GNU Debugger (GDB) was used.		All examples were created in Linux and written in C. To compile the C Code into an executable program the GNU Compiler Collection (GCC) was used. To debug binaries the GNU Debugger (GDB) was used.

	=== Example 1 ===		=== Example 1: Simple game to overwrite an integer===

	This example is quite simple and should only demonstrate that a buffer overflow is possible in general. The buffer itself has a fixed length of 8 bytes. The user input is written to the buffer with the gets() function, which doesn’t check boundaries. Any input that is longer than 8 characters will therefore overwrite what comes after it. In this case the volatile integer will get overwritten. The program acts as a game and reveals a flag if the integer is successfully changed.		This example is quite simple and should only demonstrate that a buffer overflow is possible in general. The buffer itself has a fixed length of 8 bytes. The user input is written to the buffer with the gets() function, which doesn’t check boundaries. Any input that is longer than 8 characters will therefore overwrite what comes after it. In this case the volatile integer will get overwritten. The program acts as a game and reveals a flag if the integer is successfully changed.
Line 71:		Line 71:
	</pre>		</pre>

	=== Example 2 ===		=== Example 2: Execute your own shellcode ===

	This example uses a special method of buffer overflows called “stack smashing”. The goal is to execute shellcode by redirecting the execution flow. The return addres will be altered to the start of the buffer.		This example uses a special method of buffer overflows called “stack smashing”. The goal is to execute shellcode by redirecting the execution flow. The return addres will be altered to the start of the buffer.

AKofranek: /* Example 3: Control Flow Alteration by Stack Buffer Overflow Exploitation */

2024-12-11T18:14:47Z

Example 3: Control Flow Alteration by Stack Buffer Overflow Exploitation

← Older revision		Revision as of 18:14, 11 December 2024
Line 173:		Line 173:
	[[File:Example2-hacked.png \| 900px]]		[[File:Example2-hacked.png \| 900px]]

	=== Example 3: Control Flow Alteration by Stack Buffer Overflow Exploitation ===		=== Example 3: Control Flow Alteration via Stack Buffer Overflow Exploitation ===
	The following program is vulnerable to stack-based buffer overflows due to the usage of		The following program is vulnerable to stack-based buffer overflows due to the usage of
	the insecure gets()-function. gets() is used to write user input into a character array. In		the insecure gets()-function. gets() is used to write user input into a character array. In

AKofranek: /* Summary */

2024-12-11T18:14:03Z

Summary

← Older revision		Revision as of 18:14, 11 December 2024
Line 1:		Line 1:
	== Summary ==		== Summary ==

	This Pentesting documentation features ~~[ANZAHL]~~ examples, on how to exploit a binary with a buffer overflow.		This Pentesting documentation features 3 examples, on how to exploit a binary with a buffer overflow.

	The examples range from very simple ones to more advanced and complex versions.		The examples range from very simple ones to more advanced and complex versions.

	== Requirements ==		== Requirements ==

AKofranek: /* Requirements */

2024-12-11T18:13:26Z

Requirements

← Older revision		Revision as of 18:13, 11 December 2024
Line 9:		Line 9:
	* Operating system: Linux		* Operating system: Linux
	* Packages: GNU Compiler Collection (GCC), GNU Debugger (GDB)		* Packages: GNU Compiler Collection (GCC), GNU Debugger (GDB)

			Install gcc-multilib and gdb using apt.

			<pre>
			sudo apt update
			sudo apt install gcc-multilib
			sudo apt install gdb
			</pre>

	In order to complete these steps, you must have followed [[Buffer Overflows]] before.		In order to complete these steps, you must have followed [[Buffer Overflows]] before.