Attack on Stack [Part 4]; Smash the Stack Visualization: Prologue to Exploitation Chronicles, GDB on the Battlefield.

May 1, 2015 12:24 PM

May 15, 2015 06:24 PM

Attack On Stack: "Exploitation Chronicles" Visualizing Exploitation Part Four

Hi everyone!

Last time we finished analyzing the assembly representation of our vulnerable piece of code (have I ever told you it is vulnerable?). This time we are going to introduce some fundaments about exploitation by demonstrating how to crash a program's execution. If that sounds lame, next time we will see how this crash can in fact be useful to control the program's execution, achieving remote code execution!

Today's Topic

Today we are going to introduce the "Smash the Stack" technique (yes, finally). "Smash" because a Buffer Overflow happens when a buffer is overflown (you guessed it), which means that the content of the buffer overwrites bytes passed the end of it, "smashing" the bytes that were there for other purposes. For now, we don't need to know how to use it for our own purposes, but to understand it.

The explanation will begin with the demonstration of a "Segmentation Fault error" to then use GDB to visualize data in the stack, by outputting all the bytes in the current stack frame, with the help of the backtrace, full backtrace and examine commands.

Make sure you understood everything we've explained in the past weeks, and if you have any question, don't hesitate to ask, we have a very helpful and rich comment section!

I will leave you with a little challenge to test what you've learned until now, and post the result next time.

Exploitation Chronicles: Preface

Where we introduce the topic.

Attack on Stack [Part 4]; Smash the Stack Visualization: Prologue to Exploitation Chronicles, GDB on the Battlefield.

Exploitation Chronicles: Prologue, Leaving Home.

Experimenting is a fundamental part of exploitation, ad patience the skill you'll need the most. Make sure you know how to use correctly your best tools, as the commands "bt", "bt full" and "examine"!

Debugging process in GDB with code execution displayed.

Exploitation Chronicles: Expectations

It's important to never miss a detail, GDB output is very rich!

Exploitation Chronicles: The Night of the Disbanding

What exactly happens when a buffer gets overflown? What are the consequences?

Today's objective will be to crash the program by entering an endless loop.

Buffer of 100 bytes in data processing context.

Exploitation Chronicles: Dressing Up for the Debut!

Where we prepare to examine the stack.

Text from a presentation slide outlining objectives and steps for understanding program structure and debugging.

Exploitation Chronicles: Battlefield! Clash of Beasts!

Where we practically examine the stack frames.

Code snippet showing a buffer overflow example with an explanatory note.

Exploitation Chronicles: The Aftermath.

I'm gonna leave you with a little mystery so that you can train for the next part. See if you can get this working!

References

Aleph1's "Smashing the Stack for Fun and Profit"

"Hacking, The Art of Exploitation"

"Buffer Overflow Demistified" by murat.

"The Shellcoder's Handbook"

Part 1 of "Attack On Stack"

Part 2 of "Attack On Stack"

Part 3 of "Attack On Stack"

Part 5 of "Attack On Stack"

Part 6 of "Attack On Stack"

Prelude to Reverse Engineering: IDA and Hopper Binary Patching Introduction

64 bit shellcoding by Winter Drawlace

Side Note to Null Byte Users

Hey everyone! How is it going?

In the previous parts of this series I've got an overwhelming feedback and a lot of you have been sharing my posts, so thank you!

This part was longer. I had planned to publish 10 pictures each time, but I don't want to break the continuation that I initially programmed while building the series.

I'd like to point out that, while I'm publishing this series of posts, another user, Winter Drawlace (very well done, GG), is publishing another series which might help you to also understand the next part that I'm going to publish, so make sure you read his 64 bit shellcode series!

I'm impressed by how far Null Byte is growing, we have been having new creators every week so far, so don't stop people, thank you Null Byte!

You already know how to use your phone. With Gadget Hacks' newsletter, we'll show you how to master it. Each week, we explore features, hidden tools, and advanced settings that give you more control over iOS and Android than most users even know exists.