18 - Buffer Overflow

Buffer overflow is an anomaly where a program while writing data to a buffer, overruns the buffer's boundary and overwrites adjacent memory. This is a special case of violation of memory safety. Buffer overflows can be triggered by inputs that are designed to execute code or alter the way the program operates. This may result in erratic program behaviour, including memory access errors, incorrect results, a crash, or a breach of system security.

Module Objective

The objective of this lab is to help students to learn and perform buffer overflow attacks to execute passwords.

In this lab, you need to:

• Prepare a script to overflow buffer

• Run the script against an application

• Perform penetration testing for the application

• Enumerate a password list

Scenario

Hackers continuously look for vulnerabilities in software or a computer to break into the system by exploiting these vulnerabilities.

The most common vulnerability often exploited is the buffer overflow attack, where a program failure occurs either in allocating sufficient memory for an input string or in testing the length of the string if it lies within its valid range. A hacker can exploit such a weakness by submitting an extra-long input to the program, designed to overflow its allocated input buffer (temporary storage area) and modify the values of nearby variables, cause the program to jump to unintended places, or even replace the program's instructions by arbitrary code.

If the buffer overflow bugs lie in a network service daemon, the attack can be done by directly feeding the poisonous input string to the daemon. If the bug lies in an ordinary system tool or application, with no direct access, the hacker attaches the poisonous string with a document or an email which, once opened, will launch a passive buffer overflow attack. Such attacks are equivalent to a hacker logging into the system with the same user ID and privileges as the compromised program.

Buffer overflow bugs are especially common in C programs since that language does not provides built-in array bound checking, and uses a final null byte to mark the end of a string, instead of keeping its length in a separate field. To make things worse, C provides many library functions, such as strcat and getline, which copy strings without any bounds-checking.

As an expert ethical hacker and penetration tester, you must have sound knowledge of when and how buffer overflow occurs. You must understand stacks-based and heap-based buffer overflows, perform penetration tests for detecting buffer overflows in programs, and take precautions to prevent programs from buffer overflow attacks.

I. Buffer Overflow Example

Module Syllabus

• Buffer Overflows

• Why are Programs And Applications Vulnerable?

• Understanding Stacks

• Stack-Based Buffer Overflow

• Understanding Heap

  • Heap-Based Buffer Overflow

• Stack Operations

  • Shellcode

  • No Operations (NOPs)

• Knowledge Required to Program Buffer Overflow Exploits

• Buffer Overflow Steps

  • Attacking a Real Program

  • Format String Problem

  • Overflow using Format String

  • Smashing the Stack

  • Once the Stack is Smashed...

• Simple Uncontrolled Overflow

• Simple Buffer Overflow in C

• Code Analysis

• Exploiting Semantic Comments in C (Annotations)

• How to Mutate a Buffer Overflow Exploit?

• Identifying Buffer Overflows

• How to Detect Buffer Overflows in a Program?

• BOU (Buffer Overflow Utility)

• Testing for Heap Overflow Conditions: heap.exe

• Steps for Testing for Stack Overflow in OllyDbg Debugger

  • Testing for Stack Overflow in OllyDbg Debugger

• Testing for Format String Conditions using IDA Pro

• BoF Detection Tools

• Defense Against Buffer Overflows

  • Preventing BoF Attacks

  • Programming Countermeasures

• Data Execution Prevention (DEP)

• Enhanced Mitigation Experience Toolkit (EMET)

  • EMET System Configuration Settings

  • EMET Application Configuration Window

• /GS http://microsoft.com

• BoF Security Tools

  • BufferShield

• Buffer Overflow Penetration Testing