I. Buffer Overflow Example

Scenario

In computer security and programming, a buffer overflow, or buffer overrun, vulnerability appears where an application needs to read external information such as a character string, the receiving buffer is relatively small compared to the possible size of the input string, and the application doesn't check the size. The buffer allocated at run-time is placed on a stack, which keeps the information for executing functions, such as local variables, argument variables, and the return address. The overflowing string can alter such information. This also means that an attacker can change the information as he or she wants to. For example, the attacker can inject a series of machine language commands as a string that also leads to the execution of the attack code by changing the return address to the address of the attack code. The ultimate goal is usually to get control of a privileged shell by such methods.

Programming languages commonly associated with buffer overflows include C and C++, which provide no built-in protection against accessing or overwriting data in any part of memory and do not automatically check that data written to an array (the built-in buffer type) is within the boundaries of that array. Bounds checking can prevent buffer overflows.

As a penetration tester, you should be able to implement protection against stack-smashing attacks. You must be aware of all the defensive measures for buffer overflow attacks. You can prevent buffer overflow attacks by implementing run-time checks, address obfuscation, randomizing the location of functions in libc, analyze static source code, be marking stack as non-execute, using type-safe languages such as Java, ML, etc.

Lab Objectives

The objective of this lab is to help students to learn and perform buffer overflow to execute passwords. In this lab, you need to:

• Prepare a script to overflow buffer

• Run the script against an application

• Perform penetration testing for the application

• Enumerate a password list

In this lab, you have learnt to perform buffer overflow to execute passwords.