Question

1. For this lab you will need to develop a Buffer overload exploit.
   1. Create a program with a stack based buffer.
   2. Copy shellcode to overlay the return address in the stack
   3. Pass control to your shellcode
   4. Your shellcode should activate a shell /bin/sh on linux.

Answer 1

Exploit the Buffer-Overflow Vulnerability
To fully exploit a stack buffer-overflow vulnerability, we need to solve several challenging problems.
• Injecting the malicious code: We need to be able to inject the malicious code into the memory of the
target process. This can be done if we can control the contents of the buffer in the targeted program.
• Jumping to the malicious code: With the malicious code already in the memory, if the targeted
program can jump to the starting point of the malicious code, the attacker will be in control.
• Writing malicious code: Writing a malicious code is not trivial. We will show how a special type of
malicious code, shellcode, can be written.

The vulnerable program stack.c
/* stack.c */
/* This program has a stack based buffer overflow vulnerability. */
#include <stdlib.h>
#include <stdio.h>
#include <string.h>
int foo(char *str)
{
char buffer[100];
/* The following statement has a buffer overflow problem */
strcpy(buffer, str);
return 1;
}
int main(int argc, char **argv)
{
char str[400];
FILE *badfile;
badfile = fopen("badfile", "r");
fread(str, sizeof(char), 300, badfile);
foo(str);
printf("Returned Properly\n");
return 1;
}
The above program reads 300 bytes of data from a file called "badfile", and then copies
the data to a buffer of size 100. Clearly, there is a buffer overflow problem. This time, the
contents copied to the buffer come from a user-provided file, i.e., users can control what is
copied to the buffer.

In order to execute our raw exploit codes directly in the stack or other parts of the memory, which deal with binary, we need assembly codes that represent a raw set of machine instructions of the target machines. A shellcode is an assembly language program which executes a shell, such as the '/bin/sh' forUnix/Linuxshell, or the command.com shell on DOS and MicrosoftWindows