10: Buffer Overflow

x86 Architecture

Text, Data, Free Memory, Stack (and Registers)

Text Content

Program code

Data Content

Static variables, strings, etc.

Free Memory Content

Nothing?

Stack Content

Command line arguments, variables, etc.

EAX

Accumulator

EIP

Instruction Point

ESP

“Start” of the stack

EBP

“Bottom” of the frame

Stack order

Older entries in the stack belong further down.

Old EIP

Points to the address before a function call was made so that when the function terminates, the program runs from that point again.

Old EBP

Old bottom of the stack before calling a function - the new one points to the bottom of the function working space.

Function Working Space

Where all local variables relative to the function are stored.

Instruction Pointer Purpose

The instruction pointer controls which code executes.

Buffer Overflow

Where an input in C has a set number of bytes allocated to it, but the user goes over that byte count, and overflows into the EIP, either corrupting it or telling it to pick off from another point in the code.

Shell Code Injection

1. Push 0x00000000 onto the stack by XOR’ing the accumulator (EAX) with itself
2. Push //bin/sh in reverse
3. Make EBX point to //bin/sh on the stack using ESP (mov ebx, esp)
4. Push 0x00000000 using EAX and point EDX to it using ESP (push eax and mov edx, esp)
5. Push the address of //bin/sh on the stack an make ECX point to it using ESP.
6. Since EAX is 0, move 11 into the AL.
7. Int 0x80, and you got your shell!

NX-Bit

Provides a hardware distinction between the text and stack. Protects against code injected in the stack.

Reusing Code

Instead of injecting your own code, you jump to other functions or jump to a function in the standard C library.

Address Space Layout Randomisation

Adds a random offset to the stack and codebase each time the program runs - makes it harder for an attacker to guess the address of the function where they inject code.

NOP Slide

Using the byte 0x90 (NOP) repeatedly before shellcode and picking a random return address so that it is somewhere in the NOP bytes, before it slides down into the shellcode.

Metasploit

A framework for testing and executing known buffer overflow exploits.