[Merkuri]

I haven't seen a tutorial about buffer overflow on this forum, so I decided to write one.

What is buffer overflow?

Code:

In computer security and programming, a buffer overflow, or buffer overrun, is an anomaly where a program, while writing data to a buffer, overruns the buffer's boundary and overwrites adjacent memory. This is a special case of violation of memory safety.

- Wikipedia

A buffer overflow occurs when a buffer that has been allocated a specific storage space has more data copied to it than can handle.

Example

Code:

#include <stdio.h> using name space std; int main( int argc ,char **argv) { char attacker[11]="AAAAAAAAAA"; strcpy(attacker, "BBBBBBBBBBBBBB"); printf("% n\", attacker) return 0; }

Reasons for vulnerabilities:
Boundary checks are not done fully, or in most cases they are skipped entirely. Programming languages suck as C have vulnerabilities in them. These functions in C can be exploited as they do not check for buffer size.

Code:

strcat(), strcpy(), sprintf(), vsprintf, bcopy(), gets(),and scanf()

Programs and applications do no adhere to good programing practices

Stacks
Stacks use the Last-IN-First-Out(LIFO) mechanism to pass arguments to functions and refer the local variable. The stack is created at the beginning of a function and released at the end of it. It acts like a bugger holding all of the information that the function needs.



Stack operations
Important stack operations
Pop - Remove one item from the top of the stack.
Push- Put one item on the top of the stack.

Push and pop operations
Returns the contents pointed to by a pointer, and changes the pointer.

Extended Instruction Pointer
EIP points to the code that you are currently executing. When you call a function, this gets saved on the stack for later use.

Extended Stack Pointer
ESP points to the current position on the stack and allows things to be added and removed from the stack using push and pop operations, or direct stack pointer manipulations.

Extended Base Pointer
EBP serves as a static point for referencing stack-based information like variables and data in a function using offsets. This almost always points to the top of the stack for a function.


Heap
Heap is an area of memory utilized by an application and is allocated dynamically at the run time with functions, suck as malloc().
Static variables are stored on the stack along with the data allocated using the malloc() interface.
Heap stores all instances or attributes, constructors, and methods of a class or object.


Stack-based buffer overflow
A stack-based buffer overflow occurs when a buffer has been overrun in the stacks space. An attacker injects malicious code on the stack and overflows the stack to overwrite the return pointer so that the flow of control switches to the malicious code.




Heap-based buffer overflow
If an application copies the data without checking whether it fits into the target destination, attackers can supply the application with large data. Overwriting the heap management information an attacker makes a buffer to overflow on the lower part of the heap, overwriting other dynamic variables which can have unexpected and unwanted effects.


Shellcode
Shellcode is a small code used as payload in the exploitation of a software vulnerability. Buffers are soft targets for attackers as they overflow easily. Especially if the conditions match buffer overflow shellcodes written in assembly language and exploit vulnerabilities in stack and heap memory management.

I plan on writing a second tutorial on this.