[Merkuri]

Since I see a lot of peoples to write tutorials in internet for buffer overflow, when they even aren't familiar with the stack and copy from other tutorials I decide to give some examples I hope that programmers will understand them. The example are on C language

Example 1.

Spoiler:

Code:

#include <lib 1> #include <lib 2> #include <lib ...> char buffer[8]; char *program_to_run= "something.exe"; void main( char *args[] ) { gets( buffer ); exec( program_to_run ); }

In this example I have create a char variable "buffer" with 8 bits size, this program should run something.exe, in this case the program should be vulnerable.

Example 2

Spoiler:

Code:

#include <lib 1> #include <lib ...> void function(char *str) { char buffer[16]; strcpy(buffer,str); } void main() { char large_string[256]; int i; for( i = 0; i < 255; i++) large_string[i] = 'A'; function(large_string); }

In this example again I have create a char with name bufffer and bla bla bla.The intresting here is the function she copies a supplied string without bounds checking by
using strcpy() instead of strncpy(). You may get segmentation violation.

Example 3

Spoiler:

Code:

#include <lib 1> #include <lib ...> void getInput(){ char buffer[8]; gets(buffer); puts(buffer); } void main(){ getinput(); return 0; }

Here I have create char with name bla bla bla... This simple will get a message from the user and put it on the screen. If the message is to large your application will be vulnerable.

How to avoid buffer overflow?

Spoiler:

1. Avoid using library files included with the compiler. If an hacker find vulnerability in those files all applications that include them will be vulnerable.
2.Strlcpy and Strlcat. An alternative, being employed by OpenBSD, is the strlcpy(3) and strlcat(3) they are a minimalist, statically-sized buffer approach that provides C string copying and concatenation with a different (and less error-prone) interface.

Those are the only recommendations I can do for now, I'm not very experience developer I like more exploting them. I'm sure that you will be able to find help in coding forums.

Those examples are only on buffer overflow but there are more vulnerabilities in C language like heap overflow.

[superMAUS]

Since I see a lot of peoples to write tutorials in internet for buffer overflow, when they even aren't familiar with the stack and copy from other tutorials I decide to give some examples I hope that programmers will understand them. The example are on C language

Example 1.

Spoiler:

Code:

#include <lib 1> #include <lib 2> #include <lib ...> char buffer[8]; char *program_to_run= "something.exe"; void main( char *args[] ) { gets( buffer ); exec( program_to_run ); }

In this example I have create a char variable "buffer" with 8 bits size, this program should run something.exe, in this case the program should be vulnerable.

Just because it overwrites doesnt make it vulnerable in the sense its exploitable. Considering the lack of handled user input you cant exploit this.

[0xDEAD10CC]

Just because a programmer's ignorance to check the size of the string being passed over to the destination from a source pointer might result in a buffer overflow doesn't make strcpy() a bad function.

[Christ]

Just because a programmer's ignorance to check the size of the string being passed over to the destination from a source pointer might result in a buffer overflow doesn't make strcpy() a bad function.

Only if you fail at using strcpy() does it turn into a bad function.

Code:

void func(char *userdata) { char buf[256]; strcpy(buf, userdata); }

If you code like this you shouldn't be coding because it's neither functional nor excusable.

[3SidedSquare]

Spoiler:

In this example I have created a char variable "buffer" with 8 bits size, this program should run something.exe, in this case the program should be vulnerable.

Spoiler:

In this example again I have created a char with name bufffer and bla bla bla.The interesting thing here is the function she copies a supplied string without checking bounds by
using strcpy() instead of strncpy(). You may get segmentation violation.

Spoiler:

Here I have created char with name bla bla bla... This will simply get a message from the user and put it on the screen. If the message is to large your application will be vulnerable.

Spoiler:

1. Avoid using library files included with the compiler. If a hacker finds a vulnerability
...
they are a minimal,
...
only recommendations I have for now, I'm not a very experienced developer, I like exploting buffer overflows more

I'm afraid I share the opinions of the posters above, what kind of recommendation is "Avoid using library files included with the compiler"? The entire point of libraries is to learn how to use them to make your programming easier.

[0xDEAD10CC]

Only if you fail at using strcpy() does it turn into a bad function.

Code:

void func(char *userdata) { char buf[256]; strcpy(buf, userdata); }

If you code like this you shouldn't be coding because it's neither functional nor excusable.

I don't understand. Are you agreeing with me then? This is exactly as I just said. :S

[Christ]

I don't understand. Are you agreeing with me then? This is exactly as I just said. :S

Yeah I was giving you blackup.

[w00t]

Just because a programmer's ignorance to check the size of the string being passed over to the destination from a source pointer might result in a buffer overflow doesn't make strcpy() a bad function.

Yes it does, using strncpy, which is 2-6 more keystrokes, prevents that from happening, ever.

[0xDEAD10CC]

Yes it does, using strncpy, which is 2-6 more keystrokes, prevents that from happening, ever.

My point still stands, just because there's the possibility of it being vulnerable doesn't make it a bad function. Yes there are alternatives that can and probably should be used, but if you choose to use strcpy(), then it's the programmer's ignorance that determines whether it's vulnerable or not, and/or unknowing.

There is still absolutely no reason to grab some third party library just because strcpy() doesn't check the size.

Btw, functions like strncpy() don't guarantee null-termination. People use those functions because they are safer, but not many realize this, and thus might end up forgetting to set '\0' within the string. Non-terminated strings are still bad, because it would result in an overrun. The way strncpy() works, it was really probably designed for inserting characters within a string, but it had been re-identified by programmers to be used for strings all the time, just because it's safer. If you don't understand that the null terminator is implicitly NOT put anywhere in the buffer by this function, then I see it as just as much work as checking the length with using strcpy() quite honestly, although strcpy() guarantees the null terminator.

Functions are not bad, for a programmer to blame a function is ignorance. Nobody else is writing the code for you.

[phyrrus9]

@Merkuri seriously, who taught you how to program?

braces dont go there
your tabbing sucks
you have really poor theory
all of your overflows look like something not even a first grader would do (they aren't that stupid).

Show some well written real world examples.