{"id":17239403,"url":"https://github.com/npapernot/buffer-overflow-attack","last_synced_at":"2025-04-14T02:31:26.240Z","repository":{"id":91089957,"uuid":"57186353","full_name":"npapernot/buffer-overflow-attack","owner":"npapernot","description":"This is an example buffer overflow attack on a small vulnerable C program.","archived":false,"fork":false,"pushed_at":"2016-04-27T05:45:55.000Z","size":6,"stargazers_count":78,"open_issues_count":0,"forks_count":51,"subscribers_count":3,"default_branch":"master","last_synced_at":"2025-03-27T16:40:55.431Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"C","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/npapernot.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null}},"created_at":"2016-04-27T05:37:15.000Z","updated_at":"2025-03-27T08:30:28.000Z","dependencies_parsed_at":null,"dependency_job_id":"2df47aef-7607-418f-bc11-7ff35a023431","html_url":"https://github.com/npapernot/buffer-overflow-attack","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/npapernot%2Fbuffer-overflow-attack","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/npapernot%2Fbuffer-overflow-attack/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/npapernot%2Fbuffer-overflow-attack/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/npapernot%2Fbuffer-overflow-attack/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/npapernot","download_url":"https://codeload.github.com/npapernot/buffer-overflow-attack/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":248810883,"owners_count":21165195,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-10-15T05:48:43.008Z","updated_at":"2025-04-14T02:31:24.938Z","avatar_url":"https://github.com/npapernot.png","language":"C","funding_links":[],"categories":["Buffer Overflow Writeups"],"sub_categories":[],"readme":"# Buffer Overflow Vulnerability\n\nThis is a short tutorial on running a simple buffer overflow on a virtual machine\nrunning Ubuntu. It shows how one can use a buffer overflow to obtain a root \nshell. The end of the tutorial also demonstrates how two defenses in the Ubuntu\nOS prevent the simple buffer overflow attack implemented here.\n\nThis tutorial leverages the paper written by alephOne on buffer overflows:\n\u003chttp://cecs.wright.edu/~tkprasad/courses/cs781/alephOne.html\u003e\n\n## Initial Setup of the Virtual Machine\n\nLet us first go through the initial setup of the virtual machine used to\nexperiment with buffer overflow. The virtual machine used runs Ubuntu OS `12.04\nLTS`. To make our attack easier, we first need to disable address space\nrandomization, a defense against buffer overflows making guessing addrsses in\nthe heap and stack more difficult.  To do so, we simply need to run the\nfollowing command under root privileges:\n\n```\nsu root \nsysctl -w kernel.randomize_va_space=0\n```\n\nA confirmation of the variable's value is printed `kernel.randomize_va_space = 0`\nby the terminal. \n\n## Example of a Shellcode\n\nThe file `call_shellcode.c` containes an example shellcode, which allows one to \nstore a `char` in a buffer and then call the shell by a buffer overflow. To run\nthe shell, we can compile `call_shellcode.c` using the executable stack option\nin `gcc`. Running the program `./call_shellcode` from the terminal starts a\nshell, which can for instance be used to run programs (e.g., `vim`).\n\nThis shellcode was however not injected so this example does not really\ncorrespond to a realistic threat model. Instead, we now show how one can inject\nthe buffer using a file loaded by a vulnerable program. \n\n## Vulnerable Program\n\nThe vulnerable program is provided in the `stack.c` file. It needs to be made\na set-root-uid in order for the adversary exploiting the buffer overflow to be\nable to gain access to a root shell. For that purpose, we compile the file using\nroot privileges. Furthermore, if `GCC\u003e4.3.3` is used, since the Stack Guard\noption is enabled by default, one needs to disable it at compile time (cf. \nbelow). Note that we also use the executable stack option (to be able to run \nour shellcode from the buffer). Finally, to make the file executable, we `chmod`\nthe permissions to `4755` on the compiled program `stack`.  \n\n```\nsu root \ngcc -o stack -z execstack -fno-stack-protector stack.c\nchmod 4755 stack \n```\n\n## Exploiting the Vulnerability: Demonstration of the Buffer Overflow Attack\n\nWe now need to craft the `badfile` file that will be read by this vulnerable\nprogram 'stack' and stored in the buffer, which will be overflowed. The file\n`exploit.c` contains code that dumps the buffer that will be read by the\nvulnerable program. The code is well commented and should be fairly\nunderstandable and leverages sample code provided in the paper by alephOne. \n\nTo demonstrate the buffer flow attack, we run the following commands:\n\n```\ngcc -o exploit exploit.c \n./exploit\n./stack\n```\n\nThis simply compiles and runs the exploit file. The exploit file evaluates the \nstack pointer and crafts a buffer (with the stack pointer and the shellcode) \nand saves it to `badfile`. The vulnerable program `stack` is then executed, it \nreads the file `badfile` and loads the buffer, which triggers the buffer overflow\nand executes the shellcode, thus giving us a root shell (designated by `#`). \n\nNote that the root shell we have obtained is still using our user ID, as proved\nby running the `id` command. To solve this and have both the real and effective \nuser ids set to root, one can run the included `set_uid_root.c` file.\n\n## Address Randomization: a first defense\n\nOne can set Ubuntu's address randomization back on using:\n\n```\n$ su root\n# /sbin/sysctl -w kernel.randomize_va_space=2\n```\n\nRunning the attack described in the previous section gives a \n`segmentation fault (core dumped)` error because the address is randomized each\ntime the program is executed. Therefore, the stack pointer is different and the\n`exploit.c` program will not set the address properly anymore for the buffer\nflow to run the shellcode. \n\n## Stack Guard: a second defense\n\nTo analyze one defense at a time, it is best to first turn off again address\nrandomization, as performed in the initial setup. One can then repeat the\nbuffer overflow attack but this time compiling the vulnerable program `stack`\nwith the Stack Guard protection mechanism (i.e. removing the flag previously\nused: `-fno-stack-protector`). \n\n```\nsu root \ngcc -o stack -z execstack stack.c\n```\n\nThis time, the Stack Guard option in `gcc` was able to allow us to detect the\nsmashing attemp. This effectively terminates the program and prevents the \nattack. Here is a screen dump:\n\n```\n*** stack smashing detected ***: ./stack terminated\n======= Backtrace: =========\n/lib/i386-linux-gnu/libc.so.6(__fortify_fail+0x45)[0xb7f240e5]\n/lib/i386-linux-gnu/libc.so.6(+0x10409a)[0xb7f2409a]\n./stack[0x8048513]\n[0xbffff33c]\n[0x2f6850c0]\n======= Memory map: ========\n08048000-08049000 r-xp 00000000 08:01 1582540    /home/***/Documents/stack\n08049000-0804a000 r-xp 00000000 08:01 1582540    /home/***/Documents/stack\n0804a000-0804b000 rwxp 00001000 08:01 1582540    /home/***/Documents/stack\n0804b000-0806c000 rwxp 00000000 00:00 0          [heap]\nb7def000-b7e0b000 r-xp 00000000 08:01 2360149    /lib/i386-linux-gnu/libgcc_s.so.1\nb7e0b000-b7e0c000 r-xp 0001b000 08:01 2360149    /lib/i386-linux-gnu/libgcc_s.so.1\nb7e0c000-b7e0d000 rwxp 0001c000 08:01 2360149    /lib/i386-linux-gnu/libgcc_s.so.1\nb7e1f000-b7e20000 rwxp 00000000 00:00 0 \nb7e20000-b7fc3000 r-xp 00000000 08:01 2360304    /lib/i386-linux-gnu/libc-2.15.so\nb7fc3000-b7fc5000 r-xp 001a3000 08:01 2360304    /lib/i386-linux-gnu/libc-2.15.so\nb7fc5000-b7fc6000 rwxp 001a5000 08:01 2360304    /lib/i386-linux-gnu/libc-2.15.so\nb7fc6000-b7fc9000 rwxp 00000000 00:00 0 \nb7fd9000-b7fdd000 rwxp 00000000 00:00 0 \nb7fdd000-b7fde000 r-xp 00000000 00:00 0          [vdso]\nb7fde000-b7ffe000 r-xp 00000000 08:01 2364405    /lib/i386-linux-gnu/ld-2.15.so\nb7ffe000-b7fff000 r-xp 0001f000 08:01 2364405    /lib/i386-linux-gnu/ld-2.15.so\nb7fff000-b8000000 rwxp 00020000 08:01 2364405    /lib/i386-linux-gnu/ld-2.15.so\nbffdf000-c0000000 rwxp 00000000 00:00 0          [stack]\nAborted (core dumped)\n```\n\n## How to contact me\n\nWays to get in touch with me:\n* Twitter: \u003chttps://www.twitter.com/nicolaspapernot\u003e\n* Webpage: \u003chttps://www.papernot.fr\u003e \n\n## License\n\nThis was adapted from a SEED lab.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in\nall copies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN\nTHE SOFTWARE.\n\n\n\n\n\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fnpapernot%2Fbuffer-overflow-attack","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fnpapernot%2Fbuffer-overflow-attack","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fnpapernot%2Fbuffer-overflow-attack/lists"}