The document discusses buffer overflow attacks and their prevention. It explains the memory layout of programs, how buffer overflows work by overflowing the buffer and overwriting return addresses on the stack to execute injected code, and demonstrates this on a vulnerable program to gain root access. It recommends ways to prevent buffer overflows, such as using programming languages that manage memory, input validation, disabling stack execution, patching systems, and using security features like stack canaries, ASLR, and DEP.

1. It’s a Stack! Let’s Smash
It!!
By:
Riddhi Shree
(Senior Principal Test Specialist)
Prowareness Software Services

2. Objectives:
1. Structure of program memory
2. Events necessarily required for performing a buffer-overflow attack
3. DEMO: A vulnerable code exploited to gain root shell access of the
system
4. Prevention & Mitigation

3. Memory Layout:

4. Stack Layout:

6. Stack After
Overflow:

7. THE METHOD: Step-1
1. Identify a buffer overflow vulnerability.

8. Continued…
2. Determine the size of the buffer.
By growing and shrinking the
number of characters we input
into the buffer.
As soon as we determine the exact
number of characters it takes to
crash the program, we have
completed Step 2.

9. Continued…
3. We should be able to control the data written into the buffer.

10. Continued…
4. There must be security sensitive
variables or executable program
instructions stored below the buffer in
memory.
CALL authenticate()
High Memory Address string2
string1
EIP
(return address)
EBP
(stack frame pointer)
buffer1
Low Memory Address buffer2

11. Continued…
5. Targeted
executable program
instructions must be
replaced with other
executable instructions.

12. DEMO
Stack Smashing!!!

14. Prevention & Mitigation:
1. Use a programming language, be it Java, Python, Ruby, that will manage the memory
for you.
2. If you must use C, ensure that you perform proper checks before writing to a buffer.
3. Disable stack execution.
4. Eliminate the use of flawed library functions.
5. Mitigate the damage a buffer overflow can cause:
• Stack canaries
• DEP
• ASLR
6. Use safe library modules.
7. Use source code scanning tools.
8. Patch the operating system and application.

15. Further Reading:
1. https://www.sans.org/reading-
room/whitepapers/securecode/buffer-overflow-attack-mechanism-
method-prevention-386
2. http://www.tenouk.com/Bufferoverflowc/Bufferoverflow1.html
3. http://inst.eecs.berkeley.edu/~cs161/fa08/papers/stack_smashing.
pdf
4. https://security.stackexchange.com/questions/18556/how-do-aslr-
and-dep-work