This document provides an introduction to buffer overflow attacks. It discusses buffer overflows, stack smashing, and controlling the execution flow by manipulating the EIP. It demonstrates how user input can make its way onto the stack and be used to control the call and return instructions. The document shows an example of writing exit shellcode and using it in a proof of concept attack. It notes that real attacks are illegal and this presentation is for demonstration purposes only.

1. Buffer Overflow
Attacks
A humble introduction

2. $whoami
• Security Enthusiast with an interest in knowing
things inside out.

3. DISCLAIMER
Without rwx-r-x-r
• Breaking software is ILLEGAL
• Hacking into networks is ILLEGAL
• Launching worms/virus attacks is ILLEGAL
• Governed by Indian Law - Information Technology Act, 2000.
• Section 65/66/66A…F/67 etc.
• This ppt is only for demo purposes and I am in no way responsible
for any damage done through this knowledge to self or otherwise.

4. What is it about?
• Buffer overflow
• Stack smashing

5. Don’t Expect
• Tool internals
• Tool tutorials
• Tool specifications
• Social engineering techniques
• Exploit/Payload writing

6. Live Attack Demo
• Real life attacks are actually REAL !
• Vulnerable Unzip Utility
• Impact
• What do you loose if you are “NAIVE”

8. Some useful basics?
• ESP, EIP
• Return address
• EBP
• Environment - 32bit Ubuntu 15 - ASLR disabled
and gcc - stack smashing protection - disabled.

9. Function call and stack
arrangement ?
• ESP, EIP
• Return address
• EBP
• funcall.c
• funCall gdb analysis

10. GOAL
• Control execution flow
• How ?
• Control EIP
• Where ?
• Control it in the stack (for stack smashing)
• Why ?
• User input makes it’s way to the buffers in the stack
• CALL and RET instruction auto-handle what goes in the EIP

11. writing exit shell code
• justQuit.c
• disassemble justQuit and figure out _exit
• exitInAsm.s
• objdump exitInAsm to get the shell code

12. using the exit shell code
• exitShellCode.c
• exitShellCode gdb analysis

13. attacker-vicim demo
• actual shell code - spawning a shell
• check in exitShellCode.c
• attack crafting concept
• default address to anything
• gdb analysis - address change and exploit

14. The $M ? “Who & Why”
• Several flaws in VLC
• GHOST in glibc
• getaddrinfo in glibc
• Several flaws in Apache/IIS/nginx
• All of this for FUN and PROFIT.

15. HUGE Thanks
• Security Tube
• Numerous blogs
• StackOverflow
• Null.co.in
• SecurityXploded
• Sans.org
• LinuxFoundation.org