The document discusses buffer overflow attacks used to execute malicious code with unauthorized privileges, manipulating the process stack layout. It explains the mechanics of shellcode, its role in exploiting programs, and highlights prevention strategies such as stack guards and non-executable stacks. Additionally, it emphasizes the importance of security measures against such vulnerabilities in both local and remote contexts.

1. SECURITY BEYOND
COMPARE

3. Buffer Overflow
 Technique to force execution of malicious code
with unauthorized privileges
– launch a command shell
– search local disk or network for sensitive data
– register with command and control network as a
zombie
 Can be applied both locally and remotely
 Attack technique is independent of machine
 architecture and operating system
 Can be tricky to execute, but extremely effective

4. Layout Of Stack
 Grows from high-end address to low-end address
(buffer grows from low-end address to high-end
address);
 Return Address- When a function returns, the
instructions pointed by it will be executed;
 Stack Frame pointer(esp)- is used to reference to local
variables and function parameters.

5. Layout of the Virtual Space of a Process
The
layout of
the
virtual
space of
a
process
in Linux

6. Example
low-end
address
esp
int cal(int a, int b)
{
int c;
c = a + b;
return c;
}
int main ()
{
int d;
d = cal(1, 2);
printf("%dn", d);
return;
}
c
ebp
previous ebp
retaddr(0x0804822)
a(1)
b(2)
Stack
high-end
address

10. Shell code
 Shellcode is defined as a set of instructions which is
injected and then is executed by an exploited program;
 Shellcode is used to directly manipulate registers and
the function of a program;
 Most of shellcodes use system call to do malicious
behaviors;
 System calls is a set of functions which allow you to
access operating system-specific functions such as
getting input, producing output, exiting a process;

13. How to prevent stack buffer
overflow?
 Stack Guard
 In a stack , a canary word is placed after return address
whenever a function is called;
 The canary will be checked before the function returns. If
value of canary is changed , then it indicates an malicious
behavior.
Local Variables
Lower address
Old Base Pointer
Canary Value
ReturnAddres
Arguments
Higher address
Unix Stack Frame

14. Cont.
 Non-Executable stack;
 Return-to-libc exploitation might occur
 Randomization.