The document discusses stack-based buffer overflow vulnerabilities. It begins with an overview of buffer overflows and demonstrates one using the Filecopa FTP server. It explains the stack structure when functions call each other and how a buffer overflow can overwrite the return address on the stack. The document then discusses three methods for finding security bugs: fuzzing, reverse engineering, and source code auditing. It walks through fuzzing the FTP server, determining the vulnerable function through reverse engineering, calculating the offset needed for the instruction pointer, addressing issues of limited space on the stack, and constructing an exploit to gain remote code execution by manipulating the ECX register and jumping to it.

1. Presented By: Amit Malik a.k.a DouBle_Zer0 [email_address]

2. Application overview Debuggers Stack based buffer overflow Demo

3. Filecopa FTP (File Transfer Protocol) server Port 21 Vulnerable to buffer overflow

4. All time favorite ollydbg Why debuggers ? Breakpoints Immunity Debugger Others

6. Discovered in 1972. Computer Security Planning Study. Exploited in 1988. Morris Worm. Published in Phrack in 1994. Aleph One. “ Smashing the stack for fun and profit.”

7. Each function creates its own stack. Caller function stack: known as parent stack. Called function stack: known as child stack. For e.g. main(){ ASM Pseudo: sum(); _main: } 123: push ebp 124: mov ebp,esp 125: sub esp,val 126: call _sum 127: mov esp,ebp 128: pop ebp 129: ret

8. 123: push ebp 124: mov ebp,esp 125: sub esp,val 126: call _sum 127: mov esp,ebp 128: pop ebp 129: ret Ret startup() ebp Locals main() Ret(127) ebp Locals sum() Unallocated space Stack Growth

9. 123: push ebp 124: mov ebp,esp 125: sub esp,val 126: call _sum 127: mov esp,ebp 128: pop ebp 129: ret Ret startup() ebp Locals main() Ret(127) ebp Locals sum() Unallocated space Stack Growth

10. 123: push ebp 124: mov ebp,esp 125: sub esp,val 126: call _sum 127: mov esp,ebp 128: pop ebp 129: ret Ret startup() ebp Locals main() Ret(127) ebp Locals sum() Unallocated space Stack Growth

11. if the input for local variables is greater than the space allocated to them..Then………. Ret startup() ebp Locals main() Ret(127) ebp Locals sum() Unallocated space Stack Growth

12. it will overwrite ret(saved EIP) Ret startup() ebp Locals main() AAAA AAAA AAAAAAAAAAAA… Unallocated space Stack Growth Ret startup() ebp Locals main() jmp esp AAAA AAAAAAAAAAAA… Unallocated space Before After

13. Vulnerable to Buffer Overflow (LIST command) But how we know that server is vulnerable ? Three methods to find out security bugs. Fuzzing Reverse Engineering Source Code Auditing

14. Fuzzing - Send invalid, unexpected, or random data to the inputs of a program. If the program fails/crash, the defects can be noted. Ok lets send invalid input to our server. Still listening ? Umm no..gud. But we don’t know which function is causing this problem.

15. Reverse engineering – is the process of analyzing a subject system to create representations of the system at a higher level of abstraction. Generally used after Fuzzing. Provide in-depth information about target. Sometimes more than source code.

17. Calculate offset for EIP. ESP is pointing to our buffer. Aahhh.. problem we don’t have much space on stack (only 13-14 bytes approx.). Now what ?? Check other registers. ECX is pointing but not directly.

18. But we have some bytes on stack. Use these bytes to adjust ecx and then jump to ecx. We need a jmp esp (address) first. Note: hard coding the stack address is not a good practice. Contains null bytes, address may change. Search the address in DLLs. Because DLLs are static at least for same service packs.

19. ECX is at 00652984 but our data is at 006529cc (on my system). Increase ECX, but a little problem that data is used to overwrite EIP. So increasing ECX to that address gives little space (only 234 bytes approx.) So increase ECX, that will jump over saved EIP.

20. So add ecx,152 bytes. Does it work ?? Nop.. It generate null bytes, can’t use. Ok add cx,152 bytes.. Should work. Else increase bytes. 

21. Now jump to ecx. (instruction). And we have our hellcode ready.