-: Buffer overflows, or dissecting the exploit. 2 2
So we talked about, in Gaining Access, 3 3
that there's lots of different ways to gain access 4 4
and one of the most common is a buffer overflow. 5 5
Now, what exactly is a buffer overflow? 6 6
That's what we're gonna cover in this lecture. 7 7
So, first, let's talk about what a buffer is. 8 8
A buffer is just a temporary storage area 9 9
that an program uses to store its data. 10 10
So, for instance, we might have something 11 11
like a phone number we wanna remember, 555-1234. 12 12
Now, if I'm a computer program, I have to constantly be 13 13
remembering that, or I need to put it someplace to store it, 14 14
and that's where a buffer comes in. 15 15
So let's take a example of a Buffer A. 16 16
It's an 8-bit buffer, it's got eight blocks 17 17
for us to put information in. 18 18
Can I put the number 555-1234 in an 8-bit buffer? 19 19
Well, sure I can 20 20
because I can put 555, dash, 1234 and it fits perfectly 21 21
inside an 8-bit buffer. 22 22
What happens, though, with a buffer overflow 23 23
is a program puts more data into the buffer 24 24
than the buffer can hold. 25 25
In our example, instead of using a regular seven-digit 26 26
phone number, what if I end up using the area code as well? 27 27
Well, now, instead of being able to put the entire number 28 28
in A, the buffer I was looking at, 29 29
it's gonna overflow into B. 30 30
And so you'll see it goes 210, dash, 555, dash, 1234. 31 31
So when I read from Buffer A, I'm actually getting 32 32
210, dash, 555, dash. 33 33
And now when I go for my second program to run Buffer B, 34 34
I'm actually getting 1234 and I don't understand 35 35
what that information is from. 36 36
And that's all a buffer overflow does is it actually goes 37 37
beyond what is allowed to be stored in a single area. 38 38
So how does the exploit work? 39 39
Well, the stack is a reserved area of memory 40 40
where the program saves the return address 41 41
when a call instruction is received. 42 42
So as you can see here, we have Buffer 2 43 43
with a Local Variable 2, 44 44
and then we have our shell code that we've put in there. 45 45
And then we put a new pointer to the shell code 46 46
and that might be where the information used to be. 47 47
So when the computer goes back there, it's gonna now see 48 48
the return pointer that was overwritten 49 49
and point to my shell code. 50 50
So as we walk through this, 51 51
this'll make a little bit more sense. 52 52
The stack is organized in a first in, last out structure. 53 53
The first thing that's placed in the stack 54 54
is the last thing that comes out of the stack. 55 55
So what happens is the attacker places 56 56
too much information on the stack, 57 57
and they can change the value of the return pointer 58 58
to carry out their attack. 59 59
So when you go to the new pointer, it's actually gonna 60 60
point to my shell code and not to the internet browser 61 61
or to Microsoft Word. 62 62
So the attacker's code is placed inside the buffer 63 63
and the code that's used to run the commands 64 64
or execute a series of instructions, again, that shell code, 65 65
is then gonna be used. 66 66
Buffer overflows are a complex topic. 67 67
We don't need to understand the nitty gritties 68 68
of how to actually develop them, but the fact is 69 69
that many of the techniques that we use 70 70
inside Metasploit and Metasploit Framework 71 71
are buffer overflow exploits, 72 72
and so you're gonna be using them a lot. 73 73
This I just to give you an idea of how they work 74 74
and the idea is that as you put additional information 75 75
into the memory, when the computer hits that part, 76 76
it's gonna slide into it, go to that new pointer, 77 77
and run that shell code. 78 78
So again, where do buffer overflows fall 79 79
in this grand scheme of things? 80 80
Usually, we're gonna use them in our Gaining Access phase. 81 81
This is an exploit, so we're gonna exploit a vulnerability 82 82
using a buffer overflow. 83 83
Buffer overflows are able to be done 84 84
because of poorly-written software. 85 85
So let's take an example of how this works 86 86
and see if it makes a little bit clearer. 87 87
So there's a wonderful website out there 88 88
called Over the Wire and it's got a lot 89 89
of different hacking challenges. 90 90
It's a live environment where you can connect 91 91
via an SSH connection, a secure shell connection, 92 92
to attempt various binary exploitation challenges, 93 93
including buffer overflows. 94 94
Now, this is beyond the scope of this class, 95 95
it's pretty challenging, but as you start working through 96 96
and developing your skill set, you'll wanna go back 97 97
to this site and play with it because there's a lot 98 98
of great challenges there that can really help bring 99 99
your technical ability up. 100 100
Now, one of the ones we're gonna use here to show 101 101
the buffer overflow is one in the Narnia series 102 102
of exercises at Over the Wire. 103 103
So here's a copy of what the code looks like. 104 104
This is the actual software code. 105 105
It's a very short code, less than 20 lines. 106 106
Now, this is a C program they're writing. 107 107
So I'm gonna walk through it with you 108 108
so if you don't understand C, that's just fine. 109 109
You'll be able to follow along, I promise. 110 110
So don't worry two much about the first two, the includes. 111 111
That's just saying here's how I can talk to the computer 112 112
and receive information, input, output. 113 113
So inside the main program, we have long value, 114 114
that's a variable. 115 115
And they're setting that variable initially 116 116
to 0x41414141, which is a hexadecimal value. 117 117
It's just giving us an initial value to start with. 118 118
Our goal in this program is we wanna be able 119 119
to change the value from x41414141 to xdeadbeef. 120 120
We're gonna set up a buffer of 20 characters. 121 121
Now, the next thing we're gonna look at 122 122
is print to the screen, correct value 123 123
from 41414141 to deadbeef. 124 124
They're gonna print Here's your chance, 125 125
and then they're gonna scanf. 126 126
Scanf just means input, so it's waiting for an input. 127 127
And it's gonna allow us to input from the keyboard 128 128
and it's gonna input that into the buffer. 129 129
Now, how big's that buffer again? 130 130
That's right, we said it was only 20. 131 131
So if we overflow that buffer, we can actually get it 132 132
to do things that we want. 133 133
So the next thing we're gonna do is print out 134 134
what the buffer is. 135 135
So whatever we typed and hit Enter, 136 136
it's gonna print back to us 137 137
and give us the value inside hex. 138 138
And so you'll see that there. 139 139
So if the value that we set was deadbeef, 140 140
then we're gonna get back system bin/sh, which is a shell. 141 141
So that's gonna be our payload. 142 142
Our payload is we're gonna receive 143 143
the command prompt from Linux. 144 144
Otherwise, we're gonna get an answer of WAY OFF, 145 145
you messed up, you didn't do it right, 146 146
and the program's gonna terminate. 147 147
It's a pretty simple program. 148 148
So let's see how that works in the real world. 149 149
So if you thought this was an interesting topic 150 150
and you wanna learn more about it, 151 151
I recommend looking at The Shellcoder's Handbook, 152 152
Hacking: The Art of Exploitation, 153 153
or The Hacker's Playbook 2. 154 154
All three of these books are great resources. 155 155
They'll really help you hone the skills 156 156
that you'll need to work on binary exploitation. 157 157
Again, it's way beyond the scope of this class 158 158
to teach you how to really dig in deep into this. 159 159
This is just to give you a quick overview 160 160
so you understand what a buffer overflow is 161 161
and just see what that example looks like.