Narrator: We're going to being by opening our 2 2
Colinux machine, and opening our terminal. 3 3
And there, we're going to ssh into the server. 4 4
Using our username narnia0@narnia.labs.overthewire.org. 5 5
Using our password of narnia0. 6 6
Once we connect, we're going to cd 7 7
into the narnia directory. 8 8
Once we've done that, we need to look at the actual 9 9
program that we're trying to exploit. 10 10
In our case, narnia0.c. 11 11
Do do that we're going to end up doing cat narnia0.c. 12 12
And the program's contents will get shown to our screen. 13 13
So in this point we can see the actual code itself. 14 14
We can see it's a C program with our standard IO headers, 15 15
and our standard IO libraries. 16 16
Notice the long value there, 0 times 41414141, 17 17
and our char, our character, our buffer, is 20 characters. 18 18
So if we put something over 20 characters, 19 19
we should be able to do a buffer overflow in this case, 20 20
because it will be greater than what it's expecting. 21 21
Notice in the program the value equals deadbeef, 22 22
then it will give us a shell then slash sh. 23 23
So what we're trying to do is do an overflow 24 24
and then write into memory 25 25
the hexadecimal value of deadbeef. 26 26
So here we're going to execute the program, 27 27
and we're going to put in an input. 28 28
In this case I'm going to put a bunch of A's. 29 29
I'm counting carefully to put 20 A's, and four B's. 30 30
What happened is I overflowed the buffer with the A's, 31 31
and so the value got overwritten from 41414141 32 32
to 42424242, which was the hex representation of those B's. 33 33
So at this point I'm going to write a short python script 34 34
that will put 20 A's followed by the hexademical 35 35
characters that I want, in this case deadbeef. 36 36
Now I have to put it in a little bit backwards, 37 37
and that's because of the fact that this machine 38 38
is using first in first out, or last in first out 39 39
architecture based on this machine. 40 40
So in this case I'm going to use the /'ef/'ee/'ad/'ee 41 41
And then I'm going to pipe that output 42 42
into the narnia.c program, 43 43
narnia0.c program. 44 44
Notice my value has been overwritten with deadbeef 45 45
just like we wanted. 46 46
Now notice when I run this python script 47 47
my value does change, 48 48
but nothing else happens, I'm just returned to the shell. 49 49
And that's because I executed the shell. 50 50
Now what I want to do is have it 51 51
so that when I execute the shell it does something for me. 52 52
In this case, I want it to show me 53 53
what the password is for this stage 54 54
which allows me going to stage two. 55 55
The way I'll do that is by using an echo command. 56 56
And so in this case, I'll use the same python script 57 57
I used, and then put a semicolon 58 58
echo'cat/etc/narnia_pass/narnia1 59 59
Which gives me the code to go into 60 60
the next level, which would be narnia two's level. 61 61
Then I do the pipe and run the program of narnia/narnia0 62 62
as you can see my buffer gets overwritten, 63 63
deadbeef is written to the value, 64 64
which then goes to execute the shell, 65 65
in this case executing my command, 66 66
the cat of the password for narnia1. 67 67
And I get the answer to the riddle 68 68
which was E-F-E-I-E-I-E-D-A-E. 69 69
If I go now over the wire and use narnia1 as my username, 70 70
and I use that as my password E-F-E-I-E-I-E-E-A-E 71 71
I can then go to challenge number two. 72 72
And that's just a very simple example of how 73 73
a buffer overflow works. 74 74
In this case we overrode a 20 character memory allocation, 75 75
pushing in those last four characters, 76 76
which ever we put in there, into the memory. 77 77
In this case matching up the composite overrun 78 78
to run our n/sh or our shell.