Lunchtime Hackers Buffer Overflow Intro

Some Memory Stuff to Understand Stack – a segment of memory set aside for a program (kinda like scratch space) Buffer – just a sement of contiguous memory (not broken up in pieces) Big Endian – A method of byte ordering (longer history, common in mainframes) The hex string AB CD EF will be stored in memory as AB CD EF Little Endian – Different method of byte order interpretation (Your laptop does this) The hex string AB CD EF will be stored in memory as EF CD AB

Linux Permissions Refresher If you look at Linux perms in the terminal, they’ll look like this: -rwxrwxrwx <file info> <filename> We’re interested in the leftmost portion. It can be broken down into a few different parts: - rwx rwx rwx First Portion: directory? Owner Perms Group Perms World Perms

SUID-bit Allows a program to run as another person Person usually has higher permissions than person running program Allows lower permissioned person to do stuff they wouldn’t normally In a terminal will look like this: - r - s - -x - - - Instead of an ‘X’, there is an ‘S’

The Code: Set variable called val Set aside buffer of 20 bytes #include <some libraries> int main(){ long val=0x41414141; char buf[20]; printf("Correct val's value from 0x41414141 -> 0xdeadbeef!\n"); printf("Here is your chance: "); scanf("%24s",&buf); printf("buf: %s\n",buf); printf("val: 0x%08x\n",val); if(val==0xdeadbeef) system("/bin/sh"); else { printf("WAY OFF!!!!\n"); exit(1); } return 0; Set variable called val Set aside buffer of 20 bytes Prints to standard out Reads in 24 bytes (rather than 20 bytes) If val = 0xDEADBEEF, program drops into a shell