Graduate School of Information Security MIN CHUL, KIM HACKING – THE ART OF EXPLOITATION Ox28O BUILDING ON BASIC - ANALYSIS SOURCE CODE.

Slides:



Advertisements
Similar presentations
In the last Session… ls -l command seven fields nine permissions of a file ls -ld file ownership file permissions (three-tiered file protection system)
Advertisements

Linux User Management Image source: cover of UNIX System Administration Handbook.
Smashing the Stack for Fun and Profit
IT Security Doug Brown Jeff Bollinger. What is security? P.H.P. People Have Problems Security is the mitigation and remediation of human error in information.
File Security. Viewing Permissions ls –l Permission Values.
Home: Phones OFF Please Unix Kernel Parminder Singh Kang Home:
Linux+ Guide to Linux Certification, Second Edition
User Accounts and Permissions Chapter IV / Part II.
Information Networking Security and Assurance Lab National Chung Cheng University Flawfinder.
Linux Linux File System.
Information Networking Security and Assurance Lab National Chung Cheng University 2004/03/031 A Real World Attack: wu-ftp Cao er kai ( 曹爾凱 )
CSCI 243: C & UNIX Kirk Anne South 124A
Lecture 02CS311 – Operating Systems 1 1 CS311 – Lecture 02 Outline UNIX/Linux features – Redirection – pipes – Terminating a command – Running program.
Linux File Security. What is Permission ? Specifies what right are granting to users to access the resources available in the computer. So that important.
Hardware RAID versus Software RAID CSE598D Youngjae Kim February 15, 2007.
Guide to Operating System Security Chapter 5 File, Directory, and Shared Resource Security.
Taeho Oh/PLUS 3rd CONCERT Workshop Nov Intrusion demonstration Part I Postech PLUS Taeho Oh (PLUS015)
Filesystem Hierarchy Standard (FHS) –Standard of outlining the location of set files and directories on a Linux system –Gives Linux software developers.
Files & Directories Objectives –to be able to describe and use the Unix file system model and concepts Contents –directory structure –file system concepts.
Implementations of the ADT Stack Chapter 7 Data Structures and Problem Solving with C++: Walls and Mirrors, Carrano and Henry, © 2013.
www.ursamajorconsulting.com1 Avoid Getting Hacked Joomla! Web Security Northern Virginia Joomla Users Group January 2012 Dorothy Firsching, Ursa.
Python File Handling. In all the programs you have made so far when program is closed all the data is lost, but what if you want to keep the data to use.
File Permissions. What are the three categories of users that apply to file permissions? Owner (or user) Group All others (public, world, others)
Linux+ Guide to Linux Certification, Second Edition
IT2204: Systems Administration I 1 6b). Introduction to Linux.
Penetration Testing Training Day Penetration Testing Tools and Techniques – pt 1 Mike Westmacott, IRM plc Supported by.
PROGRAMMING PROJECT POLICIES AND UNIX INTRO Sal LaMarca CSCI 1302, Fall 2009.
File Permission and Access. Module 6 File Permission and Access ♦ Introduction Linux is a multi-user system where users can assign different access permission.
Linux Security. See who's logged in 1) w (more information) 2) who (less information)
EMT 2390L Lecture 5 Dr. Reyes Reference: The Linux Command Line, W.E. Shotts.
UNIX Security From UNIX SYSTEMS Programming, Robbins & Robbins Benjamin Brewster, OSU 2006.
Linux+ Guide to Linux Certification, Third Edition
Linux+ Guide to Linux Certification, Third Edition
The home page of United States Department of Justice Was hacked on August 17, 1996.
CSE 341, S. Tanimoto Lisp CGI - 1 Lisp CGI Programming for the Web Web servers can invoke Lisp to “intelligently” create web pages on the fly. We will.
Container e-seal implementation at Custom. Problems: Although cost effective – very limited function easy to be cut and replaced, can not really stop.
Unix Security Assessing vulnerabilities. Classifying vulnerability types Several models have been proposed to classify vulnerabilities in UNIX-type Oses.
Chapter 8 File System Security. File Protection Schemes Login passwords Encryption File Access Privileges.
Accessing the Lab. Putty Available via links on course page Creates secure (SSH) command line session between your machine and SCS network Uses tunnelling.
Workflow Demo: Upload, Review and Approve. Cpay : Users & Functionalities Customer AdministratorCustomer AuthorizerUploaderReviewerApproverInterceptor.
Authorization vs. Authentication Authentication is the process of proving identity to the system –login Authorization happens after authentication. It.
EGEE-III INFSO-RI Enabling Grids for E-sciencE Apr. 25, Grid Computing Hands On Training for Users Faculty of Sciences, University.
The Saigon CTT Chapter 10 Managing Users. The Saigon CTT  Objectives  Define the requirements for user accounts  Explain group and group accounts 
CSCI 330 The UNIX System Unit V Permissions. all access to directories and files is controlled UNIX uses discretionary access control (DAC) model each.
SCSC 455 Computer Security Chapter 3 User Security.
ITEC 502 컴퓨터 시스템 및 실습 Chapter 10-2: File Systems Mi-Jung Choi DPNM Lab. Dept. of CSE, POSTECH.
Web Security Firewalls, Buffer overflows and proxy servers.
File System Security ls -l. First Columm d = directory l = symbolic link b = block special file c = character special file p = fifo (or named pipe) special.
You must study this PowerPoint, play the Rags to Riches game and take and pass the quiz before continuing with class assignments.
Introduction Contain two or more CPU share common memory and peripherals. Provide greater system throughput. Multiple processor executing simultaneous.
Access Control. Many models Traditional Unix model Windows model Role-based access control (SE Linux)‏ Access control for confidentiality (Bell-La Padula.
This courseware is copyrighted © 2016 gtslearning. No part of this courseware or any training material supplied by gtslearning International Limited to.
Experiment No 4 Prepared by, Mr. Satish Pise. Objectives View the /etc/passwd file and describe its syntax. View the /etc/shadow file and describe its.
Linux Filesystem Management
Buffer Overflows ...or How I Learned to Never Trust the User
Project CTF Yeganeh Safaei Arizona State University
Chapter 3 Maintaining Security
Chapter 8 File Security.
File system(conti..) Lecture November 2018.
Permission and CHMOD.
Homework & Class review
Presented by, Mr. Satish Pise
Security and File Permission
The Linux Command Line Chapter 9
UNIX Reference Sheets CSE 2031 Fall 2010.
Smashing the Stack for Fun and Profit
Encryption and Hacking
Figure 6-13: Managing Permissions
Ustaza. Imtithal Alnour Saeed & Ustaza Sana AL-Hwishel
The Linux Command Line Chapter 24
Presentation transcript:

Graduate School of Information Security MIN CHUL, KIM HACKING – THE ART OF EXPLOITATION Ox28O BUILDING ON BASIC - ANALYSIS SOURCE CODE

CONTENTS Simplenote.c Bitwise.c Functioncontrol_flags.c UserID_demo.c Notetaker.c Notesearch.c Time_example.c Functionponter_example.c Rand_example.c Game_of_chance.c

SIMPLENOTE.C Permission part

IMPLEMENT SIMPLENOTE.C

BUFFER OVERFLOW memory File save location Buffer destination Buffer start

IMPLEMENT SIMPLENOTE.C

BITWISE.C i12a=i&2b=i&

IMPLEMENT BITWISE.C

FUNCTIONCONTROL_FLAGS. C ♧ mask shift ♧ value=0

IMPLEMENT FCNTL_FLAGS.C

FILE PERMISSIONS -rw-r-r--1nare :57simplenote.c permissionlinkusergroupfile sizedatetimefile name Detail

FILE PERMISSIONS ownershipgroupothers r read w write x operate rwxrwx Change ownership  chown [ownership][.group] [file name] Change permission  chmod [number or symbol] [file name] -rw-r-r--1nare :57simplenote.c permissionlinkusergroupfile sizedatetimefile name Symbol uownership+add permission ggroup-del permission oothers=only permission aallsfile owned user

USER IDs Change shell  user login shell

USER IDs Locked

HACKING.h Making header file Easy to use function

NOTETAKER.c

IMPLEMENT NOTETAKER.c User id

NOTESEARCH.c

IMPLEMENT NOTESEARCH.c Independent

TIME_EXAMPLE.C

TIME_EXAMPLE2.C

IMPLEMENT TIME_EXAMPLE2.C

FUNCTION POINTER.C

RAND_EXAMPLE.C

Different

GAME OF CHANCE.C

PLAY‘GAME OF CHANCE’ I didn’t win the game. T_T