2. What is exactly Exploit writing?  Writing a piece of code which is capable of exploit the vulnerability in the target software.

3. What is the impact of Exploits?  Remote code execution : leads to running malicious application in victim’s system  Denial of Service attacks  …

5. What I am going to explain today…  Intro to Stack  Stack Buffer Overflow attack  Demo

6. Intro to Stack  A piece of the Process memory  Used for storing variables, function call,return address,…  Allocated by the OS, for each thread (when the thread is created). When the thread ends, the stack is cleared as well.  The size of the stack is defined when it gets created and doesn’t change  Increase to lower address( 0041008  0041004  0041002…)

7. void vulnfun(char *in) { char buf[10]; } int main(int argc,char *argv[]) { vulnfun(argv[1]); return 0; }

8. ................ Stack Pointer (ESP) Arguments for Main Function Return Address Local variables of Main Stack Frame for Main Arguments for VulnFun function ( argv[1] ) Save previous Base Pointer Stack Frame for Vulnfun Save previous Base Pointer Return Address Base Pointer (EBP) of main Base Pointer (EBP) of VulnFun 0xFFFFFFFF 0x00000000 Local Variable of VulnFun( buf) Stack Pointer (ESP)

11. Stack Buffer Overflow  Result of giving Input that is longer than the memory allocated for the variable  For instance, “Char a[10]” can store 10 characters. If you try to enter more than 10 characters that results in overflow

12. ................ Stack Pointer (ESP) Arguments for Main Function Return Address Local variables of Main AAAAAAA Arguments for VulnFun function ( argv[1] ) AAAAAAA Save previous Base Pointer Return Address Base Pointer (EBP) of main Base Pointer (EBP) of VulnFun Local variable “buf” Saved Base pointer overwritten

13. ................ Stack Pointer (ESP) Arguments for Main Function Return Address Local variables of Main AAAAAAA Arguments for VulnFun function ( argv[1] ) AAAAAAA Save previous Base Pointer 0x004012C9 Base Pointer (EBP) of Main Base Pointer (EBP) of VulnFun Local variable “buf” Saved Base pointer overwritten Return Address modified by exploiting the overflow

14. Thank You