Buffer Overflow

Introductions

• Buffer Overflow Attack - Computerphile: https://www.youtube.com/watch?v=1S0aBV-Waeo
• Binary Exploitation - Buffer Overflow Explained in Detail: https://0xrick.github.io/binary-exploitation/bof1/

Testing tools

• Program to detect the existence of remote / local stack-based buffer-overflow vulnerabilities (FTP, IMAP, POP3 and SMTP): https://github.com/iricartb/buffer-overflow-vulnerability-services-tester-tool
• https://hakin9.org/bovstt-buffer-overflow-vulnerability-services-tester-tool/

Generating Random Patterns

locate pattern_create
pattern_create.rb 2700
pattern_offset.rb 39624438

Bad characters

• Use all hex combinations and append that to buffer (\x01\x02)

Finding Gadgets

When main program is not memory protected

EDB -> Op code searcher

Example : ESP -> EIP

When main program is memory protected

• Find a var that loads a memory location into and offset that
• Find a module with no memory protection and memory module address (base) does not contain any bad characters

!mona modules

• Open modules and open the selected module (e)

• Search for a instructions

  • JUMP ESP
  • PUSH ESP
  • RTN

• If not found look at modules list (m) and check in other sections (if DEP or ASLR is not enabled)

nasm_shell
  > jmp esp (to get get opcode)
  > FF E4

!mona find -s "\xff\xe4" -m slmfc.dll