5 ms·
Smashing the stack for fun and profit
- mahmud 17y agoA classic. The most referenced underground paper, ever! 112,605 documents found http://citeseerx.ist.psu.edu/search?q=Smashing+The+Stack+For+Fun+And+Profit&submit=Search&sort=rel&ic=1 http://citeseerx.ist.psu.edu/search?q=Smashing+The+Stack+For...
- lg 17y agoAh, fond memories of my computer security class, where this was assigned reading. We also studied format string vulnerabilities: http://julianor.tripod.com/bc/formatstring-1.2.pdf http://julianor.tripod.com/bc/formatstring-1.2.pdf
- alecco 17y agoIf we are going down memory lane, check out JP's "Advanced Doug lea's malloc exploits" http://www.phrack.org/issues.html?issue=61&id=6#article http://www.phrack.org/issues.html?issue=61&id=6#article
- shykes 17y agoAnd you might as well read Doug Leas's paper, too http://g.oswego.edu/dl/html/malloc.html http://g.oswego.edu/dl/html/malloc.html
- scythe 17y agoIn one of my freshman CS courses, one of our last assignments was to read this paper (as well as a more approachable tutorial written by our TAs) and carry this out on a toy architecture (LC3) that we had been working with for the whole course. It was probably the most interesting assignment we had that semester.
- Oompa 17y agoI had a similar class. CS2110 at Georgia Tech. I will never forget it :)
- alexgartrell 17y agoAt CMU: http://csapp.cs.cmu.edu/public/buflab.pdf http://csapp.cs.cmu.edu/public/buflab.pdf Edit: Changes since 2002 -- Assignment is now individual -- "For Fun" stage is now mandatory And here are the other labs: http://csapp.cs.cmu.edu/public/labs.html http://csapp.cs.cmu.edu/public/labs.html Architecture lab has fallen by the wayside, and Performance Lab is done sometimes (depending upon the taste of the instructors)
- scythe 17y agoFunny, I was referring to the same class! When did you take it?
- sown 17y agoFor a lot of these tutorials to work, you also have to turn off SELinux or any other stack protection.
- petsos 17y agoThis paper was written 7 years before SELinux was merged.
- sown 17y agoYes. And the examples won't always work on modern linux distros depending on configuration
- petsos 17y agoWell, I would hope so that exploiting techniques written 13 years ago won't always work on modern distros.
- jacquesm 17y agoYour hope is unfortunately misplaced, the 'always' is the operative word. Probably we will never see the end of this kind of attack until we switch to some radically different architecture.
- jrockway 17y ago"Managed code."
- jacquesm 17y agoThat's limited to the microsoft platform for now isn't it ? Or does the term also apply to java ? One of the things that I've been wondering about, that maybe you can answer is this: If languages such as javascript, lisp, python and so on (as opposed to say C) treat functions as first class citizens, doesn't that open up a completely new can of worms with respect to security ?
- tptacek 17y agoIt's interesting to compare exploit tech from today to how simple things were back in '97. In '97, a complex exploit meant you couldn't have lowercase ASCII equivalents in your shellcode. Now, you scan the target for info leaks that will disclose stack cookies, and spray the heap to increase the odds that you'll hit your exploit in randomized memory, and forge stack frames that will return to mprotect or VirtualProtect, and and and. So much of "security research" over the last 10 years has basically danced around a fundamental fact: if you lose control of the runtime memory of your program, you lose control of the whole program.
- swolchok 17y agoIf you get lucky, your target won't bother with all these new-fangled protections and run on WinXP (no ASLR) and the only thing you'll have to contend with is non-executable stack. Our original exploit for Green Dam used a heap spray only to make writing it easier, and the underground exploit uses a really awful behavior of IE w.r.t. running .NET DLLs -- http://www.milw0rm.com/exploits/8938 http://www.milw0rm.com/exploits/8938 . Other than that, there are no defenses to speak of.
- Zarathu 17y agoWell, that's sort of true. You don't necessarily have to keep track of the runtime memory as long as the buffer is large enough. You could find the address of a JMP %ESP instruction in the victim OS (0x7C8369D8 in XP SP 2) and place it before a NOPsled. A typical buffer overflow, for example: [AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA][0x7C8369D8][NOP][shellcode] You do, of course, need to make sure you don't have any \0 bytes in your shellcode, but that's always been the case.
- ecq 17y agowow I still remember this. a classic by Aleph One. Another tutorial pre-dates this by ~1 year. It was written by mudge. http://biblio.l0t3k.net/b0f/en/howto_write_buffer.txt http://biblio.l0t3k.net/b0f/en/howto_write_buffer.txt
- tptacek 17y agoThe first published x86 shellcode-style overflow was splitvt, which was announced "officially" just weeks after this tutorial was dated: http://seclists.org/bugtraq/1995/Dec/2 http://seclists.org/bugtraq/1995/Dec/2 (My business partner co-authored it). The first shellcode-style buffer overflow (besides the rtm worm) was Thomas Lopatic's HPUX HTTPd vulnerability from a few months earlier: http://seclists.org/bugtraq/1995/Feb/109 http://seclists.org/bugtraq/1995/Feb/109 There was a frantic race to get the first overflow out after 8lgm capped off their run of zero-days with an announcement of a Sendmail 8.6.12 remote that relied on a syslog() overflow (yes, in 1995, syslog(3) had an overflow). I was sitting next to Pieter when he wrote part of the tutorial you linked to. I was pretty young (maybe 19?) but even so, it was a pretty electric time to be involved in security.
- sp332 17y ago(OT) Did you know there's a petition to get mudge to be US Cyberczar? http://www.ipetitions.com/petition/mudge4cyberczar/ http://www.ipetitions.com/petition/mudge4cyberczar/
- wclax04 17y agoI remember reading this paper as an undergrad at Rutgers. We had to do a stack smashing project based on this with different stack protection methods (canaries/ASLR) This was probably one of the most important things I learned in school.
- jacquesm 17y agoFunny how the first example contains a subtle bug, the string termination is never done, if the stack wasn't zeroed prior to running that program, you may not only overflow 'buffer' on purpose, you may overflow it a lot further than you'd think by just reading the code. large_string[255] = 0; Would solve that.
- omouse 17y agoAnd the lesson is, try to avoid using C :)
- tptacek 17y agoAnd C++.
- MtL 17y agoFunny, I just re-read that paper yesterday =) Aleph One is a hero in my eyes, he made my childhood much more interesting.
- c00p3r 17y agoOh, that romantic feeling from the boyhood... =)
- haupt 17y agoI remember reading this and finding an error in one of the examples. In addition to learning about the stack, I also realized that superheroes are human, too. <3