Stack buffer overflow.

Slides:

Advertisements

Similar presentations

For(int i = 1; i

Advertisements

Buffer Overflow Prabhaker Mateti Wright State University.

Course Introduction Bryce Boe 2013/06/25 CS24, Summer 2013 C.

Exploring Security Vulnerabilities by Exploiting Buffer Overflow using the MIPS ISA Andrew T. Phillips Jack S. E. Tan Department of Computer Science University.

Recitation 4: 09/30/02 Outline The Stack! Essential skill for Lab 3 –Out-of-bound array access –Put your code on the stack Annie Luo

Array_strcpy void array_strcpy(char dest[], char src[]) { int i = 0; while (src[i] != '\0') { dest[i] = src[i]; i++; } dest[i] = '\0'; }

Computer Forensics Use of Malicious Input. Buffer and Heap Overflow Attacks Standard Tool to Break Into Systems. Used for Access Escalation. Very Common.

Secure Programming Lai Zit Seng November A Simple Program int main() { char name[100]; printf("What is your name?\n"); gets(name); printf("Hello,

Buffer Overflows By Tim Peterson Joel Miller Dan Block.

Gabe Kanzelmeyer CS 450 4/14/10.  What is buffer overflow?  How memory is processed and the stack  The threat  Stack overrun attack  Dangers  Prevention.

Stack buffer overflow

Buffer Overflow By: John Quach and Napoleon N. Valdez.

C Review Pointers, Arrays, and I/O CS61c Summer 2006 Michael Le.

Computer Security Buffer Overflow lab Eu-Jin Goh.

Advanced Programming in the UNIX Environment Hop Lee.

Control hijacking attacks Attacker’s goal: – Take over target machine (e.g. web server) Execute arbitrary code on target by hijacking application control.

Command line arguments. – main can take two arguments conventionally called argc and argv. – Information regarding command line arguments are passed to.

Computer Forensics Use of Malicious Input. Buffer and Heap Overflow Attacks Standard Tool to Break Into Systems. Used for Access Escalation. Very Common.

Security Exploiting Overflows. Introduction r See the following link for more info: operating-systems-and-applications-in-

An anti-hacking guide.  Hackers are kindred of expert programmers who believe in freedom and spirit of mutual help. They are not malicious. They may.

CAP6135: Malware and Software Vulnerability Analysis Buffer Overflow : Example of Using GDB to Check Stack Memory Cliff Zou Spring 2011.

CSE 332: C++ functions Review: What = and & Mean In C++ the = symbol means either initialization or assignment –If it’s used with a type declaration, it.

Introduction to Pthreads. Pthreads Pthreads is a POSIX standard for describing a thread model, it specifies the API and the semantics of the calls. Model.

Chapter 6 Buffer Overflow. Buffer Overflow occurs when the program overwrites data outside the bounds of allocated memory It was one of the first exploited.

UNIVERSITY OF SOUTH CAROLINA Department of Computer Science and Engineering Stack allocation and buffer overflow CSCE 531 Presentation by Miao XU

Exploiting Buffer Overflows on AIX/PowerPC HP-UX/PA-RISC Solaris/SPARC.

Buffer Overflow Computer Organization II 1 © McQuain Buffer Overflows Many of the following slides are based on those from Complete Powerpoint.

Buffer Overflows Lesson 14. Example of poor programming/errors Buffer Overflows result of poor programming practice use of functions such as gets and.

Packet Vaccine: Black-box Exploit Detection and Signature Generation

1 Carnegie Mellon Recitation : Introduction to Computer Systems Recitation 15: December 3, 2012 Daniel Sedra Section C.

Current Assignments Homework 3 is due tonight. Iteration and basic functions. Exam 1 on Monday.

University of Virginia Department of Computer Science1 Applications of Software Dynamic Translation Jack Davidson University of Virginia February 27, 2002.

University of Washington Today Happy Monday! HW2 due, how is Lab 3 going? Today we’ll go over:  Address space layout  Input buffers on the stack  Overflowing.

4.1 Silberschatz, Galvin and Gagne ©2005 Operating System Concepts Project1: Unix Shell with History Feature Goals Descriptions Methodology Submission.

Stack-based buffer overflows Yves Younan DistriNet, Department of Computer Science Katholieke Universiteit Leuven Belgium

Weeks 5-6 Pointers and Arrays Basic pointer type Pointers and Arrays Address arithmetic Pointer Arrays User-defined data types Structures Unions Pointers.

What is exactly Exploit writing?  Writing a piece of code which is capable of exploit the vulnerability in the target software.

A Tool for Pro-active Defense Against the Buffer Overrun Attack D. Bruschi, E. Rosti, R. Banfi Presented By: Warshavsky Alex.

OPERATING SYSTEMS 1 - HARDWARE PIETER HARTEL 1. Hardware 2.

CS 155 Section 1 PP1 Eu-Jin Goh. Setting up Environment Demo.

1988 Morris Worm … estimated 10% penetration 2001 Code Red … 300,00 computers breached 2003 Slammer/Sapphire … 75,00 infections in 10 min Zotob …

CS 3214 Computer Systems Godmar Back Lecture 7. Announcements Stay tuned for Project 2 & Exercise 4 Project 1 due Sep 16 Auto-fail rule 1: –Need at least.

CAP6135: Malware and Software Vulnerability Analysis Buffer Overflow : Example of Using GDB to Check Stack Memory Cliff Zou Spring 2014.

Current Assignments Project 3 has been posted, due next Tuesday. Write a contact manager. Homework 6 will be posted this afternoon and will be due Friday.

“Success consists of going from failure to failure without loss of enthusiasm.” Winston Churchill.

Heap Overflows. What is a Heap? malloc(), free(), realloc() Stores global variables Automatic memory allocation/deallocation Allocated at runtime Implemented.

Program Execution in Linux David Ferry, Chris Gill CSE 522S - Advanced Operating Systems Washington University in St. Louis St. Louis, MO

Buffer Overflow By Collin Donaldson.

Webserver w/user threads

Command line arguments

Program Execution in Linux

CSE565: Computer Security Lecture 27 Program Security

Objective Explain basic fuzzing with concrete coding example

SEED Workshop Buffer Overflow Lab

Advanced Buffer Overflow: Pointer subterfuge

Stack buffer overflow.

Operating Systems 7 - memory

Dynamic Memory A whole heap of fun….

CAP6135: Malware and Software Vulnerability Analysis Buffer Overflow : Example of Using GDB to Check Stack Memory Cliff Zou Spring 2015.

CNT4704: Analysis of Computer Communication Network Buffer Overflow : Example of Using GDB to Check Stack Memory Cliff Zou Fall 2011.

Buffer Overflows.

GSM Global System for Mobile Communications, 1992

Malware and Software Vulnerability Analysis Fuzzing Test Example Cliff Zou University of Central Florida.

CAP6135: Malware and Software Vulnerability Analysis Buffer Overflow : Example of Using GDB to Check Stack Memory Cliff Zou Spring 2016.

Structures in c By Anand George.

CAP6135: Malware and Software Vulnerability Analysis Buffer Overflow : Example of Using GDB to Check Stack Memory Cliff Zou Spring 2013.

FIGURE Illustration of Stack Buffer Overflow

CAP6135: Malware and Software Vulnerability Analysis Buffer Overflow : Example of Using GDB to Check Stack Memory Cliff Zou Spring 2010.

Presentation transcript:

Stack buffer overflow

Stack frame layout

#include <string.h> void foo (char *bar) { char c[12]; strcpy (c, bar); //no bound } int main (int argc, char **argv) foo(argv[1]);

#include <string.h> void foo (char *bar) { char c[12]; strcpy (c, bar); //no bound } int main (int argc, char **argv) foo(argv[1]);

#include <string.h> void foo (char *bar) { char c[12]; strcpy (c, bar); //no bound } int main (int argc, char **argv) foo(argv[1]);

Demo Linux

Homework 3 Due next week. Tuesday?? Stack buffer overflow problem, very similar to what we have described today. Demo.

Linker Exercise 2.31