计算机科学与工程系

Department of Computer Science and Engineering

CS 315 Computer Security Course

Lab 2: Buffer Overflows

Introduction

In this lab, you will learn how buffer overflows and other memory vulnerabilities are used
to takeover vulnerable programs. The goal is to investigate a program I provide and
then figure out how to use it to gain shell access to systems.

In 1996 Aleph One wrote the canonical paper on smashing the stack. You should read
this as it gives a detailed description of how stack smashing works. Today, many
compilers and operating systems have implemented security features, which stop the
attacks described in the paper. However, it still provides very relevant background for
newer attacks and (specifically) this lab assignment.

Aleph One: Smashing the Stack for Fun and Profit:

http://www1.telhai.ac.il/sources/private/academic/cs/557/2659/Materials/Smashing.pdf

Another (long) description of Buffer Overflows is here:

http://www.enderunix.org/docs/en/bof-eng.txt

Software Requirements

All required files and source code are packed in the provided Lab 2 virtual machine.

- The VMWare Software

• https://www.vmware.com/
- The VirtualBox Software
• https://www.virtualbox.org/wiki/Downloads
• https://www.vmware.com/support/developer/ovf/
• https://www.mylearning.be/2017/12/convert-a-vmware-fusion-virtual-
machine-to-virtualbox-on-mac/
-

Fengwei Zhang – CS 315 Computer Security 1

 - The Kali Linux, Penetration Testing Distribution
- GDB: The GNU Project Debugger
- GCC, the GNU Compiler Collection
- C source file including BOF.c, createBadfile.c, and testShellCode.c

Starting the Virtual Machine

The Kali Linux VM has all the required files. Select the VM named Lab2-
BufferOverflows for this lab.

Login the Kali Linux with username root, and password [TBA in the class].
In the Kali Linux, you should be able to see a folder named Lab2-BufferOverflows. This
file contains all of the source code for the lab 2.

Fengwei Zhang – CS 315 Computer Security 2

Setting up the Environment

There are many protections in current compilers and operating systems to stop stack
attacks like the one we want to do. We have to disable some security options to allow
the exploit to work (Note that the VM image you get has configured the environemnt).
Disable Address Space Layout Randomization
Address Space Layout Randomization (ASLR) is a security features used in most
Operating system today. ASLR randomly arranges the address spaces of processes,
including stack, heap, and libraries. It provides a mechanism for making the exploitation
hard to success. You can configure ASLR in Linux using the
/proc/sys/kernel/randomize_va_space interface. The following values are supported:
0 – No randomization
1 – Conservative randomization
2 – Full randomization
Disable ASLR, run:
$ echo 0 > /proc/sys/kernel/randomize_va_space
Enable ASLR, run:
$ echo 2 > /proc/sys/kernel/randomize_va_space
Note that you will need root privilege to configure the interface. Using vi to modify the
interface may have errors. The screenshot below shows the value of
/proc/sys/kernel/randomize_va_space
However, this configuration will not survive after a reboot. You will have to configure this
in sysctl. Add a file /etc/sysctl.d/01-disable-aslr.conf containing:
kernel.randomize_va_space = 0
This will permanently disable ASLR.

Fengwei Zhang – CS 315 Computer Security 3

The screenshot below shows you the ASLR configuration. You can open a terminal
and try it out.

Set compiler flags to disable security features

When you compile the vulnerable program (explain in the next section) with gcc, use the
following compiler flags to disable the security features.
-z execstack
Turn off the NX protection to make the stack executable
-fno-stack-proector
Remove StackGuard that detects stack smashing exploitations
-g
Enable the debugging symbols

Fengwei Zhang – CS 315 Computer Security 4

Overview

The goal of the exploitation is to teach you how buffer overflows work. You must gain a
shell by passing a malicious input into a vulnerable program. The vulnerability
takes as input a file named "badfile". Your job is to create a badfile that results in the
vulnerable program producing a shell. Note that you also have a nop sled to make the
vulnerability work even if your shellcode moves by a few bytes. In the Lab2-
BufferOverflows folder, it contains the C files you need to use. The screenshot below
shows that.

BOF.c
In BOF.c there is an un-bounded strcpy, which means anything that is not null-
terminated will overwrite the buffer boundaries and (hopefully) put some information into
the stack that you will design. Your exploit must work with my version of BOF.c (can't
change it to make your code work).

Fengwei Zhang – CS 315 Computer Security 5

To compile BOF.c, you need to add the compile flags mentioned.
$ gcc –g –z execstack –fno-stack-protector BOF.c –o BOF

Fengwei Zhang – CS 315 Computer Security 6

testShellCode.c
This program simply lets you test shell code itself. There are a lot of different "shell
codes" you can find or create, and this is a good way to see what they do, and if they'll
work for you (on your operating system).
The actual shellcode you are using is simply the assembly version of this C code:

#include <stdio.h>
int main( ) {
char *name[2];
name[0] = "/bin/sh";
name[1] = NULL;
execve(name[0], name, NULL);
}

Fengwei Zhang – CS 315 Computer Security 7

createBadfile.c
This program writes out "badfile", however currently it is just full of nops (no ops). You
need to modify it to place your shell code into it and cause the code to jump to the
shellcode. The shellcode included already in badfile (as a char array) does work. You
shouldn't need to modify it, but you're welcome to.

To compile the testShellCode.c and createBadfile.c, you do not need to add the compile
flags mentioned early. You can just simplely compile it with gcc

Fengwei Zhang – CS 315 Computer Security 8

Starting the Exploitation
There are really two challenges in the lab. To execute the shellcode you want to
overwrite the return address in the bufferOverflow() function. You must make the return
address of that function point to your shellcode.
1. You need to figure out what memory address the return address is stored in.
2. Then you need to figure out the address of your shellcode in memory, and write the
shellcode's address into the return address you found in step 1.
In the lab instruction, I will give you some hints for the step 1.

Finding Return Address on the Stack

In order to find the return address on stacks, we first use GDB, The GNU Project
Debugger, to take a look at the assembly code. You can find more information about
GDB from here: https://www.gnu.org/software/gdb/ Note that you can also use tool,
objdump, to read the assembly code.

$ gdb BOF

Fengwei Zhang – CS 315 Computer Security 9

First, we disassemble the main() function of the BOF program. We find the
bufferOverflow() function in the main() function (type disas main in the GDB). Then, we
disassemble the bufferOverflow() function, which has a vulnerability in it.
$ (gdb) disas main
$ (gdb) disas bufferOverflow

You need to understand the assembly code to find where the return address is on the
stack. Next, type run in the GDB to execute the BOF program.
$ (gdb) run

As we expected, the BOF program generates an exception, segmentation fault. The

Instruction Pointer (EIP) is 0x90909090. This is because we put NOP sleds on the
badfile that overflows the buffer in the BOF program.

Fengwei Zhang – CS 315 Computer Security 10

You also can see more register information by execute info register in the GDB
$ (gdb) info register

Note that you can always type help in the GDB to learn the commands.

Fengwei Zhang – CS 315 Computer Security 11

Assignments for the Lab 2

A zip file containing:

1. Your updated createBadfile.c that generates the input for the BOF program
2. A copy of the badfile. This must gengerate a shell when BOF runs from the
command line in the VM
3. A screenshot of using BOF program to gain a shell (see simple screenshot
below)
4. A text file with answers to the following questions:
a. What happens when you compile without “-z execstack”?
b. What happens if you enable ASLR? Does the return address change?
c. Does the address of the buffer[] in memory change when you run BOF
using GDB, /home/root/Desktop/Lab2-BufferOverflows/BOF, and ./BOF?

Happy Exploiting!

Fengwei Zhang – CS 315 Computer Security 12