+- Hack Forums (https://hackforums.net)
+-- Forum: Tech (https://hackforums.net/forumdisplay.php?fid=444)
+--- Forum: Coding (https://hackforums.net/forumdisplay.php?fid=151)
+---- Forum: Software Development (https://hackforums.net/forumdisplay.php?fid=118)
+---- Thread: [C] Buffer Overflow (/showthread.php?tid=5311796)
Buffer Overflow - Passion Fruit - Jun 20, 2016
Hello everyone, I am currently taking a computer security class and one of my assignments is to create an exploit which also is a large portion of my grade. I am not sure where to post this thread exactly to. I really want to pass this class and I am having trouble understanding some things, it would be great if someone could help me one on one... I would be willing to give you something for helping... The project shouldn't take really that long. The project is already made, I just have to make an input that creates an exploit. Thanks guys!
* - Das Kartoffel - Jun 20, 2016
A buffer overflow is when the boundaries of a buffer are exceeded.
Here is an example in C:
If the password is correct, you log in, if it is incorrect you don't. In case password goes over the array limits, you'll get the wrong message error,
but the the overflow of input variable would go over isOK variable changing its value for the decimal value of the chars causing the overflow.
* - 0xDEAD10CC - Jun 20, 2016
(Jun 20, 2016 12:00 PM)Das Kartoffel Wrote: A buffer overflow is when the boundaries of a buffer are exceeded.
Here is an example in C:
If the password is correct, you log in, if it is incorrect you don't. In case password goes over the array limits, you'll get the wrong message error,
but the the overflow of input variable would go over isOK variable changing its value for the decimal value of the chars causing the overflow.
That's a nice modified rip from : http://www.thegeekstuff.com/2013/06/buffer-overflow/
but it doesn't do much with things like ASLR.
OP - Here's a good link: http://insecure.org/stf/smashstack.html
And another: http://www.cse.msu.edu/~enbody/overflow.htm
* - Passion Fruit - Jun 20, 2016
(Jun 20, 2016 04:53 PM)0xDEAD10CC Wrote: That's a nice modified rip from : http://www.thegeekstuff.com/2013/06/buffer-overflow/
but it doesn't do much with things like ASLR.
OP - Here's a good link: http://insecure.org/stf/smashstack.html
And another: http://www.cse.msu.edu/~enbody/overflow.htm
Thank you guys, I understand how to successfully perform a buffer overflow attack and exploit functions
* - Das Kartoffel - Jun 21, 2016
(Jun 20, 2016 04:53 PM)0xDEAD10CC Wrote: That's a nice modified rip from : http://www.thegeekstuff.com/2013/06/buffer-overflow/
Well, not really, it's a file I had made a while ago when I was studying Buffer Overflow, which was rotting on my server.
However, I could effectively have been inspired by that, yup.