[Skidsuper]

A buffer overflow occurs when more data is written to a buffer than it can hold, causing the excess data to overwrite adjacent memory, which can lead to crashes or, more dangerously, can be exploited for malicious purposes such as remote code execution.

Example of Remote Code Execution

To illustrate this with an example, let's consider a hypothetical vulnerable C program (vulnerable_program.c) which reads user input into a fixed-size buffer without proper bounds checking:

Code

#include <stdio.h>
#include <string.h>

void vulnerable_function(char *input) {
    char buffer[8];
    strcpy(buffer, input);  // Unsafe function call
    printf("Input was: %s\n", buffer);
}

int main(int argc, char *argv[]) {
    if (argc > 1) {
        vulnerable_function(argv[1]);
    } else {
        printf("Usage: %s <input>\n", argv[0]);
    }
    return 0;
}

How the Exploit Works
Vulnerability: The strcpy function does not check the length of the input string and can copy more data than the buffer can hold, leading to a buffer overflow.

Exploit: An attacker can craft a special input that overflows the buffer and overwrites critical parts of memory, such as the return address of the function. By doing this, the attacker can redirect the execution flow of the program to malicious code.

Remote Code Execution: In a scenario where this program is run on a server and accepts input from the network, an attacker can send a carefully constructed payload that exploits the buffer overflow to execute arbitrary code on the server.

Example Payload
Consider the following input provided to the program:

Code

$ ./vulnerable_program `p erl -e 'print "A"x12 . "\xef\xbe\xad\xde"'`

This input consists of:

A"x12: A series of 12 'A' characters, which will overflow the buffer.
\xef\xbe\xad\xde: A sequence of bytes in hexadecimal, representing a fabricated return address.

Conclusion
Buffer overflow vulnerabilities in C programs can be exploited to achieve remote code execution if the program accepts input from external sources (such as over a network). Proper input validation and the use of safer functions (like strncpy instead of strcpy) can help mitigate these risks. Additionally, modern systems employ various mitigations such as stack canaries, address space layout randomization (ASLR), and non-executable stacks to make exploitation more difficult.