Interactive guide to Buffer Overflow exploitation

https://nagarrosecurity.com/blog/interactive-buffer-overflow-exploitation

by bordplate • 6 years ago

169 30 6 years ago

nagarrosecurity.com

antirez2• 6 years ago

I hope somebody else remembers "Smashing the stack for fun and profit" by Aleph1.

Aaronstotle• 6 years ago

First paper I read regarding buffer overflows and would highly recommend to anyone interested.

This link is from Berkeley's Computer Security Class: http://www-inst.eecs.berkeley.edu/~cs161/fa08/papers/stack_s...

metaphor• 6 years ago

A bit more OG: http://www.phrack.org/issues/49/14.html#article

fit2rule8• 6 years ago

I was there when he wrote it, on an Indy I'd given him for work purposes. Crazy to think, all these years later, we're still discussing it .. in between setting things up for the Huntington Beach US Open Women's Volleyball competition, he'd be crashing things running eggshell.

Crazy times. I'll never forget going to a Surfrider Foundation party with Aleph1, only to be bored out of our minds and go find a barely open video arcade to throw quarters at ..

antirez2• 6 years ago

What an awesome story! Thanks for sharing.

tptacek6• 6 years ago

https://twitter.com/aleph_one/status/1247639362147254272

jrumbut• 6 years ago

Funny, I never thought about who Aleph1 was outside of textfile authoring, or where he might be today.

Certainly, my image of him did not include a volleyball competition!

apeacox• 6 years ago

I also remember your articles on Linux&C about buffer overflow, sockets in C, etc... ;-)

andarleen• 6 years ago

That, and unrelated “Hackers go corporate”. The latter is probably the best advise on how to start a career.

saagarjha3• 6 years ago

The cute little emulator, which was linked in the article: https://github.com/bordplate/js86. I am curious how they came up with the ABI for variadics, though…

bordplate2• 6 years ago

I've been aiming for x86-64 calling conventions, but must admit I've had a tendency to mix them up. It doesn't matter much in this case though. There are no variadic functions used in this post. I'm cheating a lot with the printf-function. You can see the implementation here: https://github.com/bordplate/js86/blob/master/Emulator/Proce...

mettamage• 6 years ago

Someone should contact https://explorabl.es/ because this seems like an explorable exploration!

pelliphant• 6 years ago

There is one thing here that I don't really understand:

In the first 2 examples, it says:

"If you pop (fetch) a value from the stack, RSP decreases by 8"

But when I step through it, it seems to add 8 on a pop, not subtract (and vice versa for push), or am I missing something?

bordplate2• 6 years ago

Woops, you're right. Thanks for pointing it out, I'll fix it, they should be the other way around.

You're decreasing the stack, but increasing RSP. Because the stack "grows down".

s5ma6n• 6 years ago

I love the latest commit messages at the emulator repo :)

"Fuck you JavaScript, an array with 1 int in it is not a fucking number. Why are you like this you piece of rotten garbage"

I share your hatred :)

A very nice guide and introduction both to x86 asm and buffer overflow. Thanks for this.

Interactive guide to Buffer Overflow exploitation

Related Stories