Venkata Kishore's Weblog: Venkata Kishore's Weblog

    Its really nice & very interesting to clear the clouds in my mind about different topics. And wanted to share and bookmark it. 
    I started exploiting this after an interesting topic from Chandan, about the security. Though I attended it earlier this is much clearer to me now. He discussed about the "Buffer over flow" exploits. It is a black box for me all these days, so wanted to know more about it.
    Buffer overflow occurs when you have a fixed memory area, and you are trying to put more data than it can really take. Like copying 30 characters into a character array of length 20. This can cause a serious security vulnerability.

   Here is how it can happen. The stack always grows downwards, in both X86 and sparc boxes. When a function is called typically in an X86 machine, the return address will bepushed into the stack and then the caller functions frame pointer. Then all the local variable for the function will be created.
     Now suppose you are allocated an array of size 10 it will allocate a 10 byte array and give you the least address (or) the starting address. If you copy a 20 byte content into the array then the buffer overflows, and this will goes into the return address of the caller function. If the exploiter cleverly puts address inthe return address that points to the "exec bash" source, then after completing the function bash code will be executed and gives the bash shell for the root.
    This is how the hackers will exploit the buffer overflow vulnerability.

 Other interesting points:
 
  - In S9 the stack is executable but in S10 it is not executable so the above exploit can't happen.
  - BOF can also happen with Data section being overflowed to go to stack section.