Introduction

In this lab, you will learn how buffer overflows and other memory vulnerabilities are used to takeover vulnerable programs. The goal is to investigate a program I provide and then figure out how to use it to gain shell access to systems.

In 1996 Aleph One wrote the canonical paper on smashing the stack. You should read this as it gives a detailed description of how stack smashing works. Today, many compilers and operating systems have implemented security features, which stop the attacks described in the paper. However, it still provides very relevant background for newer attacks and (specifically) this lab assignment.

Aleph One: Smashing the Stack for Fun and Profit:

https://web1.cs.wright.edu/people/faculty/tkprasad/courses/cs781/alephOne.html

Another (long) description of Buffer Overflows is here:

http://www.enderunix.org/docs/en/bof-eng.txt

Software Requirements

• The VirtualBox Software
• The Kali Linux, Penetration Testing Distribution
• GDB: The GNU Project Debugger
• GCC, the GNU Compiler Collection
• C source file including BOF.c, createBadfile.c, and testShellCode.c

Starting the Virtual Machine

You can use the Kali VM from Lab 1

Login the Kali Linux with username root, and password CS3339

Download the following 3 files on your VM: BOF.c createBadfile.c and testShellCode.c https://s2.smu.edu/~rtumac/cs3339/spring2020/Lab7/

Setting up the Environment

There are many protections in current compilers and operating systems to stop stack attacks like the one we want to do. We have to disable some security options to allow the exploit to work.

Disable Address Space Layout Randomization

Address Space Layout Randomization (ASLR) is a security features used in most Operating system today. ASLR randomly arranges the address spaces of processes, including stack, heap, and libraries. It provides a mechanism for making the exploitation hard to success. You can configure ASLR in Linux using the

/proc/sys/kernel/randomize_va_space interface. The following values are supported:

• No randomization
• Conservative randomization
• Full randomization Disable ASLR, run:

$ echo 0 > /proc/sys/kernel/randomize_va_space Enable ASLR, run:

$ echo 2 > /proc/sys/kernel/randomize_va_space

Note that you will need root privilege to configure the interface. Using vi to modify the

interface may have errors. The screenshot below shows the value of /proc/sys/kernel/randomize_va_space

However, this configuration will not survive after a reboot. You will have to configure this in sysctl. Add a file /etc/sysctl.d/01-disable-aslr.conf containing:

kernel.randomize_va_space=0

This will permanently disable ASLR. To achieve the above, you can run the following:

$ touch /etc/sysctl.d/01-disable-aslr.conf $ echo kernel.randomize_va_space=0 > /etc/sysctl.d/01-disable-aslr.conf

The screenshot below shows you the ASLR configuration. You can open a terminal and try it out.

Install GDB and GCC Multilib

$ sudo apt update

$ sudo apt install gdb gcc-multilib

Set compiler flags to disable security features

When you compile the vulnerable program (explain in the next section) with gcc, use the following compiler flags to disable the security features.

-z execstack

Turn off the NX protection to make the stack executable

-fno-stack-proector

Remove StackGuard that detects stack smashing exploitations

-g

Enable the debugging symbols

Overview

The goal of the exploitation is to teach you how buffer overflows work. You must gain a shell by passing a malicious input into a vulnerable program. The vulnerability takes as input a file named badfile. Your job is to create a badfile that results in the vulnerable program producing a shell. Note that you also have a nop sled to make the vulnerability work even if your shellcode moves by a few bytes. At this point in the lab you should already have the following files on your VM:

BOF.c

In BOF.c there is an un-bounded strcpy, which means anything that is not null- terminated will overwrite the buffer boundaries and (hopefully) put some information into the stack that you will design. Your exploit must work with my version of BOF.c (cant change it to make your code work).

To compile BOF.c, you need to add the compile flags mentioned. Also, use -m32 flag to compile your program for a 32 bit system. This will make it easier to work with memory addresses later on since 32 bit systems have shorter memory addresses than 64 bit systems.

$ gcc -m32 -g -z execstack -fno-stack-protector BOF.c -o BOF

testShellCode.c

This program simply lets you test shell code itself. There are a lot of different shell codes you can find or create, and this is a good way to see what they do, and if theyll work for you (on your operating system).

The actual shellcode you are using is simply the assembly version of this C code:

#include <stdio.h> int main( ) { char *name[2]; name[0] = /bin/sh; name[1] = NULL;

execve(name[0], name, NULL);

}

createBadfile.c

This program writes out badfile, however currently it is just full of nops (no ops). You need to modify it to place your shell code into it and cause the code to jump to the shellcode. The shellcode included already in createBadfile.c (as a char array) does work. You shouldnt need to modify it, but youre welcome to.

To compile the testShellCode.c and createBadfile.c, you can run the following commands. Note that test testShellCode.c requires the -m32 -z execstack flags but createBadfile.c does not.

Starting the Exploitation

There are really two challenges in the lab. To execute the shellcode you want to overwrite the return address in the bufferOverflow() function. You must make the return address of that function point to your shellcode.

1. You need to figure out what memory address the return address is stored in.
2. Then you need to figure out the address of your shellcode in memory, and write the shellcodes address into the return address you found in step 1. In the lab instruction, I will give you some hints for the step 1.

Finding Return Address on the Stack

In order to find the return address on stacks, we first use GDB, The GNU Project Debugger, to take a look at the assembly code. You can find more information about GDB from here: https://www.gnu.org/software/gdb/ Note that you can also use tool, objdump, to read the assembly code.

To run BOF in debugging mode with GDB:

$ gdb BOF

First, we disassemble the main() function of the BOF program. We find the bufferOverflow() function in the main() function (type disas main in the GDB). Then, we disassemble the bufferOverflow() function, which has a vulnerability in it.

$ (gdb) disas main $ (gdb) disas bufferOverflow

You need to understand the assembly code to find where the return address is on the stack. Next, type run in the GDB to execute the BOF program.

$ (gdb) run

As we expected, the BOF program generates an exception, segmentation fault. The Instruction Pointer (EIP) is 0x90909090. This is because we put NOP sleds on the badfile that overflows the buffer in the BOF program.

You also can see more register information by execute info register in the GDB

$ (gdb) info register

Note that you can always type help in the GDB to learn the commands.

Assignments for the Lab 7

A zip file containing:

1. Your updated createBadfile.c that generates the input for the BOF program
2. A copy of the badfile. This must generate a shell when BOF runs from the command line in the VM
3. A screenshot of using BOF program to gain a shell (see simple screenshot below). Add your screenshot at the top of your PDF file.
4. A PDF file with answers to the following questions:
   1. What happens when you compile without -z execstack?
   2. What happens if you enable ASLR? Does the return address change?
   3. Does the address of the buffer[] in memory change when you run BOF using GDB, /root/Desktop/<your-specific-path-to-BOF>/BOF, and ./BOF?

Happy Exploiting!