Stack allocation and buffer overflow

UNIVERSITY OF SOUTH CAROLINAUNIVERSITY OF SOUTH CAROLINADepartment of Computer Science and

Engineering

Department of Computer Science and Engineering

CSCE 531 Presentationby

Miao XUxum@engr.sc.edu

Engineering

Outline

• Stack allocation in Windows

• What is buffer overflow

• How to exploit buffer overflow

• Demo

Engineering

Stack allocation in TAM

callframe

SB = Stack baseLB = Locals baseST = Stack top

callframe Dynamic link

globals

Engineering

Stack allocation in TAM (Contd.)

A frame contains• A dynamic link: to next frame on

the stack (the frame of the caller)• Return address• Local variables for the current

activation

return address

locals

Link data

Local data

Engineering

What’s going on inside Windows?

• Initial stack state

EBP: Extended Base PointerESP: Extended Stack Pointer

Current frame

Engineering

• Before call f(arg1, arg2)– Push arguments

Current frame

Engineering

• Before call f(arg1, arg2)– Push next instruction address

Current frame

Ret. Addr.

Engineering

• Enter into f(arg1, arg2)– Push current EBP

Current frame

Ret. Addr.

Prev. EBP

Engineering

• Enter into f(arg1, arg2)– Move EBP to ESP

EBPESP

Current frame

Ret. Addr.

Prev. EBP

Engineering

• Enter into f(arg1, arg2)

Previous frame

Ret. Addr.

Prev. EBP

Current frame

Engineering

What is buffer overflow?

• Related with stack allocation

• A buffer overflow, or buffer overrun, is an anomaly where a process stores data in a buffer outside the memory the programmer set aside for it.– Wikipedia

Engineering

Buffer overflow

void function(char *str) { char buffer[8]; strcpy(buffer,str); }

void main() { char large_string[256]; for( int i = 0; i < 255; i++) large_string[i] = 'A'; function(large_string); }

void function(char *str) { char buffer[8]; strcpy(buffer,str); }

void main() { char large_string[256]; for( int i = 0; i < 255; i++) large_string[i] = 'A'; function(large_string); }

Engineering

An example

Engineering

An example

Engineering

An example

Engineering

An example

Engineering

An example

Engineering

An example

Return to 0x41414141

Engineering

Problems with buffer overflow

• A demo

Engineering

Acknowledgement

• The demo and part of this slides are from the training when the presenter was in Symantec, Chinese Development Center, Beijing

• The example comes from the following reference:– Aleph One, Smashing the stack for

fun and profit, Phrack Magzine, Vol. 7 (49) , 1996

Engineering

Questions?

Engineering

Stack allocation and buffer overflow

Documents

Transcript of Stack allocation and buffer overflow

Stack based buffer overflow Exploitation- Tutorial · Stack Based Buffer Overflows Introduction: I decided to get a bit more into Linux exploitation, so I thought it would be nice

Documento Stack Buffer Overflow

Buffer Overflow

Buffer Overflow Explanation

System Security - Attack and Defense for CSE 610 Special ... Stac… · 1. Stack-based buffer overflow-1 a. Brief history of buffer overflow b. Program variables (global, local, initialized,

Stack Overflow Attacks

Buffer Overflow or Stack smashing

Stack Based Windows Buffer Overflow

Buffer Overflow Attacks

Aprenda Stack Buffer Overflow

Stack Overflow - It's all about performance / Marco Cecconi (Stack Overflow)

Buffer overflow – Smashing The Stack

Stack based overflow

Understanding Stack Overflow

Binary‐level program analysis: Stack Smashinggxt29/teaching/cse597s19/slides/04StackSmashi… · Buffer Overflow •A buffer overflow occurs when data is written ... Smashing the

Buffer Overflows - University of Washington€¦ · L15: Buffer Overflow CSE351, Spring 2017 x86‐64 Linux Memory Layout Stack Runtime stack has 8 MiBlimit Heap Dynamically allocated

Buffer Overflow Attackscshen/367/notes/Buffer Overflow.pdf · 2016. 2. 9. · Stack Buffer Overflow • Occur when buffer is located on stack – also referred to as stack smashing

CISC 3320 C31b System Security: Threats - GitHub Pages · Protecting from Buffer Overflow •Buffer overflow can be disabled by disabling stack execution or adding bit to page table

Buffer Overflows and Defenses - Rutgers University...Stack Buffer Overflow occurs when buffer is located on stack used by Morris Worm “Smashing the Stack” paper popularized it

Buffer overflow and stack smashing attacks Principles of application software security.