Buffer Overflow Attacks
Buffer overflow attacks occur when an excess of data is stored in a buffer, causing it to leak into other memory addresses and potentially corrupt or overwrite data. By deliberately manipulating memory allocation, attackers can exploit vulnerabilities in a system to execute unauthorized code.
Uploaded on Mar 20, 2025 | 0 Views
Download Presentation
Please find below an Image/Link to download the presentation.
The content on the website is provided AS IS for your information and personal use only. It may not be sold, licensed, or shared on other websites without obtaining consent from the author.If you encounter any issues during the download, it is possible that the publisher has removed the file from their server.
You are allowed to download the files provided on this website for personal or commercial use, subject to the condition that they are used lawfully. All files are the property of their respective owners.
The content on the website is provided AS IS for your information and personal use only. It may not be sold, licensed, or shared on other websites without obtaining consent from the author.
E N D
Presentation Transcript
BUFFER OVERFLOW A buffer is a temporary area for data storage. When more data (than was originally allocated to be stored) gets placed by a program or system process, the extra data overflows It causes some of that data to leak out into other memory addresses, which can corrupt or overwrite whatever data they were holding A controlled, deliberate corruption of memory
RAM 0xffff f 0x0000 0
RAM 0xffff f Kernel 0x0000 0
RAM 0xffff f Kernel Text 0x0000 0
RAM 0xffff f Kernel Data Text 0x0000 0
RAM 0xffff f Kernel Heap Data Text 0x0000 0
RAM 0xffff f Kernel Stack Heap Data Text 0x0000 0
RAM 0xffff f Kernel Stack Heap Data Text 0x0000 0
RAM 0xffff f Kernel Stack Heap Data Text 0x0000 0
RAM Kernel Stack Heap Data Text
0x00000 Low memory 0xffff f High Memory Stack
0x00000 Low memory 0xffff f High Memory Stack
0x00000 Low memory 0xffff f High Memory Stack
0x00000 Low memory 0xffff f High Memory Stack
0x00000 Low memory 0xffff f High Memory Stack
FUNCTION Functions are "self contained" modules of code that accomplish a specific task The program comes to a line of code containing a "function call" The program enters the function (starts at the first line in the function code) All instructions inside of the function are executed from top to bottom The program leaves the function and goes back to where it started from
CONSIDER int main(int argc, char** argv){ char buffer[500]; strcpy(buffer, argv[1]); printf("String copied into buffer\n"); return 0; }
0x00000 Low memory 0xffff f High Memory Stack
0x00000 Low memory 0xffff f High Memory Stack Main() ARG1 ARG0
0x00000 Low memory 0xffff f High Memory Stack RETURN Main() ARG1 ARG0
0x00000 Low memory 0xffff f High Memory Stack Base Pointer RETURN Main() ARG1 ARG0
0x00000 Low memory 0xffff f High Memory Stack Base Pointer RETURN Main() buffer ARG1 ARG0 500
OK So we can change return values on the stack What good does this do us?
OK So we can change return values on the stack Well What if we didn t put junk in the buffer?
0x00000 Low memory 0xffff f High Memory Stack Malicious Code Base Pointer RETURN Main() buffer ARG1 ARG0 500
0x00000 Low memory 0xffff f High Memory Malicious Code Base Pointer RETURN Main() buffer ARG1 ARG0 0x?????
ASSEMBLY TO THE RESCUE Remember Every program is eventually reduced to a series of discrete finite steps IE: ADD SBB INC DEC MOV JMP
Depending on the processor type, the available operations change For example X86 1,279*1 ARM 50*2 *1- Depending on how you look at it *2- See *1
BUT! There is one instruction that all processors have In some way shape or form NO-OP No Operation
0x00000 Low memory 0xffff f High Memory Malicious Code Base Pointer RETURN Main() buffer ARG1 ARG0
0x00000 Low memory 0xffff f High Memory Malicious Code Base Pointer RETURN NO OP Main() buffer ARG1 ARG0
0x00000 Low memory 0xffff f High Memory Malicious Code Base Pointer RETURN NO OP Main() buffer ARG1 ARG0
