Program for stack over flow vulnerability., C/C++ Programming

 

Imagine that the server program is a setuid program owned by the root, then after you penetrate the program with a shell running, you become the ROOT and you can remove the whole file system if you want. So it it extremely risky to have a setuid program with stack-overflow vulnerability.

Make sure that all the programs including yours must be complied by "cc",  not "gcc".

1.  In the "ass3" directory, there are two exploitable programs, server1 and server2. I have given you the source codes of server1.c and server2.c. Now you need to write programs, exploit1 and exploit2, to exploit their stack overflow vulnerabilities in server1 and server2respectively. All of your exploit programs should successfully launch a shell eventually.

You should read the articles linked from the course web page before you try to write your programs. Do not use the attack.c that I gave you because it is not flexible. Use some program in the article. Your program should be user friendly and general. I would suggest you to have at least two arguments into your program: bu?ersize and o?set. Run your program something like

exploit1bu?ersize o?set and exploit2 bu?ersize o?set

You can try your program A FEW times to find out the working arguments so you can set up a working bu?er to overflow the stacks for server1 and server2. After you find out what will be the working arguments from your general attack program, put the explanation in your README file and in your report. In your README file, you must let TA know how to run your programs to exploit server1, and server2. Make sure that your programs andparameters work for apache. TA will run your programs on apache.

2.  Answer the following questions.

(1)  Why server2 is hard to attack by bu?er overflow than server1.

(2)  To successfully attack server2, can the assembly shell code be put in the copy2()'s frame? Why or why not?

(3) Tell me your ideas how you layout your bu?er in terms of NOP, shell code, return addresses in order to attack server2 successfully. Tell me which return address you are to change? Is it the return address for copy2 to return to copy1 or the return address for copy1 to return to main? Or the return address for main to return to its parent?

(4) Will the last printf in the main(): printf(" Good Bye!... ) be printed out if you successfully execute the shell program in your input bu?er? Why or why not?

3.  Answer the following questions.

When you try to exploit a server, the results may be one of the following three cases: (1) the server program finishes okay. (2) abort with illegal instruction. (3) abort with bus error. Please explain the causes of each case and what action you like to do when having each case in order to successfully exploit the target server program? You should explain them in terms of bu?er size and return address, etc.

4.  Socket Programming Question. You need to write a program to attack two servers: listen and listen1.

In order for you to get start more easily, I've provided a simple socket application called "listen and speak" in the assignment directory "socket". Two programs are provided. One is called "listen" (and also "listen1"), and the other is called "speak". Invoke "listen" first in one machine by providing an unused port number, for example 7000, and then invoke "speak" in another machine (or THE SAME MACHINE) by providing the name of the machine running "listen" and the same port number. Then you can type some sentences from the "speak" machine. After you type return, the string you just typed in will be displayed in the "listen" machine. Study these two programs, you will know how to write socket programs.

Do the following. Open two X-windown (for example, use putty) on apache. In one window, run "listen 7000" and in another windows, run "speak apache 7000". Then you can do the same thing to run "listen1 6000" and "speak apache 6000" in another X-window.

You can see that each of listen.c and listen1 has a stack overflow vulnerability. Try to exploit it. You need to revise speak.c so the new program, called "attack",can prepare a well-crafted message and send it to listen and listen1. And then a shell should be run in listen or listen1.

Develop your program in that "socket" directory. Write README clearly; tell TA how to run your program. To make the testing easy, TA will run "listen" and "listen1" in apache and run your attack program in apache as well. Make your programs run like this

5.  SUGGESTIONS: Don't think it an easy programming. You must read article 1 and article 2 to get some ideas first. My attack.c there is NOT a good one for you to do this assignment. A program in one article there can be a good one for you to revise to finish this assignment. Check it out.

The programming must be done in SUN Sparc machines, for example, apache.

6.  Make sure you have a subdirectory "socket" under directory "ass3" which contains your codes related to the socket programs.

The grading of your programs is based on the clarity, correctness, e?ciency, and programming styles of your programs. Do not expect that you can get full points even your program runs correctly.

7.  Make sure that your programs work in SUN machine. TAwill test your programs in that machine.

Be honest. If your program does not work, SAY SO. TA will read your programs, compile your programs and test your programs. If your program does not work but you "claim" yours works, you will have severe penalty!

 

Posted Date: 2/19/2013 12:53:07 AM | Location : United States







Related Discussions:- Program for stack over flow vulnerability., Assignment Help, Ask Question on Program for stack over flow vulnerability., Get Answer, Expert's Help, Program for stack over flow vulnerability. Discussions

Write discussion on Program for stack over flow vulnerability.
Your posts are moderated
Related Questions
It is a pointer accessible only in the member functions of a struct, class or union type. It points to the object for which the member function is called. Static member functions d

how to write code for z transformer

Problem Statement: You have to write a C program to develop a Car Parking Management System for a busy commercial area. The system will record the car plate number, date and time w

one of the segments is showing compilation error...

Project Description: I'm seeking someone who could write me a torrent seeding client which supports multiple proxies. The goal of the project is to make torrents popular by seed

why c is middle level language?

I have a program for school and I am not understanding why one of the variables gets skipped or the arithmetic operators aren''t having any effect as I have tryed defining it sever

A palindrome is a string that reads the same from both the ends. Given a string S convert it to a palindrome by doing character replacement. Your task is to convert S to palindrome

A string S is said to be "Super ASCII", if it contains the character frequency equal to their ascii values. String will contain only lower case alphabets (''a''-''z'') and the asci

Should I call a destructor explicitly on a local variable?