Program for stack over flow vulnerability., C/C++ Programming


Imagine that the server program is a setuid program owned by the root, then after you penetrate the program with a shell running, you become the ROOT and you can remove the whole file system if you want. So it it extremely risky to have a setuid program with stack-overflow vulnerability.

Make sure that all the programs including yours must be complied by "cc",  not "gcc".

1.  In the "ass3" directory, there are two exploitable programs, server1 and server2. I have given you the source codes of server1.c and server2.c. Now you need to write programs, exploit1 and exploit2, to exploit their stack overflow vulnerabilities in server1 and server2respectively. All of your exploit programs should successfully launch a shell eventually.

You should read the articles linked from the course web page before you try to write your programs. Do not use the attack.c that I gave you because it is not flexible. Use some program in the article. Your program should be user friendly and general. I would suggest you to have at least two arguments into your program: bu?ersize and o?set. Run your program something like

exploit1bu?ersize o?set and exploit2 bu?ersize o?set

You can try your program A FEW times to find out the working arguments so you can set up a working bu?er to overflow the stacks for server1 and server2. After you find out what will be the working arguments from your general attack program, put the explanation in your README file and in your report. In your README file, you must let TA know how to run your programs to exploit server1, and server2. Make sure that your programs andparameters work for apache. TA will run your programs on apache.

2.  Answer the following questions.

(1)  Why server2 is hard to attack by bu?er overflow than server1.

(2)  To successfully attack server2, can the assembly shell code be put in the copy2()'s frame? Why or why not?

(3) Tell me your ideas how you layout your bu?er in terms of NOP, shell code, return addresses in order to attack server2 successfully. Tell me which return address you are to change? Is it the return address for copy2 to return to copy1 or the return address for copy1 to return to main? Or the return address for main to return to its parent?

(4) Will the last printf in the main(): printf(" Good Bye!... ) be printed out if you successfully execute the shell program in your input bu?er? Why or why not?

3.  Answer the following questions.

When you try to exploit a server, the results may be one of the following three cases: (1) the server program finishes okay. (2) abort with illegal instruction. (3) abort with bus error. Please explain the causes of each case and what action you like to do when having each case in order to successfully exploit the target server program? You should explain them in terms of bu?er size and return address, etc.

4.  Socket Programming Question. You need to write a program to attack two servers: listen and listen1.

In order for you to get start more easily, I've provided a simple socket application called "listen and speak" in the assignment directory "socket". Two programs are provided. One is called "listen" (and also "listen1"), and the other is called "speak". Invoke "listen" first in one machine by providing an unused port number, for example 7000, and then invoke "speak" in another machine (or THE SAME MACHINE) by providing the name of the machine running "listen" and the same port number. Then you can type some sentences from the "speak" machine. After you type return, the string you just typed in will be displayed in the "listen" machine. Study these two programs, you will know how to write socket programs.

Do the following. Open two X-windown (for example, use putty) on apache. In one window, run "listen 7000" and in another windows, run "speak apache 7000". Then you can do the same thing to run "listen1 6000" and "speak apache 6000" in another X-window.

You can see that each of listen.c and listen1 has a stack overflow vulnerability. Try to exploit it. You need to revise speak.c so the new program, called "attack",can prepare a well-crafted message and send it to listen and listen1. And then a shell should be run in listen or listen1.

Develop your program in that "socket" directory. Write README clearly; tell TA how to run your program. To make the testing easy, TA will run "listen" and "listen1" in apache and run your attack program in apache as well. Make your programs run like this

5.  SUGGESTIONS: Don't think it an easy programming. You must read article 1 and article 2 to get some ideas first. My attack.c there is NOT a good one for you to do this assignment. A program in one article there can be a good one for you to revise to finish this assignment. Check it out.

The programming must be done in SUN Sparc machines, for example, apache.

6.  Make sure you have a subdirectory "socket" under directory "ass3" which contains your codes related to the socket programs.

The grading of your programs is based on the clarity, correctness, e?ciency, and programming styles of your programs. Do not expect that you can get full points even your program runs correctly.

7.  Make sure that your programs work in SUN machine. TAwill test your programs in that machine.

Be honest. If your program does not work, SAY SO. TA will read your programs, compile your programs and test your programs. If your program does not work but you "claim" yours works, you will have severe penalty!


Posted Date: 2/19/2013 12:53:07 AM | Location : United States

Related Discussions:- Program for stack over flow vulnerability., Assignment Help, Ask Question on Program for stack over flow vulnerability., Get Answer, Expert's Help, Program for stack over flow vulnerability. Discussions

Write discussion on Program for stack over flow vulnerability.
Your posts are moderated
Related Questions
Project Description: Boots capture video from your YouTube channel and upload your own video to our channel or the copyright of the videos, bang, 3 parties, automatically delete

Problem 1. Explain Break and continue statements in C++. Explanation of Break statement Explanation of Continue statement 2. Explain concepts of constructors and

How do I allocate multidimensional arrays by new? A: There are several ways to do this, based on how flexible you wish the array sizing to be. On one acute, if you know all the

Write a program that computes the cost of a long distance call. The cost of the call is determined according to the following rate schedules. a. A call made between 8:00 AM and

Write two different arrays. Store the names in it and then compare if both the names entered by the user are the same.

Each of the following two procedures defines a method for adding two positive integers in terms of the procedures inc, which increments its argument by 1, and dec, which decrements

Write a program to find the area under the curve y = f(x) between x = a and x = b, integrate y = f(x) between the limits of a and b. The area under a curve between two points can b

What are the debugging methods you employ while came across a problem? A: Debugging with tools such as: 1.      DBG, GDB ,Forte, Visual Studio. 2.      Using tusc to trace

Illustration of Grid function: For illustration, the script below creates two individual figure windows. At First, it clears the figure window. Then, it generates an x vector

hello i have about 15 hours the dead line I Need a program in c language that''s determine the router ip or the gateway ip of the current NIC example the router ip is: