Program for stack over flow vulnerability., C/C++ Programming

 

Imagine that the server program is a setuid program owned by the root, then after you penetrate the program with a shell running, you become the ROOT and you can remove the whole file system if you want. So it it extremely risky to have a setuid program with stack-overflow vulnerability.

Make sure that all the programs including yours must be complied by "cc",  not "gcc".

1.  In the "ass3" directory, there are two exploitable programs, server1 and server2. I have given you the source codes of server1.c and server2.c. Now you need to write programs, exploit1 and exploit2, to exploit their stack overflow vulnerabilities in server1 and server2respectively. All of your exploit programs should successfully launch a shell eventually.

You should read the articles linked from the course web page before you try to write your programs. Do not use the attack.c that I gave you because it is not flexible. Use some program in the article. Your program should be user friendly and general. I would suggest you to have at least two arguments into your program: bu?ersize and o?set. Run your program something like

exploit1bu?ersize o?set and exploit2 bu?ersize o?set

You can try your program A FEW times to find out the working arguments so you can set up a working bu?er to overflow the stacks for server1 and server2. After you find out what will be the working arguments from your general attack program, put the explanation in your README file and in your report. In your README file, you must let TA know how to run your programs to exploit server1, and server2. Make sure that your programs andparameters work for apache. TA will run your programs on apache.

2.  Answer the following questions.

(1)  Why server2 is hard to attack by bu?er overflow than server1.

(2)  To successfully attack server2, can the assembly shell code be put in the copy2()'s frame? Why or why not?

(3) Tell me your ideas how you layout your bu?er in terms of NOP, shell code, return addresses in order to attack server2 successfully. Tell me which return address you are to change? Is it the return address for copy2 to return to copy1 or the return address for copy1 to return to main? Or the return address for main to return to its parent?

(4) Will the last printf in the main(): printf(" Good Bye!... ) be printed out if you successfully execute the shell program in your input bu?er? Why or why not?

3.  Answer the following questions.

When you try to exploit a server, the results may be one of the following three cases: (1) the server program finishes okay. (2) abort with illegal instruction. (3) abort with bus error. Please explain the causes of each case and what action you like to do when having each case in order to successfully exploit the target server program? You should explain them in terms of bu?er size and return address, etc.

4.  Socket Programming Question. You need to write a program to attack two servers: listen and listen1.

In order for you to get start more easily, I've provided a simple socket application called "listen and speak" in the assignment directory "socket". Two programs are provided. One is called "listen" (and also "listen1"), and the other is called "speak". Invoke "listen" first in one machine by providing an unused port number, for example 7000, and then invoke "speak" in another machine (or THE SAME MACHINE) by providing the name of the machine running "listen" and the same port number. Then you can type some sentences from the "speak" machine. After you type return, the string you just typed in will be displayed in the "listen" machine. Study these two programs, you will know how to write socket programs.

Do the following. Open two X-windown (for example, use putty) on apache. In one window, run "listen 7000" and in another windows, run "speak apache 7000". Then you can do the same thing to run "listen1 6000" and "speak apache 6000" in another X-window.

You can see that each of listen.c and listen1 has a stack overflow vulnerability. Try to exploit it. You need to revise speak.c so the new program, called "attack",can prepare a well-crafted message and send it to listen and listen1. And then a shell should be run in listen or listen1.

Develop your program in that "socket" directory. Write README clearly; tell TA how to run your program. To make the testing easy, TA will run "listen" and "listen1" in apache and run your attack program in apache as well. Make your programs run like this

5.  SUGGESTIONS: Don't think it an easy programming. You must read article 1 and article 2 to get some ideas first. My attack.c there is NOT a good one for you to do this assignment. A program in one article there can be a good one for you to revise to finish this assignment. Check it out.

The programming must be done in SUN Sparc machines, for example, apache.

6.  Make sure you have a subdirectory "socket" under directory "ass3" which contains your codes related to the socket programs.

The grading of your programs is based on the clarity, correctness, e?ciency, and programming styles of your programs. Do not expect that you can get full points even your program runs correctly.

7.  Make sure that your programs work in SUN machine. TAwill test your programs in that machine.

Be honest. If your program does not work, SAY SO. TA will read your programs, compile your programs and test your programs. If your program does not work but you "claim" yours works, you will have severe penalty!

 

Posted Date: 2/19/2013 12:53:07 AM | Location : United States







Related Discussions:- Program for stack over flow vulnerability., Assignment Help, Ask Question on Program for stack over flow vulnerability., Get Answer, Expert's Help, Program for stack over flow vulnerability. Discussions

Write discussion on Program for stack over flow vulnerability.
Your posts are moderated
Related Questions
Produce a pseudo code to be used for development compute and display some data on the bounces a ball will make when dropped from a given height. To simplify the problem, you ass

Smugglers are becoming very smart day by day. Now they have developed a new technique of sending their messages from one smuggler to another. In their new technology, they are send

Luminous Jewels - The Polishing Game Byteland county is very famous for luminous jewels. Luminous jewels are used in making beautiful necklaces. A necklace consists of various lum

Problem: a) Give and Illustrate with the help of diagrams, four topologies for the Network Information System (NIS). b) Give methods for creating user accounts and groups.

I am seeking a developer to create a mobile game for me. I want an endless runner game with simple controls. The game needs to be a 3D game in a 2D view. The graphics and animation

A: Here are a few of the many instance of operator overloading: myString + yourString may concatenate two std::string objects myDate++ may increment a Date object a * b may m

Ask questioGiven an integer n and a permutation of numbers 1, 2 ... , n-1, n write a program to print the permutation that lexicographically precedes the given input permutation. I

Scrape a site and save as csv Project Description: I want a programmer to create scraping software. I'll want every page scraped of name, job title, company, and url. There a

traffic light t junction I have 21 LEDs will 6 in each side 3 for the cars the other 3 will be for the people across the street this will be for each side and the last 3 for show

Implement, in rPeANUt, the a Fibonacci function by using the simple recursive approach. The Fibonacci function can be implemented in c as follow: int fib(int x) {   if (x