Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revision Previous revision
Next revision
Previous revision
cs-465:project-8-buffer-overflow [2016/02/26 16:54]
sruoti [Objectives]
cs-465:project-8-buffer-overflow [2017/11/11 17:10] (current)
seamons
Line 3: Line 3:
 == Objectives == == Objectives ==
  
-Spend 3 hours average ​to increase your understanding of buffer overflow attacks +Use a debugger ​to examine assembly code and stack memory 
-* You select the project you want to work on +* Conduct simple ​buffer overflow attacks ​against ​vulnerable program from the command line
-* Submit ​report on what you learned along with supporting evidence +
-* Choose the project that will give you the best learning experience based on your background on this topic.+
  
 +== Resources ==
  
-<​del>​The Unix machines in the Pizza Lab (1057 TMCB) in the basement have ASLR turned off for the next few weeks, so you can complete your projects on those machines. Other machines could have protections turned on that will prevent your experiments from working. +The CS department has prepared a VM for each of you to be able to use on the lab machines or your own machine. You need to be connected to the CS network to download the actual VM. [[https://​docs.google.com/​a/​cs.byu.edu/​document/​d/​14MlNZmbqkx8jzibNOcpAGWZ3bk36qw1XcLIRjCoqG08/​edit?​usp=sharing|Instructions]]
-</​del>​ +
-The CS department has prepared a VM for each of you to be able to use. You need to be connected to the CS network to download the actual VM. +
  
 For tips on how to use GDB, [https://​gist.github.com/​ThaWeatherman/​6912322 here] is a document detailing some of the more useful and important commands. Ignore the comments on the Bomb lab: it may become a lab later in the semester but you don't have to worry about it now. For tips on how to use GDB, [https://​gist.github.com/​ThaWeatherman/​6912322 here] is a document detailing some of the more useful and important commands. Ignore the comments on the Bomb lab: it may become a lab later in the semester but you don't have to worry about it now.
  
 +== Part 1 - This is now HW 11a ==
  
-== Option 1 == +This part is intended ​to introduce you to the debugger, ​understand ​how to examine and update memory locations using a debugger, and gain experience with how the runtime stack is organized. A helpful way to start is to watch an [http://​youtu.be/​RF7DF4kfs1E introductory video] on buffer overflow attacks.
- +
-This option ​is intended ​for students with little or no experience using the debugger, ​understanding ​how to examine and update memory locations using a debugger, and have no experience with how the runtime stack is organized. A helpful way to start is to watch an [http://​youtu.be/​RF7DF4kfs1E introductory video] on buffer overflow attacks.+
 The following file makes a series of function calls main -> freshman -> sophomore -> junior -> senior. The following file makes a series of function calls main -> freshman -> sophomore -> junior -> senior.
 Compile the program and run it in the debugger, breaking somewhere in function senior. Compile the program and run it in the debugger, breaking somewhere in function senior.
-Print out all the stack activation frames, and label as many memory locations as you can. You should be able to identify 1) return addresses, 2) saved frame pointers (ebp), 3) local variables, 4) function arguments. +Print out all of the stack activation frames, and label as many memory locations as you can.  
-You may print out a hard copy, write on it to label all the items, and turn in the hard copy. You may also submit ​your result electronically.+ 
 +Not all the stack locations will be labeled. Extra space may be allocated on the stack that is set to uninitialized values that already existing in memory. Be sure to label the following elements for all four functions. 
 +You should be able to identify 1) return addresses, 2) saved frame pointers (ebp), 3) local variables, 4) function arguments
 +Use the "info frame" gdb command to compare the information you labeled with what the debugger reports is in each stack frame
 +You may print out a hard copy, write on it to label all the items, and turn in a scan of the hard copy. You may also create ​your result electronically. Make it easy for the TAs to grade.
 * Link to [http://​faculty.cs.byu.edu/​~seamons/​examine_stack.c examine_stack.c] * Link to [http://​faculty.cs.byu.edu/​~seamons/​examine_stack.c examine_stack.c]
-Due to -m32 not working on the lab machines, here is a [http://​students.cs.byu.edu/​~cs465ta/​fall2014/​examine_stack precompiled version]+Compile the program with the -m32 compiler optionWe will use a 32-bit program for simplicity.
  
 +* [http://​tinyurl.com/​9uh458s Buffer Overflow Resources] This is used in part 2, but there are some helpful gdb commands at the start of the file.
  
-== Option 2 ==+* compile with -g and -m32 options to give you debugging info
  
-The most recent CS 360 course now includes a project on buffer overflow attacks. This is based on a lab developed at Syracuse. You may complete that lab and submit the result for Project 8. +== Part 2 ==
-* Link to [http://​ilab.cs.byu.edu/​cs360/​2012s/​assignments/​lab5.html CS360 Buffer Overflow Lab] +
-* As in option 1, you'll need a [http://​students.cs.byu.edu/​~cs465ta/​fall2014/​bufferOverflow/​option2.tgz precompiled version]+
  
- +I used a collection of files based on materials found in Jon Erickson'​s The Art of Exploitation. Visit the following page for hints on using gdb and perl, and then try a range of options to change ​the flow control for a program.
-== Option 3 == +
- +
-I used a collection of files based on materials found in Jon Erickson'​s The Art of Exploitation. Visit the following page for hints on using gdb and perl, and then try a range of options to change ​to flow control for a program. Your deliverable is a writeup to describe what you learned.+
 * [http://​tinyurl.com/​9uh458s Buffer Overflow Resources] * [http://​tinyurl.com/​9uh458s Buffer Overflow Resources]
-Inject shell code on the stack +Complete Sections A, B, C, and D in the Resources File 
-First inject your shellcode as an environment variable. Then smash the stack and cause that shellcode ​to execute+** Section C - From the command line, gain access ​to the program without providing a legitimate password
- +** Take screen shot of your result ​for Section C and submit ​that to Learning Suite
- +** Section D - From the command line, submit shell code to launch ​your own shell 
-== Option 4 (NOT AVAILABLE - Now Extra Credit Lab)== +** Take screen shot of your result for Section D and submit that to Learning Suite.
- +
-For this option you can practice your buffer overflow skills against the Carnegie Mellon buflab. This lab is part of EE 324 as well. Currently we do not have a project description posted. However the one for EE 324 is [http://​ece324web.groups.et.byu.net/​Labs/​buflab/​buflab.pdf here] and it is the same as what you will be doing here. However please note that you cannot work in teams, despite what that spec says. For your cookie provide your NetID. This lab can only be done on CS lab machines (not SPICE machines like the spec says). You can SSH into them if you don't want to go into the labs.  +
- +
-Get your bomb [http://​padme.cs.byu.edu:​18213 here]. See the results board [http://​padme.cs.byu.edu:​18213/​scoreboard here]. +
- +
- +
-== Option 5 == +
- +
-Find resources on the web to help you develop ​your own shell code and perform ​stack smashing attack with your own shellcode instead of taking existing shellcode ​and using it without understanding what it does. +
- +
- +
-== Option 6 == +
- +
-Choose a compiler and O/S and reverse engineer the canary-based stack protection ​to learn how it works. How does it compare to the canary alternatives we discuessed in class? Demonstrate how it works to detect a stack-smashing attack.+
  
  
-== Option 7 == 
  
-Learn about format string vulnerabilities and demonstrate how they work. 
  
cs-465/project-8-buffer-overflow.1456530842.txt.gz · Last modified: 2016/02/26 16:54 by sruoti
Back to top
CC Attribution-Share Alike 4.0 International
chimeric.de = chi`s home Valid CSS Driven by DokuWiki do yourself a favour and use a real browser - get firefox!! Recent changes RSS feed Valid XHTML 1.0