Exploit Buffer Overflow

• Vulnerable programs (fgets, strcpy, sprintf..)
• NUL bytes
• Uncertainty about address

Find vulnerable programs

• Use nm and grep to spot use of dangerous routines
  • nm - list symbols from binary files

    # nm test.o
    0000000a T global_function
    00000025 T global_function2
    00000004 C global_var
    ...
    

• Probe via very-long inputs
• Dissambler: look at source or disassembed/decompiled code

NUL bytes

• C strings can’t have embedded 0 bytes
• Some instructions do have 0 bytes, perhaps as part of an operand

Address Uncertainty

• Pad the evil instructions with NOPs $\rightarrow$a landing zone or a NOP sled.
• Set the return address to anywhere in the landing zone.

Conclusions

• Must check buffer length
• Use safer library functions
• Write your own safe library functions
• Don't use raw C.