In this demonstration,
I'm going to show you how a buffer overflow attack
is conducted.
Now, I'm going to do this
by using a simple program that's written here.
This program is called Narnia 0.C.
This tells me that the program was written
in the C programming language.
You can see it displayed here on the screen.
Now, you don't have to be an expert in the C language
to understand what this program is doing though.
I'm going to walk you through it step by step,
and then I'm going to show you
how we throw this buffer overflow attack
to exploit this program.
Now, the first thing we can see
is that there are two statements
that start with the word include.
This is just saying that we're going to include
these third-party libraries,
the standard input/output library
and the standard library itself.
After those two include statements,
we get to the main part of this program.
This is called main.
If you see the first thing,
we have a long variable,
and that value is 0x41414141.
Followed by that,
we have a character array
being set up called buffer
that is 20 items long.
This means that the buffer
can only hold 20 pieces of information,
or 20 characters in this case.
Next, we have the printf statement,
which basically says,
"Put everything in between the quotes on to the screen
when you run this program."
Then it goes and asks you,
"Here is your chance to try it."
And then it asks by scanning
what the input is from the keyboard,
and that input is going to be stored into the buffer.
Once you've inputted what you want to the buffer,
it's going to print out the two variables,
what's stored in buffer
and what's stored in value.
After displaying both variables to the screen,
it's going to see what the value was.
If the value = 0xdeadbeef,
meaning we've overflowed the buffer
with the characters that make up deadbeef,
then the system will give you a shell prompt,
which means you're going to have access to that system
to conduct any kind of programs you want.
If not, it's going to say, "WAY OFF",
and it's going to exit the program,
and you'll have to try again.
So now that we've walked through that program a bit,
let's go ahead and run it and see how it works.
First, we'll type in ./narnia0,
which simply tells the computer
to run the program Narnia0.
When I hit enter,
you'll see that it brings up the correct value
is from 41414141 to deadbeef.
Here's your chance,
and it's asking you to input something.
So now I need to input my guess.
What I'm going to do is I'm going to put in 20 A's
and four B's.
The buffer, if you remember,
was only 20 characters long.
So what I'm really trying to do here
is fill up that 20-character buffer
using all of the A's.
And those four B's are going to overflow
into the value of the variable val.
So instead of having 41414141,
I'm going to have the hex value of those four B's.
And when I do that,
you'll see that the buffer is now flowing
with all of those A's
and those four B's,
and the value has changed from 41414141,
to 42424242.
And 42 is the he representation of the letter B.
So now at this point,
I'm going to go through
and try to write a short Python script
that will put 20 A's
followed by some hexadecimal characters that I want.
In this case, I want the hexadecimal value
to show up as deadbeef,
D-E-A-D-B-E-E-F.
Now, those are characters that make up a word in this case,
but actually they're just hexadecimal digits,
where the D stands for 13,
the E stands for 14,
the A stands for 10, et cetera.
So what we're going to do
is we're going to have to do this a little bit backwards.
And the reason is because this machine
is going to use Last-In-First-Out architecture
when I'm trying to attack it.
So in this case,
I'm going to use
/ef/be/ad/de,
which when combined back together,
will give me deadbeef like I want.
And I'm going to pipe that output
into the Narnia 0.C program.
So when I hit enter,
it's going to run that program
and feed that information from the Python script into it.
In this case, the buffer is now overwritten
with those 20 A's
and the four hexadecimal characters that I've added.
And you can see that the variable val
has now been overwritten
with the value of 0xdeadbeef.
This was the solution we wanted in the problem.
But all it did was return us back to the Narnia prompt.
That's because what the program did
was run itself and execute a shell,
but I was already in the shell environment.
If I was doing a buffer overflow attack like this,
I can have it run any program I want.
And so to do that and display that for you,
I'm going to go through
and actually change my Python script just a bit here.
So I'm going to run my Python script again,
but I'm going to add a little bit to it.
So I'm going to bring it up like I had last time,
and I'm going to add a semicolon,
which means, once you finish doing that command,
do this next command.
And so what I'm going to do here is echo
and then the program cat,
and I want you to show me the file narnia1
inside the Narnia pass directory.
Ideally this would be something like a password file,
like an etc shadow file
or something like that.
And then I'm going to go ahead and run that.
Now let's see what happens.
In this case, we see that the deadbeef value
is written to the value.
But then when it goes to execute that shell command,
it was past the command that I gave it,
the cat/etc/narnia_pass.narnia1.
And so what I get is the value
that was shown in that file.
In this case, that's efeidiedae.
Now, this is just a very simplistic example
of a buffer overflow attack.
If you didn't understand all the things
that I went through in this video, that's okay.
This is way beyond the scope,
but I wanted to show you what a buffer overflow attack
really looks like
when a hacker is doing this type of thing.
This is a sample for our lab environment,
but I just wanted to give you an idea of what happens.
And the big takeaway here
is that we overflowed the memory buffer
so that whatever was put in after
went and overwrote the next value in memory.
In our case, the val variable.
By doing that, we are able to then run other programs
by getting into a command shell or other things.
Whatever command that's going to be run
is going to depend on the exploit you're using,
but that initial buffer overflow
is what allows you to put that into memory.