Lab Exercise 2

Due: November 6, 2019
Points: 100

(100 points) This laboratory exercise has you implement a buffer overflow. The regular one is a simple overflow that causes a parameterless routine to execute. The extra credit is a return-to-libc (or arc) attack.

You will need a virtual machine available via the web at http://nob.cs.ucdavis.edu/classes/ecs153-2019-04/lab2. The password is “ubuntu” (without the quotes, of course). When you start the virtual machine, you will find two programs, bad.c and realbad.c and two executables, bad and realbad, in your directory. Note the last executable is setuid-to-root.

A word of warning. Ubuntu Linux comes with a defense called “address space layout randomization” (ASLR). This must be off for you to complete this exercise successfully. It is turned off in the virtual machine you download, but it gets turned on automatically whenever you restart the machine. So, after you restart, log in and type the following command to turn it off:

Regular Buffer Overflow

In your home directory is a program bad.c (also see below). This program contains a buffer overflow vulnerability; see the call to gets(3) at line 13. Your job is to exploit the overflow by providing input to the running process that will cause the program to invoke the function trap (which, you may notice, is not called anywhere else). You will know you’ve succeeded when you run the program, give it your input, and it prints “Gotcha!” This is called a “return-to-libc” or “arc” attack.

The following questions will help guide you. Please turn in your answers to them, a hex dump of the input you use to call trap, and a typescript or screen shot of you running the program bad, giving it your input, and showing its output.

1. What is the address of the function trap? How did you determine this?
2. What is the address on the stack that your input must overwrite (please give both the address of the memory location(s), and their contents)? How did you locate this address?
3. What is the address of buf?
4. The sled is the input you give to alter the return address stored on the stack. What is the minimum length your sled must be?

Extra Credit: Buffer Overflow with Program Execution

(50 points) Now extend the overflow attack. In your home directory is another program realbad.c (also see below). As before, this program contains a buffer overflow vulnerability. Your job is to exploit the overflow by providing input to the running process that will cause the program to invoke the function runcom and cause the system(3) function to be executed with a command embedded in the input you have given. You must pass in a parameter that is a Linux command, which the program will then execute. (I recommend the command id(1).)

Please turn in the following:

1. A hex dump of the input you use. Please also show where the parameter to runcom is in your input.
2. A screenshot of the program’s output for that input.

Recovery

If you accidentally delete or change the executables, you can recreate them yourself. First, compile the source using gcc with the option –fno-stack-protector; if you omit this flag, the attempt to overflow the stack will be blocked and so the lab will not work. That’s it for bad. For realbad, once you compile it, do the following:

sudo chown root realbad
sudo chmod 4755 realbad

and enter the password given above when asked.

The Programs

bad.c

 
#include <stdio.h>
#include <stdlib.h>

void trap(void)
{
	printf("Gotcha!\n");
	exit(0);
}

int getstr(void)
{
	char buf[12];
	gets(buf);
	return(1);
}

int main(void)
{
	getstr();
	printf("Overflow failed\n");
	return(1);
}

realbad.c

#include <stdio.h>
#include <stdlib.h>

void runcom(char *cmd)
{
	system(cmd);
	exit(0);
}

int getstr(void)
{
	char buf[12];
	gets(buf);
	return(1);
}

int main(void)
{
	getstr();
	runcom("echo Overflow failed");
	return(1);
}

Matt Bishop Office: 2209 Watershed Sciences Phone: +1 (530) 752-8060 Email: mabishop@ucdavis.edu

ECS 153, Computer Security Version of October 22, 2019 at 8:27AM

You can also obtain a PDF version of this.