Buffer overflow

Might toss in a bit of info here, on how hackers, coders, researchers so on actually spot buffer overflows.

Most readers will know that a buffer overflow is basicly a problem which is based in the memory where a program stores data.

The trick is to get something you want i.e shellcode into the place where the buffer overflow overwrites expecific memory, so you can get your code to do what its got to do.

Heres some code which may shead light on things for some people, this pice was grabbed from the web

---

Partial code below

---

main(int argc, char **argv) {

char *somevar;
char *important;

somevar = (char *)malloc(sizeof(char)*4);
important = (char *)malloc(sizeof(char)*14);

strcpy(important, "command"); /*This one is the important
variable*/
stcrpy(somevar, argv[1]);


..... Code here ....

}

.... Other functions here ....

---

End Of Partial Code

---

So let's say that important variable stores some system command like, let's
say "chmod o-r file", and since that file is owned by root the program is run
under root user too, this means that if you can send commands to it, you can
execute ANY system command. So you start thinking. How the hell can I put
something that I want in the important variable. Well the way is to overflow
the memory so we can reach it. But let's see variables memory addresses.
To do that you need to re-written the code. Check the following code.

---

Partial Code

---

main (int argc, char **argv) {


char *somevar;
char *important;

somevar=(char *)malloc(sizeof(char)*4);
important=(char *)malloc(sizeof(char)*14);

printf("%p\n%p", somevar, important);
exit(0);

rest of code here

}

---

End of Partial Code

---

Well we added 2 lines in the source code and left the rest unchanged. Let's
see what does two lines do.
The printf("%p\n%p", somevar, important); line will print the memory
addresses for somevar and important variables. The exit(0); will just keep the
rest of the program running after all you don't want it for nothing, your goal
was to know where is the variables are stored.

That pice may open some peoples eyes for others maybe not
:cool:

thats it the one by Ghost_Rider from the hack co za archive ran by gov-boi

Heres some other links to more papers

http://www.linux.com.cn/hack.co.za/papers/basicoverflows/index.html

http://www.linux.com.cn/hack.co.za/papers/advancedoverflows/index.html

yeah god bless my clip board