-: The next type of exploit that were going to cover
is called a buffer overflow.
A buffer overflow occurs when a process
in a program stores data outside the memory range allocated
by the developer.
Now, this begs the question, what exactly is a buffer?
Well, a buffer is simply a temporary storage area
that a program uses to store its data.
Let's pretend that you have a glass sitting on a table.
It can hold a certain amount of water, right?
If it's designed to hold 16 ounces of liquid,
but you pour 20 ounces in, well,
the cup is going to overflow with water
and the table is going to get wet.
In this example, the glass is our buffer,
and when we overflow it with our data, in our case water,
the extra is going to spill out onto the table
and make a huge mess.
Buffer overflows in the IT world can also create
a big mess for us.
In fact, 85% of the data breaches were caused by
a buffer overflow attack being used
as the initial attack vector.
So, let's take a closer look at how
a buffer overflow attack really works.
Let's pretend you wanted to store my phone number into
your contacts list.
Here in the United States, our phone numbers consist
of 10 digits.
The first three digits are for our area code,
which represents the city we live in.
And the last seven digits represent
the person's unique phone number.
Before we had cell phones, you would simply pick up
the phone and dial seven digits of your phone number
because the telephone company assumed you wanted
to place a local call within your own city or area code.
So, let's pretend that the person who designed
the contact list application on your phone decided
they wanted to save some memory space
and they wanted to use the smallest buffer possible,
so they decided to use an eight-digit buffer because
they are going to assume that you don't need to store
an area code because you're going to make local calls.
So, let's store my made-up phone number, 555-1234,
into an eight-digit buffer called A.
When I do this, you'll see that it takes up
the first seven boxes labeled zero through six,
because computers always start counting with zero,
like you learned back in A+.
What happens, though, if we try to enter a number
that's too long?
Well, Buffer A isn't the only memory buffer
that your contact list application can use.
Right after Buffer A is Buffer B
and then Buffer C and so on.
So, let's consider how we store a longer phone number.
For example, let's say you're out on vacation
and you meet somebody but they don't live in your city.
Well, in this case, you need to store the area code
and the phone number, like 410-555-1234.
Since this now includes the area code
for Annapolis, Maryland, we now have ten digits
we need to store, but each buffer is only eight digits long
because our programmer didn't quite think through all
of the different types of phone numbers that one might need
to store in their list.
So, our contact list application tries to store
this ten-digit number in an eight-digit buffer.
But the last two digits overflow Buffer A
and go into Buffer B.
This is exactly what happens with a buffer overflow.
Now, why is this a bad thing?
Well, to explain that, we have to get
a little bit technical, so bear with me.
Each program reserves a chunk of system memory
when it's run.
This allows it to have a place to store data
that it needs during processing.
This area is known as a stack.
A stack is a reserved area of memory
where the program saves the return address
when a function call instruction is received.
Here is an example of a stack that's organized
as first in, last out.
Basically, this means that the first thing
that's placed in the stack is the last thing to be removed
and data is filled from the bottom of the memory,
which is shown as the top of our screen,
to the top of the memory, shown at the bottom of our screen.
Now, I apologize for this being what looks like
it's upside-down, but this is actually
the standard convention used in the IT world.
I wanted to introduce it to you now
so you won't get confused in your later studies.
Now, if an attacker places too much information into
the stack or changes the value of that return pointer,
they can carry out an attack.
This is what they're attempting to do with
a buffer overflow, they're attempting to overwrite
the return address of the pointer so that it will point
to a different place in the stack where they've placed
their malicious code.
That way, when the non-malicious code is run
and hits that return pointer, it's going to return
to the attacker's malicious code,
such as the /bin/shell code shown here,
and this is going to give them a shell or a command prompt
on the victim system where they can then perform
a remote code execution using that shell.
When an attacker is able to do this,
it's known as smashing the stack.
This occurs when an attacker fills up the buffer with a NOP,
or a non-operation instruction,
so that the return address may hit one of these NOPs
and continue on until it finds the attacker's code
and runs it.
When this series of NOPs is hit by a non-malicious program,
because the attacker's filled up the buffer
with NOPs and a return address to his malicious code,
this is known as a NOP slide.
The NOP instruction, essentially, is an instruction
that tells it to do nothing and simply go
to the next instruction and it will continue to do this
and slide down until it hits that final return pointer
and that causes the program to branch over
to that memory address.
One of the mitigations against a buffer overflow attack
is the use of address space layout randomization,
also known as ASLR.
This is a programming technique that helps prevent
an attacker's ability to guess where the return pointer
for a non-malicious program has been set to call back
by randomizing the memory addresses used
by well-known programs, such as parts
of the operating system.
ASLR was first introduced back in Windows Vista
as a way to prevent buffer overflow attacks,
but there are methods used by attackers to help bypass ASLR
like side-channel attacks, too.
Like I said, this is a very technical concept,
and it's not one that you need to understand in-depth
for the Security+ exam.
When you move on to the PenTest+ exam later,
you'll come back and look at buffer overflows
in much more technical depth.
But for the Security+ exam, you just need to remember
that a buffer overflow is used to put more data
into memory than it's designed to hold.
The intent here is to overflow the buffer
for the non-malicious program in an effort for the attacker
to be able to get their malicious program into memory
and allow it to be run.
In the next lesson, I'm going to show you
how a buffer overflow attack works in a lab environment
and I'm going to walk you through how
an attacker might perform one.
This demonstration is not required to fully be understood
for the Security+ exam, but I think it'll help you better
solidify how a buffer overflow attack actually works
in the real world.
And that's why I'm going to show it to you.