-: In this demonstration, I'm going to show you
how a Buffer Overflow Attack is conducted.
Now, I'm going to do this by using
a simple program that's written here.
This program is called Narnia 0.C.
This tells me that the program was written
in the C programming language.
You can see it displayed here on the screen.
Now, you don't have to be an expert in the C language
to understand what this program is doing, though.
I'm going to walk you through it step-by-step.
And then I'm going to show you how we throw this
Buffer Overflow Attack to exploit this program.
Now, the first thing that we can see is that there are
two statements that start with the word include.
This is just saying that we're going to include
these third-party libraries.
The standard input-output library
and the standard library itself.
After those two include statements
we get the main part of this program.
This is called Main.
If you see the first thing, we have a long variable.
And that value is 0x41414141
Followed by that, we have a character array
being set up called Buffer, that is 20 items long.
This means that the buffer can only hold
20 pieces of information, or 20 characters, in this case.
Next, we have the print F statement,
which basically says
put everything in between the quotes onto the screen
when you run this program.
Then, it goes and asks you here is your chance to try it.
And then it asks by scanning
what the input is from the keyboard.
And that input is going to be stored into the buffer.
Once you've inputted what you want to the buffer,
it's going to print out the two variables.
What's stored in buffer, and what's stored in value.
After displaying both variables to the screen,
it's going to see what the value was.
If the value equals 0xdeadbeef,
meaning we've overflowed the buffer
with the characters that make up deadbeef,
then the system will give you a shell prompt.
Which means you're going to have access to that system
to conduct any kind of programs you want.
If not, it's going to say WAY OFF!!!!
and it's going to exit the program.
And you'll have to try again.
So now that we've walked through that program a bit,
let's go ahead and run it and see how it works.
First we'll type in ./narnia0
which simply tells a computer to run the program Narnia0.
When I hit enter, you'll see that it brings up
the correct value is from
41414141 to deadbeef.
Here is your chance, and it's asking you to input something.
So now, I need to input my guess.
What I'm going to do is I'm going to put in 20 A's
and four B's.
The buffer, if you remember, was only 20 characters long.
So what I'm really trying to do here
is fill up that 20 character buffer
using all of the A's,
and those four B's are going to overflow
into the value of the variable val.
So instead of having 41414141,
I'm going to have the hex value of those 4 B's.
And when I do that, you'll see that the buffer is now flowing
with all of those A's, and those four B's
and the value has changed
from 41414141
to 42424242.
And 42, is the hex representation of the letter B.
So now at this point, I'm going to go through
and try to write a short python script
that will put 20 A's followed by some
hexadecimal characters that I want.
In this case, I want the hexadecimal value
to show up as deadbeef.
D-E-A-D-B-E-E-F.
Now, those are characters that make up a word in this case
but actually, they're just hexadecimal digits.
Where the D stands for 13, the E stands for 14,
the A stands for 10, et cetera.
So what we're going to do is
we're going to have to do this a little bit backwards,
and the reason is because this machine is going to use
last in, first out architecture
when I'm trying to attack it.
So in this case, I'm going to use \ef, \be,
\ad, \de
which when combined back together
will give me deadbeef like I want.
And I'm going to pipe that output into the Narnia 0.C program.
So when I hit enter, it's going to run that program
and feed that information from the python script into it.
In this case, the buffer is now overwritten
with those 20 A's,
and the four hexadecimal characters that I've added.
And you can see that the variable val
has now been overwritten
with the value of 0xdeadbeef.
This was the solution we wanted in the problem.
But, all it did was return us back to the Narnia prompt.
That's because what the program did was run itself
and execute a shell.
But I was already in the shell environment.
If I was doing a Buffer Overflow Attack like this,
I can have it run any program I want.
And so to do that and display that for you,
I'm going to go through and actually change
my python script just a bit here.
So I'm going to run my python script again,
but I'm going to add a little bit to it.
So I'm going to bring it up like I had last time
and I'm going to add a semicolon, which means
once you've finished doing that command,
do this next command.
And so what I'm going to do here is echo,
and then the program cat,
and I want you to show me the file
Narnia one, inside the Narnia pass directory.
Ideally, this would be something like a password file.
Like an etc shadow file, or something like that.
And then I'm going to go ahead and run that.
Now, let's see what happens.
In this case, we see that the deadbeef value
is written to the value.
But then when it goes to execute that shell command,
it was passed the command that I gave it.
The cat/etc/narnia_pass/narnia1.
And so what I get the value that was shown in that file.
In this case that e-f-e-i-d-i-e-d-a-e.
Now, this is just a very simplistic example
of a Buffer Overflow Attack.
If you didn't understand all of the things
that I went through in this video, that's okay.
This is way beyond the scope of Security+.
But I wanted to show you what a Buffer Overflow Attack
really looks like when a hacker is doing this type of thing.
This is a sample for our lab environment,
but I just wanted to give you an idea of what happens.
And the big takeaway here is that
we overflowed the memory buffer,
so that whatever was put in after
went and overwrote the next value in memory.
In our case, the val variable.
By doing that, we are then able to run other programs,
by getting into a command shell or other things.
Whatever command that's going to be run
is going to depend on the exploit you're using.
But that initial buffer overflow is what
allows you to put that into memory.