lioumens / cs310_server_exploit Goto Github PK

*************************
*  Project 2: Group 18  *
*************************

Group Members: Reyina Senatus, Steven Pierre, Michael Liou

Overview of Attack
==================

The buffer overflow that we exploit is implicit cast from a 4 byte int to a 1
byte in the function that checks the length of the filename. We inject the
string to replace the return address to someplace on the stack with our
shellcode. The shellcode simply opens a new port and binds the stdin and stdout
to the port number 1337. The source of the shellcode can be found here

http://shell-storm.org/shellcode/files/shellcode-882.php

The actual request string can be found on the third line of the file
"request.txt". The general format of the request string is as follows:

********************************************************************************
** Return Address (200 bytes)  ** NoOps (500 bytes)   * Shellcode (89 bytes)  **
********************************************************************************

789 bytes cast to 1 byte will be less than 100 and will be written to memory. The stack frame turns out to be around 140 bytes. That is, the distance from
where filename starts and the return address. 200 bytes are used as a safety to
make sure it has been overwritten. The return address will return to somewhere
in the region of NoOps, and will slide to the start of the Shellcode. Once the
port is created, we use another shell to execute the following command to
connect to the shell:

nc 310test.cs.duke.edu 1337

The return address we guessed includes a 1 GB kernel at the top of the address
space for the 32bit machine.


Overview of Project
===================

We learned a lot from this project. I think it was very educational to also know
what each of the flags did during compilation and the current security measures
against buffer overflow attacks. The necessity of learning GDB will be fairly
helpful in the future, and greatly appreciated. We appreciated being able to
copy and paste the shellcode from shell storm and not having to write our own shellcode.