Exploit a stack overflow vulnerability.

[Crux161]

Nicer job! So if program 1 was an OS or other essential component like IE, you could serve this to computer inside a commonly installed app, or commonly visited website. The error would occur, and you could change the system. This is a fun video, thanks for the tutorial! Seeing this done in assembly would have been nice too! Yay op codes!

[coder4fun]

nice video!

[tremitor]

good

[DerekChaunessey]

I was on cnn . com and a box popped up that said "Stack overflow at line: 0". What the hell is this?

[arfor]

i dont get it all, becuz of the acent, but great dude! thanks for sharing :D

[mahcuz]

You code in notepad?!

[ProDiago]

Hi

In instances where you can cause similar overflows, how could you use this as an injection vector to insert commands to change the program?

In your example, the ASCII for "C" appears, but how could this be adapted to exploit a system vulnerability with overflows?

Thanks. Great videos too.

[Kinjamaimai]

@ProDiago Have a look at how an operating system behaves in a buffer overflow situation. Typically you would introduce code into memory then, through the use of buffer overflow, cause the processor to execute the code beginning at that particular adress in memory.

In most cases, this is code that elevates your access priviliges on the system to that of an administrator. After that, it's christmas.

Disclaimer: It is (probably) illegal to do it the way you are thinking of it right now.

[dosattack777]

invisiblehero keep your negative comments to yourself. This dude has done a good job in posting some nice vids on assembly and others don't ruin that.

[invisibleheero]

first of all, everyone who codes PROPERLY and EFFICIENTLY knows that strcpy() is horrible for overflows. How about if one is to write a program, make proper bounds checking..

[youhakim]

My mistake! I was thinking that people who watch this video are intelligent enough to understand that this is a simple demonstration of a buffer overflows and how it works!

[invisibleheero]

oh I wasn't giving you shit bro lol.

just saying that programmers should learn to code EFFICIENTLY.

[pakistanzindabada]

yeah i learned buffer overflow!!! (stack bufer overflow),can u tell me something

in dev c++ 5 bytes bufer requires 27 AAAAAAAAAAAA to overflow!!!

can u tell us abt it thx

[pakistanzindabada]

hello!! thx man spend many weeks on searching on buffer overflow!!!

PLS PLS PLS POST SOME MORE VDS ON BUFFER OVERFLOW !!!

ALSO SHELL CODING

[DeutscherKonvertit]

Yeah, abdelhakims Videos are nice,

BUT Where do you find such easy examples of Stackoverflows? :>

[unknown84]

What kind of harm overflows can make! I do not see that overflows can benefit the hacker to control over my algorithm, etc.

[youhakim]

Well, the hacker can own your computer if he succeeded in exectuing code that expoits a buffer oveflow vulnerability in a particular software. Let's suppose you use Internet explorer to visit a web site, the website happens to host malicious code that exploits one of -a known or not- buffer overflows in IE, ... if this happens and it does a lot then you can imagine the harm!

The video simplfy things because I used the exploit to execute internal code!

[blenderuser]

Buffer overflows are still the most used and the easiest way to get control of a computer. I think most of all worms exploits buffer overflows. So yes, it's "kind of dangerous".. Even the new Conficker worm uses buffer overflow to infect computers. Think of it as, making the hacker execute whatever he likes - as he controls the return address.

[chapichapobip]

forget it, i got it

thx

[chapichapobip]

hello, i have what seems to be a stupid question for those who know the answer but how do i try this under windows vista ?

i mean i don't have the "error signature" window which appears when i try the first AAAABBB test thing, but only that small one telling that vista is looking for a solution to the problem then nothing...

how do i turn this on or is there any other way to get the offset information ? thx

[meaculpa1]

Hakim, your name is familiar to me, its been a long time u did not post something else, is any thing new coming up ?

[youhakim]

Yeah, it's true that I didn't post anything since a long time, and I am sorry for that because I am busy all the time these days and I have no PC at home to record videos, ... I have only a laptop to do my work, you know ... the work that pays the bills :)

Thanks meaculpa1 for your comment.

[assntities18]

Pretty good video, hit me up. I'm thinking about starting a group for certain genres of software if you arent involved with any scenes.

A&T

- Ex C.O.R.E Officer

[youhakim]

No I am not involved with any group.

Thank you for your comment.