Exploit a stack overflow vulnerability.

This video is about a stack overflow vulnerability. We will program 2 programs, the first one will have a stack overflow vulnerability in it and the second one will take advantage of that to execute code that shouldn't otherwise be executed!

Category:

Howto & Style

Tags:

• Programming
• Stack
• Overflow
• vulnerability
• Security
• bakkich
• abdelhakim

[invisibleheero]

first of all, everyone who codes PROPERLY and EFFICIENTLY knows that strcpy() is horrible for overflows. How about if one is to write a program, make proper bounds checking..

[youhakim]

My mistake! I was thinking that people who watch this video are intelligent enough to understand that this is a simple demonstration of a buffer overflows and how it works!

[unknown84]

What kind of harm overflows can make! I do not see that overflows can benefit the hacker to control over my algorithm, etc.

[youhakim]

Well, the hacker can own your computer if he succeeded in exectuing code that expoits a buffer oveflow vulnerability in a particular software. Let's suppose you use Internet explorer to visit a web site, the website happens to host malicious code that exploits one of -a known or not- buffer overflows in IE, ... if this happens and it does a lot then you can imagine the harm!

The video simplfy things because I used the exploit to execute internal code!

[meaculpa1]

Hakim, your name is familiar to me, its been a long time u did not post something else, is any thing new coming up ?

[youhakim]

Yeah, it's true that I didn't post anything since a long time, and I am sorry for that because I am busy all the time these days and I have no PC at home to record videos, ... I have only a laptop to do my work, you know ... the work that pays the bills :)

Thanks meaculpa1 for your comment.

[dosattack777]

invisiblehero keep your negative comments to yourself. This dude has done a good job in posting some nice vids on assembly and others don't ruin that.

[Crux161]

Nicer job! So if program 1 was an OS or other essential component like IE, you could serve this to computer inside a commonly installed app, or commonly visited website. The error would occur, and you could change the system. This is a fun video, thanks for the tutorial! Seeing this done in assembly would have been nice too! Yay op codes!

[coder4fun]

nice video!

[tremitor]

good

[DerekChaunessey]

I was on cnn . com and a box popped up that said "Stack overflow at line: 0". What the hell is this?

[arfor]

i dont get it all, becuz of the acent, but great dude! thanks for sharing :D

[Kinjamaimai]

@ProDiago Have a look at how an operating system behaves in a buffer overflow situation. Typically you would introduce code into memory then, through the use of buffer overflow, cause the processor to execute the code beginning at that particular adress in memory.

In most cases, this is code that elevates your access priviliges on the system to that of an administrator. After that, it's christmas.

Disclaimer: It is (probably) illegal to do it the way you are thinking of it right now.

[mahcuz]

You code in notepad?!

[ProDiago]

Hi

In instances where you can cause similar overflows, how could you use this as an injection vector to insert commands to change the program?

In your example, the ASCII for "C" appears, but how could this be adapted to exploit a system vulnerability with overflows?

Thanks. Great videos too.

[invisibleheero]

oh I wasn't giving you shit bro lol.

just saying that programmers should learn to code EFFICIENTLY.