The Art of Hacking: Coding Sample Exploit – Scene 1

There is a beneficial co-evolution between the hackers securing systems and those breaking into them. This competition provides us with better and stronger security. The net result of this interaction is positive, as it produces smarter people, improved security and more stable software. A properly patched system should be immune to attack.So if there aren’t any patches, what can be done to prevent hackers. If you know how exploits are written then you are better understanding of securing systems. I hope this article will prompt you to contribute to the art of hacking in some way, regardless of which side you choose to be on.

A program can only do what it’s programmed to do. Unfortunately, what’s written doesn’t always coincide with what the programmer intended the program to do. For example, how many items between M= 22 and N = 8? The obvious answer is M − N, or 22 − 8 = 14 items. But this is incorrect, because there are actually M − N + 1 items
(22 – 8 + 1). That’s exactly how errors can happen.

The most common type exploit are buffer-overflow ones. The goal is to take control of the target program’s execution and running a piece of malicious code that can be injected into memory in some ways. This is known as execution of arbitrary code. An understanding of these type of exploits is more powerful. However, a prerequisite to understanding these exploit techniques is a much deeper knowledge of programming concepts(especially in C) file permissions, variables, memory allocation(EIP, EBP, ESP), functions, and assembly language. I’ll not explain all of these stuff, you should gain knowledge on them with your own effort.

In C, once a variable is allocated memory, there is no mechanism to ensure that the contents of a variable fit into the allocated memory space. If a programmer wants to put 10 bytes of data into a buffer(array) that had only been allocated 8 bytes of space. This type of action is allowed in C, even though it will most likely cause the program to crash. This is known as a Buffer Overflow. Since the extra 2 bytes of data will overflow, overwriting whatever happens to come next. If a critical piece of data is overwritten, the program will crash. The following code is an example. Let’s take a look at and try to understand what is going on with our example before coding our own exploit.

void overflow_function ( char *str) {
char buffer[22];
strcpy(buffer, str); //Fuction that copies str to buffer
}

int main() {
char big_string[128];
int i;

for (i = 0; i < 128; i++) //Loop 128 times
{
big_string[i] = ‘A’; // Fill big_string with ‘A’ s
}
overflow_function(big_string);
exit(0);

Here are the program results:
$ gcc – o testoverflow testoverflow.c
$ ./testoverflow
Segmantation fault
$

The program crashed as a result of the overflow. These types of errors are common and are easy to fix, as long as the programmer knows how big the expected input is going to be. Often, the programmer will ensure that a certain user input will always be a certain lenght and will use that as a guide. But hacking involves thinking about things that weren’t expected. A program that runs fine for several years might suddenly crash when a hacker decides to try inputting a thousand chracters into a field that normally only uses several, like a username field.

So, a clever hacker can cause a program to crash by inputting unexpected values that cause buffer overflows, but how can this be used to take control of the program execution? The answer can be found by examining the data that actually overwritten. This topic will be explained in the next scene!