Class 3 – Stack Zero (Protostar)¶
Objective¶
To demonstrate a buffer overflow vulnerability by modifying the value of a variable without directly accessing it.
Steps Performed¶
I navigated to the Protostar exercise directory:
cd /opt/protostar/bin
Listed the available stack exercises:
ls
Output:
stack0 stack1 stack2 stack3 stack4 stack5 stack6 stack7
I executed the Stack0 program:
./stack0
The program accepted user input. I entered a long string of A characters:
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
The program displayed:
you have changed the 'modified' variable
Screenshot: Stack0 successful exploitation
Observation¶
The program was vulnerable because it used the unsafe gets() function, which does not check input size.
The buffer was only 64 bytes, but the long input exceeded the limit and overwrote the adjacent modified variable in memory.
Input → Buffer Overflow → Modified Variable Changed
This caused the program to detect that the variable value had changed and confirm the successful exploit.
Learning Outcome¶
Through this exercise, I learned how a buffer overflow attack can modify program variables due to improper memory handling. It demonstrates why secure programming practices and proper input validation are important.
````markdown id=”q8n4m”
Practical Exercise – Stack One (Protostar)¶
Objective¶
To exploit a buffer overflow vulnerability by modifying the value of the modified variable using program input.
Steps Performed¶
In the Stack One exercise, I provided a long input as a program argument. The program stored the input in a small memory buffer.
Because the program uses the unsafe strcpy() function without checking input size, the extra characters overflowed the buffer and overwrote the nearby modified variable.
By entering the correct value:
dcba
the variable was changed to:
0x61626364
The program displayed:
you have correctly got the variable to the right value
Screenshot: Stack One successful exploitation
Observation¶
The vulnerability occurred because strcpy() copied data without limiting the input length.
Input → Buffer Overflow → Modified Variable Overwritten
The overflow allowed us to change the value of modified without directly accessing the variable.
Little Endian Explanation¶
Little endian is a method of storing multi-byte values where the least significant byte is stored first.
The required value:
0x61626364
is stored in memory as:
64 63 62 61
which represents:
d c b a
Therefore, the input had to be:
dcba
instead of:
abcd
to produce the correct value.
Why No Segmentation Fault Occurred?¶
A segmentation fault occurs when a program accesses invalid memory.
In this exercise, only the modified variable was overwritten, which was still within the program’s allocated memory area. Important control information, such as the return address, was not corrupted, so the program continued running normally.
Learning Outcome¶
This exercise demonstrated how a buffer overflow vulnerability can allow attackers to modify program variables. It also showed the importance of input validation and understanding memory storage techniques such as little endian representation. ````