Session 3: Software security / memory safety¶
Section 1 - Environment Setup¶
- Qemu already installed in the VM
- Downloaded the Protostar exploit virtual machine from exploit.education/protostar
- From the desktop terminal, ran the virtual machine with QEMU; typically:
qemu-system-x86_64 -boot d -cdrom ~/Downloads/exploit-exercises-protostar-2.iso -m 512 - Logged to the virtual machine; username and password are on the protostar page
- Navigated to the right directory (instructions on the Protostar page)
Section 2 - Exercise 1 - Stack zero¶
The code
#include <stdlib.h>
#include <unistd.h>
#include <stdio.h>
int main(int argc, char **argv)
{
volatile int modified;
char buffer[64];
modified = 0;
gets(buffer);
if(modified != 0) {
printf("you have changed the 'modified' variable\n");
} else {
printf("Try again?\n");
}
}
Try until you get “you have changed the ‘modified’ variable¶
What happened?¶
The C program was given input through the terminal. Instead of typing the input manually, Python was used to generate the input. The command python -c "print('HELLO' * 100)" tells Python to print the word HELLO one hundred times. The pipe symbol | then sends that Python output as input to the C program /opt/protostar/bin/stack0. As a result, the C program receives a long string and reads it inside the main() function.
How can gets(buffer) change the value of modified?¶
The line gets(buffer) stores the user’s input inside buffer, which has space for only 64 characters. However, gets() is unsafe because it does not check the input length. If the input is longer than 64 characters, the extra characters continue to be written into nearby memory. Since the variable modified is stored close to buffer in memory, the overflowing input can overwrite it. Therefore, although modified was originally set to 0, the long input changes it to a non-zero value. Because the program checks if(modified != 0), it prints you have changed the ‘modified’ variable.
What does “Segmentation fault” mean?¶
A segmentation fault is an error that occurs when a program tries to access memory that it is not allowed to use. In this case, the long input not only changes the nearby modified variable, but may also corrupt other important memory used by the program. The success message appears first because the program is still able to run the printf() statement. The crash happens later, usually when the program tries to finish and return from main() using corrupted memory. At that point, the operating system stops the program and displays Segmentation fault.
Section 3: Exercise 2 - Stack 1¶
The code
#include <stdlib.h>
#include <unistd.h>
#include <stdio.h>
#include <string.h>
int main(int argc, char **argv)
{
volatile int modified;
char buffer[64];
if(argc == 1) {
errx(1, "please specify an argument\n");
}
modified = 0;
strcpy(buffer, argv[1]);
if(modified == 0x61626364) {
printf("you have correctly got the variable to the right value\n");
} else {
printf("Try again, you got 0x%08x\n", modified);
}
}