All right, this is my virtual machine, and I have already logged in and I'm currently inside the X
86 and 64 directory.
As I mentioned earlier, this is the working directly through all the courts now within this victory.
I have another directly called simple underscore buffalo floor.
And within that, I do have two different files.
The first one is Makefile and the second one is vulnerable.
Dot seat.
As I can guess, the file vulnerable.
Daudzai is a simple C program which is vulnerable to Buffer overall.
If you look at this C program,
we have a function named one underscore function, which is having an argument.
This is basically the argument to the program itself and that's being passed into a variable called
input, which in turn is being copied into another variable, which is a category of length.
Two hundred and fifty six.
However, we are performing this copy using FDCPA function.
This ECPA function doesn't do any bounce checking and thus we will be able to write more than two hundred
and fifty six characters into this buffer.
And that's when the buffer of lowercase and if this overflown buffer is written onto the stack, and
if we can somehow override the return address of this function, we will be able to control the flow
of the entire program.
And that's the reason why this is called a stack based buffer overall.
Now, let's proceed to exploit this program.
Before that, we need to have a combined binary.
I have created a simple makefile to make our life easy and to also avoid mistakes.
So here it is.
That's the second file.
Now, if you look at this, when you run make command, this line will be executed.
We are simply using GTC and we are passing the program vulnerable Nazih as input and we are producing
the binary vulnerable as output.
There are two important arguments that are worth noting here.
The first one is ethnos stack protector.
What this is going to do is it will be able stack guarantee protection.
And the second one is Dasch, the exec stack.
This is going to disable next bit for this executable so that the stack will be executable for us.
Essentially, we are disabling Anex using this option bash the exact stack.
This is important before proceeding with this example, because as I mentioned earlier, to start with,
we are going to exploit this binary without any protections.
We don't want to build on binary with protections at this point of time.
We are going to discuss how to bypass some of these protections like Anex and SLR in later videos.
Now, let's go ahead and disable SLR as well before disabling it.
Let's quickly check the value of the file.
Pronk, we need to have sort of here slash this slash colonel slash randomise
underscore, we underscore space.
Let's surrender.
Look at that.
This file randomise underscore we are in this space.
Has the value to this means ASALA is fully enabled.
Now let's go ahead and disable SLR by writing the manual zero into this file.
Now to simplify this process of verifying whether SLR is enabled or disabling SLR or enabling Arsala,
I have written a few helper scripts.
So in my ex 086 Underscore 64 directory, I created another folder called Asla and inside this I do
have three different files that simple helper scripts to help us with enabling and disabling SLR.
Let's first check the file verifying dash SLR dot such as you can see it is just doing a simple cat
on this file so we can also use this file to verify if salaries enabled.
As it can see currently ASALA is fully enabled.
Now if you want to disable SLR, we can use the file disable dash SLR, dot S.H..
As you can see, this is writing the value zero into this file, so let's quickly type pseudo dot,
slash, disable dash, SLR dot message.
Now let's once again verify if A is enabled.
There you go.
The value is now set to zero, so ASALA is now disabled on this mission.
Now we are fully ready to exploit this vulnerable program.
So let's compile it and produce the executable binary.
So let's go to simple Buffalo Placeholder and let's quickly type make this should have produced a new
file which is vulnerable.
Now let's quickly type file space vulnerable.
As you can see, this is an alpha binary and it's a 64 bit binary.
Let's quickly go ahead and run it and see what happens.
Nothing happens, let us probably pass a simple argument and observe what happens once again, nothing
happens.
It is intentional that it doesn't do anything apart from taking input and then copying it into another
variable, using a Stackpool function.
Right.
So that's all for this video.
In the next video, we are going to see how to crash this application.