Archive for June, 2019

It’s for training purpose only so you can understand what you can do with hacking buffer over flow.

In this part 2, I will show you how to execute a hidden code in a program by manipulating the return address of a stack buffer.

It’s a simple c program, compiled with gcc 4.6.1, debugged with gnu debugger 7.3 on Xubuntu 11.10 and with help of python 2.7.1 to create the exploit.

Type the code below and save to “buffer-hidden.c”.

1 #include
2 hiddencode()
3 {
4 printf("The hidden codes is running........ \n");
5 // put your codes here and //
6 // do what you want //
7 }
9 getinput()
10 {
11 char buffer[20];
12 gets(buffer);
13 puts(buffer);
14 }
16 main()
17 {
18 getinput();
19 return 0;
20 }

Compile it.

$ gcc -g -fno-stack-protector -mpreferred-stack-boundary=2 buffer-hidden.c -o buffer-hidden


Read Full Post »

I will try to explain in a simple way what is buffer Over flow.
Buffer is a fixed length memory block where you put your data. If you put data in the buffer that more than it’s capacity, then it will flow over. Like empty 100 ml glass. If you pour 120ml water in it, the 20 ml water will flow over the glass.
Of course the buffer over flow is much more complex than it.

Based on NVD (National Vulnerability Database), the US government repository of standards based vulnerability management data represented using the Security Content Automation Protocol (SCAP), Buffer Overflow is still the most occurring vulnerability the last quarter century (1988 – 2012). It’s 35% from top vulnerability type with a critical severity. And still reported until 2019 although the percentage is not that high.

The history of buffer overflow was started in 1988, when Robert Morris, a student from Cornell University, created Morris Worm. It’s the first worm computer launching in November 1988. Morris Worm took advantage of ‘gets() function’ in Unix fingered. The Worm spread very fast in Unix machines on that time.

Worm and Virus computer are ‘malicious software’, the other name is ‘Malware’ or ‘Malcode’. It’s design to damage, steal or other ‘bad’ things to data, hosts or network. The only different is Virus need a host program to spread out meanwhile Worm is stand alone. Worm spreads by exploiting the vulnerability of the target system.

Read Full Post »

If you are familiar with Norton Commander that very popular in MS-DOS time, 1986-1998, then mc (gnu midnight commander) is the clone of it. It was started by Miguel de Icaza in 1994. At first release, it was mouseless. It’s pure text user interface based. It’s part of the GNU project and it is licensed under the terms of the GNU General Public License.
There are 3 things that I most like from mc.
-Quick view of a file content.
-Access to hot list directory
-Access to FTP server

To install mc, from your Linux Terminal, type: $ sudo apt-get install mc.
To run the program, just type: $ mc.
Below is the main screen. As you can see:
Menu Title is on the top. There area Left, File, Command, Options and Right.
-There are 2 panels which display the file system.
Function Keys (F1 …. F10)
Linux prompt, where you can type linux command line here for changing directory. For example, “cd /etc”. It will display directory ‘/etc’ in active panel.


Read Full Post »

Some distros, the default editor is Nano and some is vi. I like vim, may be other users like emacs or atom.
So, how to change our preferred editor become the default text editor?

From your Linux terminal, type:

$ update-alternatives --list editor

It will display any editor installed in your system.

To change the default editor, type:

$ update-alternatives --config editor
There are 5 choices for the alternative editor (providing /usr/bin/editor).

Selection    Path         Priority    Status
*0      /bin/nano            40       auto mode
1       /bin/ed             -100      manual mode
2       /bin/nano            40       manual mode
3       /usr/bin/mcedit      25       manual mode
4       /usr/bin/vim.basic   30       manual mode
5       /usr/bin/vim.tiny    10       manual mode

Press enter to keep the current choice[*], or type selection number:

For example, from nano, I want to change to vim.

$ sudo update-alternatives --config editor
There are 5 choices for the alternative editor (providing /usr/bin/editor).

Selection     Path           Priority    Status
0           /bin/nano           40       auto mode
1           /bin/ed            -100      manual mode
2           /bin/nano           40       manual mode
3           /usr/bin/mcedit     25       manual mode
* 4         /usr/bin/vim.basic  30       manual mode
5           /usr/bin/vim.tiny   10       manual mode

Press enter to keep the current choice[*], or type selection number:

Just press Enter to quit.
Now, my default editor is vim.

Read Full Post »