What is a simplest “Crash an application” demonstration to get access to a system?

Question

For a presentation (10-15 mins) purpose what is the simplest demonstration of "crashing an application" on a machine can be done.

Answer 1

Typically buffer overflows are good - it is generally easier to make one give a crash result than a useful compromise result.

And in general looking at the security advisories lists will be your best bet for current exploits that will crash a server, app or platform.

Answer 2

The classic document on buffer overflows is Smashing The Stack For Fun And Profit. The examples require a Unix based system, e. g. Linux.

The main example is based on a vulnerable program which is flagged to be executed with super user permissions. Then a second program exploits the vulnerability and ends up with a shell that has super user permissions.

Answer 3

If you just need to perform a buffer overflow and demonstrate how you would hypothetically take control of the EID to inject shellcode, then you could just write a small C application that just reads in a single command-line argument, and then does a copy() function to move the value into another variable. Then run that command with a huge input string with a debugger (such as GDB in *INX) and you can see it crash and get the memory and register information.