In attacks on programs, such as stack buffer overflows, what is the objective of the attacker? I’m having trouble learning the technical details of the attack (such as overwriting the function’s return address) because it’s not clear what such attacks are intended to achieve.
They're intended to achieve remote code execution. This means they want to execute code in your program by overflowing the expected input. You always want to check that your input corresponds to the correct length.
Let's look at it from a different perspective: mind-control. What if you could control someone's mind to do whatever you want them to do?
Let's say there's an exploit in someone's brain where they can only take 8-character commands. Anything outside of that gets executed because it isn't checked for.
You: Hi there. Please respond with "Hello..."
["Hello..." is 8 characters]
Victim: Uhm, okay. Hello...
[brain is only capable of processing 8 characters]
You: Please respond with "Cake."
Victim: Uh, "Cake."?
You: How about "Hello...
<shellcode to make them say "Buffalo!", beyond the original 8 character limit>"
Victim: Wait, What did you just do to me?
You: How are you gentlemen! All your buffalos are belong to us.
Now what if "Buffalo!" was shellcode designed to execute any kind of code you want, such as the downloading of a
For example, in SQL injection, it’s usually done to get confidential information or make the server run code. It seems like the prerequisite for a buffer overflow attack is for the attacker to already have the ability to run code on the machine, so what more do they want?
Because buffer overflows, like any kind of exploit that allows for remote code execution, are usually the result of a flaw in someone else's code. Like SQL injection, you are trying to get the remote machine to execute code.
This could be something as simple as sending a malformed command to a normal program. You could also implement intentional vulnerabilities your own programs. Some less-than-scrupulous individuals may do that.
There are lots of RCE vulnerabilities in various languages. The trick is to find something - anything - that allows you to run code/commands on the target in question that open up further opportunities to gain additional access.