1

I am really trying to understand the concept of the attack made possible by the code given below.

I notice that strcpy is being used, which does not perform any boundary checks and therefore enables buffer overrun attacks. Also, since malloc and free are being used, I know this example code is trying to illustrate the concept of a heap overrun attack.

Ok. What do I know about the heap? It will look sth like this: the heap

And all the commandline arguments can be used to overwrite what is following on the heap after them. What would I like to overwrite? And what would I want to overwrite this memory location with?

malloc() calls the unlink() makro, which takes an element (a chunk) from the double-linked free list, and free() calls the frontlink() makro, which adds a chunk to the free-list.

Now, I know I want to overwrite some backward- or forward pointer. Just which one exactly ?

Let's have a look at the frontlink() makro:

BK = FD->bk;
P->bk = BK;
P->fd = FD;
FD->bk = BK->fd = P;

Whenever we call free(), we want to add P to the free-list. It will simply be put where ever there is a large enough gap in the free-list, I think. And now we have a look at the element below (BK) P and at the element above P (FD). And then we perform the actions given above, where fd is the forward pointer and bk is the backward pointer.

I don't even know if this frontlink() thing is important for this attack. Can anyone explain to me how the code given below may be exploited? Please give me an easy to understand answer, since I am really new to this matter. Thanks for your help!

#include <stdlib.h>
#include <string.h>
#include <stdio.h>

void winner(void)
{
  printf("that wasn't too bad now, was it?\n");
}

int main(int argc, char **argv)
{
  char *a, *b, *c;

  a = malloc(512);
  b = malloc(512);
  c = malloc(512);

  strcpy(a, argv[1]);
  strcpy(b, argv[2]);
  strcpy(c, argv[3]);

  free(c);
  free(b);
  free(a);

  printf("dynamite failed?\n");
  return 0;
}

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.