Execution condition for buffer overflow

Question

I have an old Beaglebone Black board which is similar to Raspberry Pi. Unfortunately, I forgot the Linux login password and can access the Linux using the Cloud9 feature. With this I can log into the Linux as a common user but cannot use any sudo commands.

In this situation, I can just wipe the microSD and reinstall the OS. But it might be a good chance to learn a penetration method. I can write C program and execute as a common user, then is it possible to execute a buffer overflow attack to reset my password?

Answer 1

I can write C program and execute as a common user, then is it possible to execute a buffer overflow attack to reset my password?

No, because by definition, any program you can write and run will run as you. Any buffer overflow would execute code as you, not as root.

You would want to overflow a setuid-root program, but without root privileges, you can't create one. Of the setuid-root programs already on the computer, you should not expect to be able to execute a buffer overflow against them; they're well vetted and secure.

Your best bet to get in is to interrupt the boot cycle and convince the boot loader to allow you to boot directly into a shell. Unfortunately, on specialized hardware, I've no idea how accessible GRUB or whatever boot loader is in use will be.

---

Update - ironically, in January 2021 a buffer overflow against one of those "well vetted and secure" system setuid binaries was announced - Baron Samedit. So while I still wouldn't expect to find a hole in one, perhaps you should feel free to try.

Answer 2

You need to have root privileges to modify your password. This can be done by supplying the passwd utility with your user (non-root) password, since that utility is setuid and automatically runs itself as root no matter who executes it. If it verifies that the password you gave it matches the password on record for that user, it will allow you to change it by editing /etc/shadow for you.

There are many ways to get root on a system that you only have unprivileged local access to. This type of attack is termed local privilege escalation, or LPE. It usually relies on attacking a vulnerable setuid application, or attacking the kernel itself. Both of these require exploit development knowledge, which is not something someone can learn in one day, nor is it something that can be captured in a single answer here. If the system is running outdated software, you may be able to find a public vulnerability which you could use to elevate privileges. Otherwise, don't count on it.

As for using a buffer overflow exclusively, that's not going to work on any modern software. It might have worked in the 90s, but not today. There are numerous security techniques employed that make the naïve buffer overflow a thing of the past. Nowadays you need to bypass those techniques, which is not trivial. If you want to begin learning binary exploitation, start with a tutorial where you learn to exploit an intentionally insecure application with all the modern exploit mitigations manually disabled. Eventually you'll start learning how to perform the exploit even with mitigations in place (e.g. learning how to execute code in non-executable memory by leveraging ROP). This is the kind of thing you'll have to understand before exploiting a modern system with all the security in place.