Hack Like a Pro: How to Build Your Own Exploits, Part 1 (Introduction to Buffer Overflows) « Null Byte :: WonderHowTo

Welcome back, my fledgling hackers!With this first article, I am initiatinga new seriesintended to convey to my readers the skills necessary to develop your own exploits.As many of you know, soon after an exploit is found in the wild, software developers begin to work on patches to close the hole or vulnerability that was exposed. Soon, that exploit will no longer work, except on unpatched systems. (Despite this, don't underestimate the number of unpatched systems. Many firms don't patch out of neglect or fear that a patch will break a working production system. There are millions of unpatched systems!)Furthermore, soon after an exploit is developed,AV softwaredevelopers create a signature for the exploit, and the ability to send or install the software on the target system becomes problematic (not impossible,but problematic).The key to overcoming these issues is to develop your own exploits. If you can develop your exploits, there will be no patch and the AV software won't detect it. In essence, you will have developed the hacker's holy grail—a zero-day exploit!This series is designed to provide you the background and skills to develop your own zero-day exploits. It's not for the beginner or those without a good IT background, but we will start slowly and go step by step through the process, giving you time to build the skills you need.Expectthis seriesto have numerous tutorials (from 10 to 15) on the anatomy of buffer overflows and the knowledge and skills you need to find and exploit them along the path to building our own zero-day exploits. We will eventually develop our own stack-based buffer overflow, which involves overfilling a variable on the program's memory stack and overwriting adjacent memory areas.Let's begin with some basic concepts and terminology.Buffer OverflowsIn many of my numerous hacks here on Null Byte, we have been able to get a command shell or meterpreter on a remote computer. In the jargon of the industry, this is referred to as "remote arbitrary code execution." What is taking place in all of these cases is better known as a "buffer overflow."A buffer overflow is a condition where a variable is overstuffed with data and "arbitrary" (i.e., the hacker's) code is executed. This code can be anything, but ideally, it a command shell or terminal to give hacker control of the victim system.Buffer overflows are far and away the most dangerous and destructive vulnerabilities within any application or operating system. In its simplest form, a buffer overflow is simply a variable that does not check to make sure that too much data is sent to it (bounds checking) and when too much data is sent, the attacker can send and execute whatever malicious code they want in that address space.Memory BasicsTo understand buffer overflows and the terminology that the industry uses, you need to understand a bit about memory. Let's use a simple analogy.Let's imagine that our memory is like a large three-ring binder. You know, the type we have carried to school or work. When a new program executes, it begins to fill up the pages in this three-ring binder with data (stack) it needs, filling it from the top towards the bottom. When the program begins it execution, it requires temporary data that it uses and discards quickly. It then fills the binder with this data from the bottom toward the top (heap).The memory area directly after the program is called the "stack" and the memory area at the end of the memory area is called the "heap." If the book is large enough, then these two areas will never collide.Stack vs. Heap MemoryStack is short term memory, is fixed in size, and is used to store function arguments, local variables, etc.Heap is long-term memory and holds dynamic memory.General-Purpose RegistersOn Intel-based CPUs (both Mac and Windows), there are several general-purpose registers that can be used to store data. In future tutorials, we will be learning how to manipulate and use these registers to create our zero-day exploit. These are:EIP- instruction pointerESP- stack pointerEBP- base pointerESI- source indexEDI- destination indexEAX- accumulatorEBX- baseECX- counterEDX- dataNOP SledA NOP (no operation) is an instruction that tells the program to do nothing, and a NOP sled is a sequence of NOPs that are meant to slide the CPUs instruction flow to the desired location in memory registers. Many exploits use NOP sleds to direct the execution pointer to the malicious (hacker) code after pushing out the data from the stack or heap.These are some of the basic concepts and terminology you will need before we can begin building our exploit, so make certain you understand these concepts and bookmark this page before we proceed inthis exploit-building series. If you follow this series closely, by the end you will capable of developing your very own zero-day exploits.Want to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseCover image viaShutterstockRelatedHack Like a Pro:How to Build Your Own Exploits, Part 2 (Writing a Simple Buffer Overflow in C)Hack Like a Pro:How to Exploit and Gain Remote Access to PCs Running Windows XPHow To:Exploit Development-Stack Base Buffer Overflow/Part 1(VIDEO)How To:Create a Metasploit Exploit in Few MinutesHack Like a Pro:How to Exploit IE8 to Get Root Access When People Visit Your WebsiteNews:Test Your Hacking / Exploiting Skills with SmashTheStack!Hacker Hurdles:DEP & ASLRHack Like a Pro:How to Exploit Adobe Flash with a Corrupted Movie File to Hack Windows 7How To:The Art of 0-Day Vulnerabilities, Part2: Manually FuzzingHow To:Attack on Stack [Part 4]; Smash the Stack Visualization: Prologue to Exploitation Chronicles, GDB on the Battlefield.Exploit Development:How to Learn Binary Exploitation with ProtostarHack Like a Pro:How to Hack Windows 7 to See Whether Your Girlfriend Is Cheating or NotHack Like a Pro:How to Build Your Own Exploits, Part 3 (Fuzzing with Spike to Find Overflows)Hack Like a Pro:Exploring Metasploit Auxiliary Modules (FTP Fuzzing)Hack Like a Pro:Metasploit for the Aspiring Hacker, Part 1 (Primer & Overview)How To:Attack on Stack [Part 5]; Smash the Stack Visualization: Remote Code Execution and Shellcode Concept.Hack Like a Pro:Exploit MS Word to Embed a Listener on Your Roommate's ComputerHow To:Security-Oriented C Tutorial 0x0C - Buffer Overflows Exposed!Advanced Exploitation:How to Find & Write a Buffer Overflow Exploit for a Network ServiceHack Like a Pro:Capturing Zero-Day Exploits in the Wild with a Dionaea Honeypot, Part 2 (Configuration)How To:The Five Phases of HackingHow To:Attack on Stack [Part 6]; Smash the Stack Visualization: NOP Sled Technique, the End of a Trilogy.How to Hack Like a Pro:Getting Started with MetasploitHack Like a Pro:Use Your Hacking Skills to Haunt Your Boss with This Halloween PrankHowTo:Build Your Own DIY SuperMacro LensHow To:Attack on Stack [Part 3]; Smash the Stack Visualization: Building on Fundaments, Analyzation Trilogy Conclusion.News:And the Winner of the White Hat Award for Technical Excellence Is...Weekend Homework:How to Become a Null Byte ContributorNews:Null Byte Is Calling for Contributors!Weekend Homework:How to Become a Null Byte Contributor (1/12/2012)Hack Like a Pro:Hacking Samba on Ubuntu and Installing the MeterpreterHow Null Byte Injections Work:A History of Our NamesakeCommunity Byte:HackThisSite Walkthrough, Part 3 - Legal Hacker Training