Hello, dear friend, you can consult us at any time if you have any questions, add WeChat: THEend8_
Computer Security
Coursework Exercise CW3
Software Security
The goal of this coursework is to gain practical experience with attacks that exploit software vulner-
abilities, in particular buffer overflows. A buffer overflow occurs when a program attempts to write data
beyond the bound of a fixed-length buffer – this can be exploited to alter the flow of the program, and
even execute arbitrary code.
You are given five exploitable programs, which are installed within the virtual machine provided for
this coursework. Each of you will work on slightly different exploitable programs. You will find the five
programs you need to work on in the /task{1-4}/[yourUUN] and /task5 directories on the provided
virtual machine, with setuid for a respective user set.1 In each case, a secret should be extracted by
exploiting the program in some way, by supplying it maliciously crafted inputs, either to spawn a shell,
or extract the secret directly.
1 Virtual Machine Layout and Setup
For this assignment we are using a Virtual Machine called binary-exploits (how original!) inside
VirtualBox. The machine comes as an *.ova file, which includes the virtual hard drive as well as all
necessary settings for VirtualBox. To get the coursework running:
Once VirtualBox is running, select File ↪→ Import Appliance and select the file binary-exploits.ova.
For binary-exploits your username and password are both student, and you have root access via
sudo. Be cautious with how you use it, however, as you will not have root access on our automarker!
In order to allow these attacks to be practically and reproducibly executed, address space layout
randomisation (ASLR) has been disabled in the VM, ensuring that in each execution, the same parts of
a program get assigned to a consistent memory location.
To further protect against buffer overflow attacks and other attacks that use shell programs, many
shell programs automatically drop their privileges when invoked. Therefore, even if you can “fool” a
privileged setuid program to invoke a shell, you might not be able to retain the privileges within the
shell. This protection scheme is implemented in /bin/bash. In Ubuntu, /bin/sh is actually a symbolic
link to /bin/bash. For this coursework, and in order to really realise how much damage this sort of
attacks can do, we use another shell program (the zsh), instead of /bin/bash. The preconfigured Ubuntu
virtual machines contains a zsh installation.
Templates On first starting the VM, templates for each of the exercise submissions should be found
in the cw3/ folder in your home directory. For each task you will find a script task{1-5}.sh. This script
will be executed by our automarker, and should output the secret to its stdout. Beyond this, you are
free to use what you want – provided the tools are preinstalled on the VM. This includes using your own
compiled binaries if you wish, although you will not get partial marks if we can’t see the source! Notable
tools installed include netcat (nc), and gdb.
1Note that for task 5 you are all working on the same program in /task5.
1
Important You must run your attacks inside the provided VM. It is very important that your attack
programs work in the provided binary-exploits VM. This is because, the compiler version, the op-
erating system and the installed libraries will affect the exact location of code on the stack. The VM
provides an identical environment to the one in which we will test your code for marking it.
Some of the template scripts include a part using the env command to clear the environment. This
is to ensure the environment our automarker runs the attack in, and the environment you test it in are
the same. Take care to also make this consistent with your gdb environment! If you remove this part,
you do so at your own peril, and you may experience an attack that works fine for you being turned
down by our automarker.
2 Shellcode
In task 3 you will have to deploy some shellcode, and while we do not ask you to come up with this
yourself, we will briefly elaborate what this code does. These are x86 instructions, that, when executed,
have the same affect as executing the following C function:
i n t main ( ) {
char ∗name [ 2 ] ;
name [ 0 ] = "/ bin / sh " ;
name [ 1 ] = NULL;
s e t r e u i d ( ge teu id ( ) , ge t eu id ( ) ) ;
execve (name [ 0 ] , name , NULL) ;
}
This program does two things: First, it sets the current user id the the effective user ID. This ensures
that the shell does not drop privileges when it is started, i.e. reverting to an unprivileged user. In
particular bash does this, which supplies /bin/sh in our VM. Second, it executes /bin/sh directly.
Good shellcode does not contain NULL bytes, as these will not typically be copied by C programs –
for this reason just compiling the above is usually not sufficient. We provide the below shellcode, and in
task 3, this is already available in the task template.
/∗ geteu id ( ) ∗/
"\x6a\x31" // push $0x31 ;
"\x58" // pop %eax ;
"\x99" // c l t d ;
"\xcd\x80" // i n t $0x80 ;
/∗ s e t r e u i d ( ) ∗/
"\x89\xc3" // mov %eax , %ebx ;
"\x89\xc1" // mov %eax , %ecx ;
"\x6a\x46" // push $0x46 ;
"\x58" // pop %eax ;
"\xcd\x80" // i n t $0x80 ;
/∗ execve ("/ bin / sh " , 0 , 0) ∗/
"\xb0\x0b" // mov $0x0b , %a l ;
"\x52" // push %edx ;
"\x68n/sh" // push $0x68732f6e ;
"\x68// b i " // push $0x69622 f2 f ;
"\x89\xe3" // mov %esp , %ebx ;
"\x89\xd1" // mov %edx , %ecx
"\xcd\x80" // i n t $0x80 ;
2