Computer Security: A Hands-on Approach

Explore the bash shellshock vulnerability in CGI by injecting data into environment variables with curl's user agent to trigger remote code execution, illustrating execution as www_data and limited privileges.

Explore how to establish a reverse shell during a shellshock attack by redirecting bash input and output to a tcp connection using netcat, enabling remote control.

Explains buffer overflow vulnerabilities, how strcpy can overflow a 40-byte buffer, corrupt the stack, and overwrite the return address to execute attacker code.

Explore how to construct a payload to overflow a return address in a vulnerable function, using a badfile, nop sleds, and shellcode, with gdb debugging.

Learn to craft linux shellcode in assembly to spawn a shell via execve, including setting ebx, ecx, edx with stack-based strings, handling zeros, and building argument arrays.

Examine three countermeasure categories for buffer overflow defense: developer-led resilience, operating system protections, and compiler-based defenses. Learn how address randomization and stack memory protection reduce risk and harden programs.

Explore how operating systems use address space layout randomization to hinder buffer overflow attacks by randomizing stack and heap locations, and examine effectiveness across architectures.

Explore heap-based buffer overflow vulnerabilities using malloc-allocated memory. Learn how overflowing a heap buffer can alter the linked list of heap blocks to hijack a return address or trigger return-to-libc.

Explain buffer overflow attacks by examining memory layout and stack frames, showing how overwriting the return address enables code execution or return-to-libc, with lab exercises and countermeasures including StackGuard.

Chain no-argument function calls by manipulating the stack return addresses, track ebp values to call bar ten times, and verify the rop chain using gdb with a setuid program.

Explore how memory mapping and copy-on-write drive the dirty cow vulnerability, comparing map_shared and map_private, and how madvice discards private copies to restore the master file.

Explore side channels and how cpu caches enable the meltdown and spectral attack, illustrating cache timing and memory access.

Contrast meltdown and spectre attacks by comparing hardware protection of the kernel space with software sandbox protections and the restricted access control API governing memory.

Explain how out-of-order execution in meltdown attacks lets code access kernel space, using cpu caches to prove executed instructions despite exceptions and denial of access.

Reveals how the Spectre attack exploits out-of-order execution and a cache side channel to reveal a secret, using training, flush-and-reload, and timing to exploit race conditions.

Explore how side channels use cpu caches, learn flush and reload, and reveal cache residues from out-of-order execution to understand Spectre and Meltdown attacks and cpu race conditions.

Explore format string vulnerabilities in printf and related functions, and learn how attackers exploit them to inject code into setuid or server programs with root privileges.

Explore how format strings govern printf and related functions through va_list, va_start, and va_arg, enabling optional arguments and specifiers like %d, %s, and %x to print formatted output.

Explore what happens when printf encounters more format specifiers than arguments, and how mismatches can cause memory reads, writes, and format string attacks from user input.

Demonstrates fast memory writes by using a two-address format string with %n and length modifiers. Shows splitting four-byte values into two-byte chunks using %hn and %hhn in little-endian memory.

Demonstrates exploiting a format string vulnerability to inject code by identifying the target address and value, then using printf memory writes to overwrite the return address and execute shellcode.

Avoid letting user input become part of the format string; derive all format strings from trusted sources or constants. Illustrate compiler warnings and how fixed strings prevent format string attacks.