The Heap: How to exploit a Heap Overflow

The Heap: How to exploit a Heap Overflow - bin 0x15

Рет қаралды 102,574

7 жыл бұрын

We are solving heap1 from exploit-exercises.com by exploiting a heap overflow.
=[ ❤️ Support ]=
→ per Video: / liveoverflow
→ per Month: / @liveoverflow
=[ 🐕 Social ]=
→ Twitter: / liveoverflow
→ Website: liveoverflow.com/
→ Subreddit: / liveoverflow
→ Facebook: / liveoverflow
=[ 📄 P.S. ]=
All links with "*" are affiliate links.
LiveOverflow / Security Flag GmbH is part of the Amazon Affiliate Partner Programm.
#BinaryExploitation #HeapOverflow

Пікірлер: 72

@manfredheinz3066 3 жыл бұрын

again this is an older video; but this kind of stuff even it is an "easy" challenge still completely blows my mind. this is CRAZY. I totally love this.

@h3apspray 7 жыл бұрын

These tutorials are by far some of the best material on the entire internet focused on this subject. I love the technical explanations as well as the quality of the video editing. Curious what you are using to do your editing? Keep up the excellent work, I've learned quite a lot from these and look forward to learning that much more. Where do you hang out in IRC? Kudos!

@rajatumb 7 жыл бұрын

I love the videos posted on this channel.The content is very clearly explained in depth.This is the best material I read so far.

@Diemf74 10 ай бұрын

Watched*

@pepsipu1765 4 жыл бұрын

11:19 when my mom looks at me when I pop out of her womb

@fredericmeyer8514 7 жыл бұрын

Thanks for the video, I was stuck at this level since yesterday! Watched your video exactly until 1:51 and immediately noticed what I was overseeing/missing all the time. Damn. Further exploitation was pretty straightforward :D

@LiveOverflow 7 жыл бұрын

awesome! congrats!

@fredericmeyer8514 7 жыл бұрын

thanks! keep up the good work! have been following your channel for a while and i must say that it motivated me to dive deeper into the "art of exploitation" after years of mostly doing other (though RE and lowlevel related) stuff :)

@hawk__ Жыл бұрын

learning in 2022 and it seems that these tutorial vidz of yours are some of the best on the whole www

@alkeryn1700 6 жыл бұрын

Of course you aren't the best security researcher, but you are the one making the best informative videos i know of and i thank you for that :)

@ArchanaKumari-ql6ws 3 жыл бұрын

Excellent !!! Amazing videos !! I am so happy to discover these videos . The best video I ever came across on internet 😎

@AneeshDogra 7 жыл бұрын

You're amazing! :)

@vladmiller5682 Жыл бұрын

"oh, that looks fucked" lol Awesome video series!

@noamw3841 7 жыл бұрын

And that's why you must use strncpy(copy N chars from src to dest) here, never trust user input :D. Awesome series!

@rootabeta9015 5 жыл бұрын

Development rule #1 - never ever trust anything that comes from the other guy.

@ozjuanpa 4 жыл бұрын

@@rootabeta9015 Developer rule #2 - never ever trust any code that came from yourself.

@rikkasatrio2285 2 жыл бұрын

Developer rule #3 - never ever trust any code

@Lfomod1Dubstep 5 жыл бұрын

great video!

@gideonge6188 5 жыл бұрын

really, awesome!

@shrreturn7288 7 жыл бұрын

Thank you for this good series of tutorial :) I'm a bit confuse on print in GDB. Could you help explain why we have to set $i1 = (struct internet*) 0x08041028 ? Shouldn't print work with an existing variable in the current context ? I first tried (gdb) print *i1, print i1, x/x i1 but the address of i1 seems to be totally different from the real one 0x08041028.

@arsen3783 7 жыл бұрын

ow, that looks fucked I love it. Great vids by the way, keep it up :)

@miklosq 4 жыл бұрын

don't forget to turn ASLR off!

@dawindersingh6431 4 жыл бұрын

How do I get my gdb to show the destination address?

@Hello-od2tj 5 жыл бұрын

Hi, I was wondering if there is a way to exploit this on a 64-bit system. The problem is that we have to override 0x00007ffff7ef6070 (address to malloc'd area on heap) to 0x00000000006041d0 (address to puts@got) and strcpy stops copying before a nullbyte.

@kuhluhOG 4 жыл бұрын

3:45 I didn't know a Compiler can optimize that since it's a function. I mean, it's possible but it's a really special purpose optimization.

@bamberghh1691 3 жыл бұрын

Compilers are very specialized now, to the point where this code #include int bitcount(uint64_t x) { int v = 0; while(x != 0) { x &= x - 1; v++; } return v; } Is optimized to a single instruction popcntq %rdi, %rax. Unfortunately if you change the code even a little bit the optimization won't work

@gabrielraphaelgarciamontoy1269 4 жыл бұрын

How did it actually change where i2->name was pointing to? Shouldn't it have just changed the value inside? Or does it have to do with overwriting the meta-headers?

@robinhood3841 4 жыл бұрын

Why eip is overwrote with the source of string copy after you overwrote the destination of string copy can someone explain please

@syr0xs 11 ай бұрын

How can you use the run echo command with the chars needed if the programme doesn't work arround the argv argument but a gets() function

@typedeaf 5 жыл бұрын

@10:00 why doesn't the malloc for the name of the i2 ever get assigned? The name of i2 was 0x0 before the strcpy().

@SolomonUcko 3 жыл бұрын

I think the breakpoint triggers in between the malloc and the assignment.

@Born2KillHF 7 жыл бұрын

This video was very helpfull but there is something I can't figure out. When you replace the FFFF with the Address of Puts what happens to the code flow.. I mean why the eip is replaced with the firt 4 characters of second argument?? Thanks in advance

@LiveOverflow 7 жыл бұрын

You see a strcpy there. So a string copy. And the destination of the string copy is the global offset table. The global offset table contains the addresses of functions such as puts. So if you overwrite the puts function address with another address, next time you call puts, you redirect code to wherever you want it to be. More info in episode "bin 0x12"

@Born2KillHF 7 жыл бұрын

Amazing.. Very clear.. I wiil check also that video

@0xc0ffee_ 6 жыл бұрын

You're really good but what I don't understand is that if EIP indicates the next step to process how can you manipulate it if it should be changing every microsecond? Like while Im watching your youtube video isn't eip changing to read new data from memory and send it to the audio card? Maybe it is all process encapsulated?

@maciejbacal5562 6 жыл бұрын

A CPU by nature can actually only run one program at once (i'm simplifying things here). The fact that you can run multiple programs, even though you only have a single CPU is faked by the OS rapidly switching between running different processes (threads to be exact). These days you likely have multiple cores, but that still stands; the OS has to run thousands of threads on the hand-full cores you have. When the OS switches to running another thread, it'll save the current thread's registers along with the rest of the thread state, and restore the registers and state for the thread that's going to run next, so all the registers you see him access are for the current thread only.

@0xc0ffee_ 6 жыл бұрын

Wow thank you! :D Thank you so much, really. I love this channel and ctf community. Everyone is so polite. Thank you for existing and making me feel home

@JennJanesko 7 жыл бұрын

Hi LiveOverflow, I have followed through your tutorial, and it is straightforward and super helpful. I thought that I would try it on an Ubuntu 16.04, 32 bit system, and I have run into a problem. At about 3:10 you have a segfault for your strcpy function, and it is clear which string is being copied and the string's target address (0x46464646). But, when I have a segfault, my error message says: __strcpy_sse2 () at ../sysdeps/i386/i686/multiarch/strcpy-sse2.S:1657 1657 ../sysdeps/i386/i686/multiarch(strcpy-sse2.S: No such file or directory. When I use backtrace I get he same error. This error is not nearly as clear and helpful as the one that you receive in your tutorial. I have looked around online to see how to solve the "no such file or directory" problem thinking that this might help. I tried installing libc6-dbg, installing build-essentials and setting gdb's debug-file-directory. This didn't help. Is it because I am using a different version of C? Or, is the error message difference due to a configuration in gdb. Thank you.

@TheOmarss 6 жыл бұрын

Try compiling your c file with the '-g' flag maybe

@bobbobety 4 жыл бұрын

I get the same error, did you ever find a fix?

@mohammaddvd844 Жыл бұрын

Hi , thank you for your videos, i have a problem , the output of the gdb isnt like you, the part `*__GI_strcpy (dest=0x804a038 "", src=0x0) at strcpy.c:39` please help me

@w0ttheh3ll 5 жыл бұрын

does anybody know where I can find the sources for these protostar exercises? the original website is down, and the bootable image that I downloaded over vulnhub doesn't contain any source code. I have searched the internet, but didn't find anything.

@w0ttheh3ll 5 жыл бұрын

if anybody has the same problem, I found them: github.com/hellosputnik/exploit-exercises

@toxicraptor4196 5 жыл бұрын

exploit.education This is where it went. Seems to be the original author

@w0ttheh3ll 5 жыл бұрын

@@toxicraptor4196 thanks a lot!

@toxicraptor4196 5 жыл бұрын

@@w0ttheh3ll No problem, good luck!

@sassynatan 5 жыл бұрын

u r wow!

@Zooiest 5 жыл бұрын

-Heap overflow- -Buffer overflow- LiveOverflow

@sharathb814 3 жыл бұрын

This worked because printf on line 34 was optimized to puts(), if it was printf printing with arguments then it could have gone into endless recursion by calling printf & exploit would have failed. The real question is how to exploit this code if line 34 was printf.?

@neerajkumar188 4 жыл бұрын

My gdb is not showing the memory address where segmentation fault occurred. Any idea ? It says -->> Program received signal SIGSEGV, Segmentation fault. __strcpy_sse2_unaligned () at ../sysdeps/x86_64/multiarch/strcpy-sse2-unaligned.S:298 298 ../sysdeps/x86_64/multiarch/strcpy-sse2-unaligned.S: No such file or directory.

@zaoyang5514 Жыл бұрын

I face the same issue. Do you know how to fix it?

@niektuytel9519 4 жыл бұрын

to do what he is try to do by the beginning : run gdb break * after the latest strcpy define hook-stop info registers end run with the payload to detect

@robinhood3841 4 жыл бұрын

When i run my payload and step forward from the break point do the hook will stop again or the hook will be in the break point boundaries

@niektuytel9519 4 жыл бұрын

@@robinhood3841 yeah that is what you need ? i not sure forget most of it already

@dawindersingh6431 4 жыл бұрын

what Linux and gdb are you using

@areg7182 3 жыл бұрын

doesnt matter

@Occcc12 7 жыл бұрын

Thanks a lot! Will there be a video on exploiting heap functions such as unlink?

@LiveOverflow 7 жыл бұрын

yep. there will be. We are getting there slowly :) My cookbook video write-up (not very well edited) already contains a more advanced heap exploit if you are interested in that.

@mumlesh 3 жыл бұрын

How much it will differ in ×64 system.? For heap0 challenge, I was able to get the overflow offset but the address from objdump is different from gdb . When I try it in gdb it crashes and from terminal it never jumps to winner.