Show Posts

This section allows you to view all posts made by this member. Note that you can only see posts made in areas you currently have access to.


Messages - SarK0Y

Pages: [1]
1
Hacking and Security / Re: buffer overflow
« on: October 26, 2014, 10:45:29 pm »
Well this is nog really safe. You can easily bruteforce the canary. Try to use the default stack protectors given by the compiler.
bruteforce via typing console??? theoretically it's possible, but brute forcing is only good for const canary: if each time you get new one, probability to take right canary becomes too low + good security limits the number of attempts ;) however, we can use more safe & reliable variant than canaries.
==============================================================
 char name[SIZE];//SIZE==40, for our case
char pswd[SIZE];
memset(name, 0, SIZE);
memset(pswd, 0, SIZE);
printf("Please, Enter username: \n");
fgets(name, SIZE-1, stdin);
int ch;
 while ((ch = getchar()) != '\n' && ch != EOF);//clears console buffer, otherwise ye'll get nasty behavior ;D
printf("\nPlease, Enter password: \n");
fgets(pswd, SIZE-1, stdin);
 while ((ch = getchar()) != '\n' && ch != EOF);
printf("Your name: %s\nYour password: %s\n", name, pswd);
======================================================
output:
Please, Enter username:
444444444444444444444444144444444444444444444444444444444444444444444444444444444

Please, Enter password:
bbbnjhgfjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjhgf
Your name: 44444444444444444444444414444444444444
Your password: bbbnjhgfjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj

Let's take wrong code:
====================================================
 char name[SIZE];
char pswd[SIZE];
memset(name, 0, SIZE);
memset(pswd, 0, SIZE);
printf("Please, Enter username: \n");
fgets(name, SIZE-1, stdin);
//system("clear");
//int ch;
 //while ((ch = getchar()) != '\n' && ch != EOF);//clears console buffer, otherwise ye'll get nasty behavior ;D
printf("\nPlease, Enter password: \n");
fgets(pswd, SIZE-1, stdin);
 while ((ch = getchar()) != '\n' && ch != EOF);
printf("Your name: %s\nYour password: %s\n", name, pswd);
==================================================
output:

Please, Enter username:
4444444444444444444444444444444444444444444444455555555555555555555555555

Please, Enter password:
44444444444444444444444444444444444444444444
Your name: 44444444444444444444444444444444444444
Your password: 44444444455555555555555555555555555

2
Hacking and Security / Re: buffer overflow
« on: October 25, 2014, 11:35:57 pm »
ah, year -- seven chars long  ;D

3
Hacking and Security / Re: buffer overflow
« on: October 25, 2014, 11:34:00 pm »
#include <stdio.h>
int main () {
    int rnd=random();
    char username[8];
    int canary=rnd;
    int allow = 0;
    printf external link("Enter your username, please: ");
    gets(username); // user inputs "malicious"
    if (canary!=rnd){
      printf("User, my Dear! :) Please, give me ok-sized string. It's only eight characters to input. Ain't it so compicated??? @@\n");
      exit;
    }
    if (grantAccess(username)) {
        allow = 1;
    }
    if (allow != 0) { // has been overwritten by the overflow of the username.
        privilegedAction();
    }
    return 0;
}

however, we can use even more simple way  ::)

#include <stdio.h>
int main () {
    char username[8];
    int allow = 0;
    printf external link("Enter your username, please: ");
    gets(username); // user inputs "malicious"
   
  if (allow==1){
      printf("User, my Dear! :) Please, give me ok-sized string. It's only eight characters long. ;-}) Ain't it so compicated??? @@\n");
      exit;
    }
    allow=0;
  if (grantAccess(username)) {
        allow = 1;
    }
    if (allow != 0) { // has been overwritten by the overflow of the username.
        privilegedAction();
    }
    return 0;
}

Meanwhile, 1st variant runs much safier  8)

4
I understand you probably dident create all this for EZ or even another forum. But this IS a forum. We would very much appreciate it if we dident have to download a zip and then opening multiple PDF's and code files in various viewers and editors. Make your stuff forum friendly in the future please.
OK, i'll try to be more informative & short as well.  ::) So, the approach is based upon simple idea: access to array must be provided by three parameters:

1. base address of array, i.e. &array[0].
2. offset in array to access to o/& since.
3. size of array.
====================
if we know for sure all-that, we can certainly calculate how many bytes to write in w/o the least risk to overflow. In other words, safe memory shouldn't be accessed Just by arbitrary address.

5
Hacking and Security / The techniques to guard buffers against overflow
« on: October 21, 2014, 04:03:22 am »
Hi there, my Friends. :D

here, i'd like to discuss the possible & the best techniques for subj. 1st & foremost, i would like to share my humble approach to protect buffers.

code: https://sourceforge.net/projects/dasofi
description: http://alg0z.blogspot.ru/2014/10/dabofi.html

perhaps, description seems too short, but i hope code is more verbose  ;)
======================
Thanks a lot in Advance for your contribution.

Pages: [1]