Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Smashing the Stack for Fun and Profit (1996)

phrack.org

Post reply on HN
Print view View original

21–30 of 66 posts

Re: Smashing the Stack for Fun and Profit (1996)

#21

Post by tylerjwilk00 »

tekstar wrote: post #13

This article, and then working through the book "Hacking and the Art of Exploitation" taught me the true fundamentals of the C programming language, and Linux. The other key ingredient was working through the classic "digital evolution" wargames where you'd SSH into a box as level1 and work your way up from there.

Your comment caused a forgotten memory to pop up to the surface. Did you by chance happen to participate in the Zebulun Cyber Army Challenge(s) [1]?

Those games were very rewarding for a high schooler on the early internet.

[1] https://www.ca-zeb.com/

Re: Smashing the Stack for Fun and Profit (1996)

#22

Post by ralph84 »

jnwatson wrote: post #8
__jf__ wrote: post #4

In 2017 I got a second hand Cisco ASA just to play with the shadowbrokers tools. EXTRABACON was the codename for the SNMP exploit using a buffer overflow. This was an interesting excercise because there were NO logs of this happening on the Cisco ASA, not even when ramping every loglevel to debug. Well only on the console port. Exception in readline() or something like it. Doing stuff for security monitoring in daily…

The assumptions about environment and the system-under-test has been the Achilles' heel in any certification I've been part of. It isn't like the CC folks aren't aware of the problem. The idea was that the Security Target (definition of the system) could declare conformance to a standardized Protection Profile which consumers could use as a shortcut to understanding what was promised. However, nobody looks at STs nor…

Just like almost every FIPS 140 validated crypto module has a "FIPS mode" that is what was validated but is never actually used in production, even by government customers.

Re: Smashing the Stack for Fun and Profit (1996)

#23

Post by ahepp »

f00zz wrote: post #6

A classic, but these days if you want to reproduce those bugs you need to build your code with -fno-stack-protector, enable executable stack, disable ASLR in the kernel, etc.

I'm trying to remember where, but I once saw this article presented with a very nice guide to replicating the exploits in a VM on a modern computer.

I think it must have been in university, unfortunately when I look up the course number, the resources seem to be (understandably, I suppose) date gated.

Re: Smashing the Stack for Fun and Profit (1996)

#24

Post by hyper_reality »

opticnerve wrote: post #16
hyper_reality wrote: post #10

What a classic! Phrack stopped publishing some time ago but the world of security ploughs on, who can recommend similar modern resources to Phrack? Here's a few I'm aware of: https://www.alchemistowl.org/pocorgtfo/ https://secret.club/

Paged Out - https://pagedout.institute/ Rafale - https://www.rafale.org

Paged Out is great, Rafale appears to be offline though (and French only).

Re: Smashing the Stack for Fun and Profit (1996)

#26

Post by guerrilla »

wizzwizz4 wrote: post #11
f00zz wrote: post #6

A classic, but these days if you want to reproduce those bugs you need to build your code with -fno-stack-protector, enable executable stack, disable ASLR in the kernel, etc.

Not really. If you can overwrite the return address, and you have some time to plan out your payload in advance, you can write a program by “returning” into other bits of the program or its libraries.

https://en.wikipedia.org/wiki/Return-oriented_programming

I wonder if anyone's ever automated it.

Re: Smashing the Stack for Fun and Profit (1996)

#27

Post by jcpham2 »

m00dy wrote: post #17
tekstar wrote: post #13

This article, and then working through the book "Hacking and the Art of Exploitation" taught me the true fundamentals of the C programming language, and Linux. The other key ingredient was working through the classic "digital evolution" wargames where you'd SSH into a box as level1 and work your way up from there.

Same here. It also inspired me for my master thesis which is ‘Using Bitcoin For Fun and Profit’.

Slashdot circa 2011 “bitcoin mining for fun and profit”

Phrack is standard required reading

Re: Smashing the Stack for Fun and Profit (1996)

#28

Post by waynecochran »

wizzwizz4 wrote: post #11
f00zz wrote: post #6

A classic, but these days if you want to reproduce those bugs you need to build your code with -fno-stack-protector, enable executable stack, disable ASLR in the kernel, etc.

Not really. If you can overwrite the return address, and you have some time to plan out your payload in advance, you can write a program by “returning” into other bits of the program or its libraries.

If you're exploit using existing code (which would be limited), but if you want to inject code you typically need to put on the stack. Maybe one could inject code into the .bss/.data section, but this is probably protected from execution as well. The .text section is probably read only.

Re: Smashing the Stack for Fun and Profit (1996)

#30

Post by bluedino »

tekstar wrote: post #13

This article, and then working through the book "Hacking and the Art of Exploitation" taught me the true fundamentals of the C programming language, and Linux. The other key ingredient was working through the classic "digital evolution" wargames where you'd SSH into a box as level1 and work your way up from there.

Another good book is 'Reversing: Secrets of Reverse Engineering'

Books like that should be required reading when learning C. It shows you so much that the typical book won't cover.

Post reply on HN