Court of Analysis and Testing

This is the third part of smash the tux series, in this post lets continue our work and try to finish 0x03 - 0x06 challenge Challenge 0x03: from this source code, we can see that there is a limit of input length in the program. If we try to input with a length that exceeds 512 bytes, the program will terminate itself. We can safely assume that 512 is the length that we need to overwrite the EIP register let's try to test the program by inputting just 512 bytes and see what happen to it. so what happens in here? this vulnerability is called "off by one byte" if the programmer knows that it takes 512 bytes and above to overwrite the EIP, they should not put a check like this (strlen(text) > 512) that means we can still input with length 512, to do the correct checking it supposed to be like this (strlen(text) >= 512) this will make sure that input with length 512 and above is properly sanitized Let's try to determine how much length we a...

In the previous blog about SmashTheTux we are talking about how we can leverage simple buffer overflow and format string attack to gain control of a program. This time we will take a look at one of the most interesting attacks in the modern OS environment "Race condition" I heard about this attack when I'm attending a lecture of operating system security at that time I understand the underlying principle of the attack but not really much on how to do attack and this time I have a chance to do the implementation of this attack What is the race condition? According to OWASP 10, the race condition is a vulnerability that produces an unexpected result when the timing of actions is impacted or affected by other actions. Simple enough this attack is based on the length of the timing of the program execution and mostly happens in a multithreaded application where all of the execution is happening at the same time. consider the following source code taken from ...

meme source: https://www.mememaker.net/meme/if-you-practice-4240 No matter how far you go, it is important to always practice the concept over and over again by giving yourself a new challenge in every opportunity. So in this post, we are going to take a look at another good challenge for practicing Linux exploitation which is SmashTheTux that come from "Vulhub" platform but because I don't want you guys to be overwhelmed with the material I will cut the writeup into several parts. VM can be download from this link: https://www.vulnhub.com/entry/smashthetux-101,138/ Warm-up -> 0x00: Once you installed and started the VM in your VirtualBox, the machine will offer us 9 challenged in the home directory, each of them contains a common vulnerability in the Linux binary that we can exploit to take control the program the first challenge 0x00, give use the following piece of vulnerable code: If you are already indulged with binary exploitation long enou...