Tasks 1) Open linux terminal and compile victimFile.c, and run it. Type the message that you see: After running and compiling the victimFile.c the massage shown was: you didn’t provide any argument: ./.out <string>

2) Check the source code of victimFile.c by opening the file in an editor. Which variable can be used to apply a buffer overflow attack? Why? var, because the input variable will be used inside the copy function and will copy it to var; and var is array of characters with fixed size of 20.

3) Run the file with an argument that will cause an exception (execution error). How long was your argument? (How many letters)?
Since var max size is 20, so any argument that is more than 20 will cause an exception. Example “123456789123456789123” 21 letters as shown below:

4) Disable the buffer overflow protector that linux has, and try to overflow the buffer by increasing the length of your argument until you receive “Segmentation fault”. How long is the argument now?
After disabling the buffer overflow protector using –fno-stack-protector, now we can overwrite into the stack without Abort. An argument of length 32 causes the segmentation fault. 20 (var) + 4 (var2)+ 4(input)+ 4(bptr) =32

5) a) In this step we created the script.pl file that needs arguments and the address to where it should jump. In our case we want to jump to hacked function.

b) We run the gdb tool using “gdb a.out”. After that, using “(gdb) disassemble hacked” the assembly code of the function hacked was shown as below. The first shown address next to push is the address of the hacked function; which is “0x080484b7”.

c) In the script.pl, we filled the argument of size 36 (size of string needed to reach the eip pointer) concatenated with function hacked address (which will come inside eip pointer), in reserved order as shown below: * 20 (var) + 4 (var2)+ 4(input)+ 4(bptr)+ 4 (return address) =36

6) Finally we run the script file using “perl script.pl”. And the message “Can you see me now?” inside the hacked function will be shown as below:

Optional:
In this step, we will be able to know the length of the argument to be used in the buffer overflow without looking into the code. * First we generated a string of random length using pattern_create. * After running the a.out file, the generated string will fill into the stack. We need to know the part of the string that filled the eip pointer; this can be done by viewing the content of the registers using “info registers”. Then we took the content of the eip pointer and compared it with the generated string using pattern_offset. This will give the length of the string needed to reach the eip pointer; which is 36 as shown below: