Writing a Simple Buffer Overflow Exploit

[@YdenPL]

If he streamed this instead... It'd be a... Live Overflow *ba dum tss*

[@coffeedata7107]

ಠ_ಠ

[@KangJangkrik]

Darn... spilled coffee again (oh the coffee is quite overflow btw)

[@capkenway]

"Simple" Buffer Overflow

[@Zooiest]

ikr

[@krztix]

that's what i was thinking, am i really that bad? haha

[@user255]

It is simple and too simple to work on out of the box Ubuntu.

[@m3mory_leak344]

You're just bad

[@0xc0ffee_]

2014: Really professional and rare videos 2019: 10:43 Please don't stop! We're loving the new LiveOverflow

[@suicidalkatt]

IDK what you mean, that was just a randomly generated pattern, created professionally.

[@xXLanyuzAnlunXx]

that statement is debatable

[@SaeedAlFalasi]

Lmao omg why didnt I ever think of this there I was using metasploit to generate a pattern

[@tobiasgorgen7592]

10:43? I present to you 15:55

[@chezz444]

Just a small note, at 17:45, the syntax "string[a:b]" isn't a list comprehension but is instead string slicing; a list comprehension is instead the syntax "[f(x) for x in iter]".

[@laterz8260]

wgat

[@otesunki]

@@laterz8260 learn python you bootleg potato

[@ari_archer]

@@laterz8260 a list complrehention like for example `hello = [x for x in range(10)]` is basically a compact version of: hello: list[int] = [] for x in range(10): hello.append(x) and string slicing (as an example `"hello world"[1:-1]` will slice characters, like remove, modify them: removing: >>> "hello world"[1:-1] 'ello worl' modifying: >>> "hello world"[::-1] 'dlrow olleh' You can read more about both in the python documentation and on the internet

[@mrocto329]

@@laterz8260 list comprehension is basically like how you define sets in maths. E.g. in maths you'd do {(a, b, c) | c^2 = a^2 + b^2 and a, b, c \in Z} to get all pythagorean triples. This notation is easy to read and work with, so python and some other languages added it.

[@therudolfgaming4631]

I was giving a presentation on Buffer Overflows just as this video released! The timing when the notification popped on screen was just perfect hahaha

[@EchoXIIIGO]

Yeet

[@solveit1304]

I wish myself that when December is over LiveOverflow still uploading videos daily...

[@almightyhydra]

Why does two %p leak the input buffer address, I wonder. Also, how do you need to change the method if working in a telnet to a remote server where you can't use gdb?

[@klightspeed]

For the executable shellcode on the stack to work (i.e. not using return oriented programming), you'd have to have an executable stack, which means W^X would need to be disabled.

[@gwg]

At 0:33, you say to use ``apt-get install socat``. The apt command without the "-get" is like apt-get, but designed for use for humans. It has color coding and fancy progress bars and looks better on your terminal. Do ``apt install socat`` instead. See askubuntu.com/questions/445384/what-is-the-difference-between-apt-and-apt-get

[@happygimp0]

And less to type.

[@tafama]

Can you give a link about that geohot ctf you talked in the video?

[@tr909love]

Why don't you fucking hack the latest ps4 firmware ffs ?

[@myczxr]

i just interested in these kind of things, so i have no idea what all these mean, but i'll be back in a few with a more thorough understanding. wish me luck

[@delphicdescant]

You've always put out such good content, and I love it, but despite that, I've never understood how this channel gets so many views, since this subject isn't exactly aimed at a general audience. Are there way more people out there doing security stuff than I think, or are there lots of people who watch without really having a reason to do so?

[@SFDeku]

I see a lot of programmers or devops staff in real life recommending me this channel who are not that much into security.

[@ME0WMERE]

I don't do security, but I watch these videos because they're interesting you underestimate how much computer-related stuff nerds will watch

[@SourceCodeDeleted]

PWNIE Racing is AWESOME!!!

[@ZetaTwo]

:D

[@EvilSapphireR]

I love LiveOverFlow not only because of his amazing content, but because he always points me to other marvellous KZbinrs. He introduced me to OAlabs before, and now yet another awesome KZbin channel to expand my knowledge!

[@ssfdf7751]

10:44 msf-create_pattern -l 150

[@JacquesBoscq]

17:04 "Anyways let's execute this. Anyways let's execute this"... First try / no debugging, really? -_-

[@kavandsl1942]

More likely to be a necessary edit to maintain quality of video (maybe he sneezed immediately after or something and just did a quick retake of the shot). It's far less likely that he was disingenuous as the code was not altered and anyone can really follow along to replicate the steps themselves.

[@kavandsl1942]

also- this would of been a great opportunity for a cliche matrix glitch joke!

[@chrono0097]

Sometimes you reach a point where you can code something and expect it to work first try, it happens to me, and happends to a lot of programmers

[@groowy]

little tip for script kiddies that just headlessly downloaded files form the gist, executed it and don't know why it doesn't work the gcc outputs file called "cap" but the socat wants to execute file called "caf" so guess what you have to do :) I'm sorry if this was intentional and I've ruined the fun

[@PeetHobby]

He got it at the first try, after ten practice rounds and prepared a program for the video. :D

[@nin10dorox]

All the stuff where you're looking at the disassembled code and reading which bytes the buffer took up, real hackers can't do that right? If you're attacking over the internet, will you be able to do the same thing? Is it even possible to carry out this attack if you can't do those steps?

[@channel-yx1gt]

13:25 "we should CC what it does"

[@drw0if]

Why don't you use pwnlib instead of struct, socket and telnet? It should be easier!

[@sniGGandBaShoR]

Hey I like your videos! Subscribed =) Did you find your bachelor and masters usefull? Or would you say somebody without a degree (maybe just apprenticeship, and general really good software engineer) has a can get a job in the field as a security engineer / ethical hacking ?

[@diarykeeper]

A 1337 port, huh ? Well done instruction. Any reason for why you prefer unix ?

[@kangalio]

I'm noticing that since you started pumping videos out daily, those videos also changed in their topics. They're much more beginner-oriented now and are often even a bit clickbaity. I do hope we will see some more advanced videos of you soon, in the same animated style as back then (that was fantastic!), like you used to do. That would make many of your old fans happy

[@EvilSapphireR]

I doubt a format string exploit on a live executable is completely 'novice oriented'.

[@kangalio]

@@EvilSapphireR okay I realize that word was exaggerating it a bit. I edited it out

[@aidancollins1591]

@@kangalio He's creating a video a day, they can't be too complicated to create. He's also accumulated many new subscribers recently. I'm sure once he gets back to his normal routine, we will start seeing his more complicated videos again (the video he did recently with that Google researcher was pretty complicated).

[@LiveOverflow]

Even during this special time I released a regular video. Checkout the iOS jailbreak video about the sockpuppet vuln.

[@zyrohnmng]

@@LiveOverflow Idk how it would affect views, but consider adding a difficulty level to the videos? [basics] [intermediate] etc... Either way, awesome content :)

[@waplet]

These two videos were like "Memento"

[@maddelasaikarthik7563]

you are on fire , keep it going

[@loppuun4928]

the best way to make a comment is not to be the 14th post in the comment section

[@Cochise85]

As a noob ... Is he targeting his own OS or another VM/host ?

[@sumitlahiri209]

@LiveOverflow Thanks to your videos and constantly inspiring us to learn new things. I was able to reverse engineer a feature in WhatsApp. Thanks again for all the videos you have made. They are just awesome.

[@d1rtyharry378]

Notification squad✊

[@toidihack8151]

I just love you make more video about create hacking python programs :)))

[@kevinalexander4959]

This guy looks a lot like Michael Cera

[@beron_the_colossus]

14:43, I can't believe you've done this

[@StarliskJanova]

Is this a demonstration of the bleeding server error that was on the news for a while back ?

[@shinixshuxd9949]

I thought this is simple buffet overflow!

[@markopekovic2417]

while "14:44 ~ 14:45" == true

[@gyroninjamodder]

Python 2 will reach its EOL in two weeks. You should not be teaching people to use software that is no longer maintained. Python 3 came out over a decade ago. Get with the times.

[@LiveOverflow]

Yolo

[@yurandeveloper6958]

LiveOverflow dinosaur... Lol

[@adi331]

python2 is still good.

[@gyroninjamodder]

@@adi331 Not, for a tutorial meant to be watched in the future. In these upcoming months Linux distros will start to remove python 2 from the package repositories.

[@adi331]

really , are you sure about that ?

[@quantum4691]

How the shell(shell code) connects to you? Over telnet?

[@georgehammond867]

very nice [while loop], keep Up the good work

[@chiabobo]

Cool video as always! Thanks for the detailed explanations!

[@rishi905]

It's really awesome man

[@aryangupta7414]

Dont remember C or C++ but learnt python can we make same exploit in any language?

[@MissionFailed2]

Yes. You can do it by hand even. The point is to send a specially crafted string to the server. That's it.

[@bumblybeenard]

Good video! Very informative!

[@eagle772]

What’s the best IDE to use?

[@Ootskullkid]

Just realized that socat is listening in on port "leet" lol

[@rusirumunasingha2234]

Loving the new vids! Keep them coming!

[@luecu]

why the +8?

[@waplet]

Bam!

[@gwnbw]

Haha love the thumbnail thats my face when I RE

[@Laurent1110]

This is great! I was looking for a way to make the challenges I made accessible easily over the network. I havent thought about using socat but I'll try this next time! You've used Python2 in this video, but what is exactly the problematic with Python3? Is it just that the conversions are annoying ?

[@p0n-pompf]

@Gareth Ma there is a version of pwntools for python3 as well

[@ZetaTwo]

@Gareth Ma Pwntools for Python 3 is still beta but I have been running it for the past year without problems. Only minor inconveniences but totally usable.

[@R0-B1t]

What mouse do you use?

[@abhaasgoyal1376]

Nice one

[@berrabe3917]

can you explain what is stack and offset

[@happygimp0]

en.wikipedia.org/wiki/Stack_%28abstract_data_type%29 The stack is mainly used for return addresses (to go back to the next instruction after a function call) and local variables.

[@viniciusVS8v]

"Simple"

[@DynoosHD]

how would a fix of the server programm look like?

[@nikiibarbaro]

Don't use gets function

[@DynoosHD]

@@nikiibarbaro and use instead?

[@nikiibarbaro]

DynoosHD fgets because you can set the length of the string which will be handled

[@DynoosHD]

@@nikiibarbaro so here: fgets(buf, 256, sdtin); in line 17 would do the trick?

[@nikiibarbaro]

DynoosHD I think yes

[@lior_haddad]

Hi

[@Zooiest]

Hi

[@coffeedata7107]

Hi

[@CameronNoakes]

Calle! I follow him on twitter and didnt even know he had a YT. Hes got 3 degrees and is head of security, insane! I knew it was him not from his name but from his profile pic.

[@SWonYT]

Of the years that I've been watching this channel, I just noticed that your new logo sequence is an animated buffer overflow attack

[@SWonYT]

Then it dynamically allocates the memory to fix it

[@SWonYT]

This is EXACTLY what I needed!! Thank you!!! If anyone sees this that knows of any undergraduate minority male scholarships, please let me know!!!

[@realityveil6151]

Please dont act like an obnoxious hacker. You start out doing it ironically but next thing you know you can't stop and what was once ironic and funny just became what you do. Just lile me and yeet. I started saying it to annoy my friends and be ironic, but now I just say It as part of my vocabulary. Don't let this happen to you.

[@omran.alshehabi]

You're amazing dude ✌🏻

[@p1nkfreud]

And a new generation of $criptkiddies is spawned...here, I'll even help: slight modifications of this will work on "private VPN servers" which are usually emulated VMs, with a little ingenuity you can gain server root

[@privateger]

What?

[@Schlumpfpirat]

17:05 - moments after "first try" cringe

[@ThatGamerBlue]

didnt ask

[@m9gam]

Clearly a joke but ok

[@yxor]

python 2? disliked and unsubscribed.

[@mustafakhalid9348]

Relax butt hurt.

[@privateger]

lmao