是否可以通过另一个程序调用一个程序

Question

I'm reading an article about Buffer Overflow Attack: http://www.cse.scu.edu/~tschwarz/coen152_05/Lectures/BufferOverflow.html
Theoretically I understand what it is talking about.

But I can't imagine how a hacker program could be executed by this kind of attack.
For the example in the article, the function bar is called because of the designed string. However, bar is a function of the same program. In other words, he is hacking himself on purpose. As I know, any address in a program only belongs itself, meaning that you can't invoke a function of another program thought its address.

I just want to know that in real cases, how will a hacker do?
As it said:

A real attack would try to place the address of the top of the stack in lieu of the return address, followed by some horrible lines of assembly code, such as a call to another tool.

what is "some horrible lines of assembly"? Is there a simple example?

Answer 1

Go read Smashing The Stack For Fun And Profit . It has a specific example for 32-bit x86.

---

Yes, programs run other programs all the time. eg a command shell takes input that you type and runs that program. Or in a GUI, double-clicking on a program runs it. The program that draws the file-manager window and receives your double-clicks is itself a program (or graphical shell).

Anyway, the OS has a system call for starting a new program , and by getting enough control to run a small amount of code in the process you're attacking, you (the attacker) can invoke that system call with args to start whatever program you want on the remote computer.

Often you'd choose args like /bin/sh (the Unix shell). Depending on context, its input might still be connected to the network socket you used to send the exploit payload. (Often called "shellcode", because the typical exploit goal is to invoke a shell. Although the term is now more generic, and applies to any executable machine code exploit payload, especially when formatted as a string. Usually this means avoiding any 0 bytes in the machine code.)

---

As I know, any address in a program only belongs itself, meaning that you can't invoke a function of another program thought its address.

Data is code, code is data . As soon as your exploit payload (ie machine code) is read into memory by the process you're attacking, it has an address in the target process.

The simplest kinds of buffer overflows include code and data that overwrites the return address of a function, so the function returns to the exploit payload instead of to its caller. This is the classic stack-smashing attack for buffers allocated on the call stack, like char buf[16]; // nobody ever types more than 16 digit numbers, right? char buf[16]; // nobody ever types more than 16 digit numbers, right? inside a function.

From that page, you already know how an attacker can take control of the return address with a buffer overflow.

Things like non-executable memory eg W^X (either write or exec, not both), and ASLR (address-space layout randomization , are both designed to defeat this sort of attack. If stack addresses are randomized, it's might take a lot of tries before you manage to get the return address to land inside a bunch of NOPs (a "nop sled") in your exploit payload.