DANGEROUS C Functions gets & strcpy (PicoCTF 2022 #04 buffer-overflow0)

Поділитися
Вставка
  • Опубліковано 26 січ 2025
  • Help the channel grow with a Like, Comment, & Subscribe!
    ❤️ Support ➡ jh.live/patreon ↔ jh.live/paypal ↔ jh.live/buymea...
    Check out the affiliates below for more free or discounted learning!
    🖥️ Zero-Point Security ➡ Certified Red Team Operator jh.live/crto
    💻Zero-Point Security ➡ C2 Development with C# jh.live/c2dev
    👨🏻💻7aSecurity ➡ Hacking Courses & Pentesting jh.live/7asecu...
    📗Humble Bundle ➡ jh.live/humble...
    🌎Follow me! ➡ jh.live/discord ↔ jh.live/twitter ↔ jh.live/linkedin ↔ jh.live/instagram ↔ jh.live/tiktok
    📧Contact me! (I may be very slow to respond or completely unable to)
    🤝Sponsorship Inquiries ➡ jh.live/sponso...
    🚩 CTF Hosting Requests ➡ jh.live/ctf
    🎤 Speaking Requests ➡ jh.live/speaking
    💥 Malware Submission ➡ jh.live/malware
    ❓ Everything Else ➡ jh.live/etc

КОМЕНТАРІ • 48

  • @jlm1144
    @jlm1144 2 роки тому +7

    I was at that part in my Security+ chapter about buffer-overflow and I was looking for an example of what it really did in C. Thanks man !! :)

  • @jpierce2l33t
    @jpierce2l33t 2 роки тому +2

    Dude, following along right with you, even going ahead now until I get stuck! Please keep going, this is great and I appreciate you so much!

  • @mrnord1989
    @mrnord1989 2 роки тому +1

    Thank you John, every time I watch one of your videos I always learn something new :)

  • @wilcosec
    @wilcosec 2 роки тому +1

    Great series! Keep it coming!

  • @Rhyl4x
    @Rhyl4x 2 роки тому +1

    These videos are so awesome. Thanks so much John

  • @VA3KAMA3
    @VA3KAMA3 2 роки тому +1

    Super cool series, always a pleasure to watch them! Keep it up!

  • @greyether777
    @greyether777 2 роки тому

    Thanks John. We appreciate how you thoroughly explain everything and keep it simple at the same time. You're a rockstar!!

  • @windows74001
    @windows74001 2 роки тому +2

    Haha I'm a noob at these CTF challenges and had troubles solving this one for some reason. Looking through it with your guidance I'm like "Wow I'm an idiot, it was so simple" lol

  • @JB4lly
    @JB4lly 2 роки тому +16

    Maybe putting -fstack-protector when compiling would have worked? Not sure

  • @drioko
    @drioko 7 місяців тому

    Awesome

  • @zer001
    @zer001 2 роки тому +2

    This was fun! Please more John. :)

  • @KGAD0831
    @KGAD0831 2 роки тому +1

    Loving this series, John. Please finish it!

  • @LDowning0190
    @LDowning0190 2 роки тому

    Enjoyed the video. Keep them coming.

  • @wChris_
    @wChris_ 2 роки тому +21

    it seems to be a kali linux thing having no stack-protector when building with gcc, as it works on my machine (ubuntu)

    • @FunkadelicFeed
      @FunkadelicFeed 2 роки тому

      You have to pass “fstack-protector" when compiling with gcc

  • @tuxmaster2715
    @tuxmaster2715 Рік тому

    You the best John, thanks a lot for these material and your explanations,
    You are a master mind my friend

  • @kaleabalemayehu
    @kaleabalemayehu 2 роки тому +1

    you already know it but let me tell you one more time YOU ARE AWESOME.

  • @logiciananimal
    @logiciananimal 2 роки тому +6

    3 ways to fail the computer systems course I did ~20 years ago: 1) cheat 2) do way too little adequate work 3) use gets()

  • @MiguelDevOps
    @MiguelDevOps 2 роки тому +1

    6:34 a minor correction: the char array buf1 is 100*sizeof(char) Bytes long

  • @sunriser_yt
    @sunriser_yt 2 роки тому +1

    I wanted to subscribe, but I've completely forgotten that I already was. Anyway, thanks for another informative video!

  • @masudrahman253
    @masudrahman253 2 роки тому

    Done Watching Cool Thanks John

  • @henrym5034
    @henrym5034 2 роки тому +2

    Thank you for all the beginner-friendly content
    A question as an absolute newbie into binary: only an input of length>=20 causes the SIGSEGV, i.e. it doesn’t happen with say 17. Is there a way to know or estimate how many more bytes I need?

    • @hedgechasing
      @hedgechasing 2 роки тому +5

      The segfault is triggered by overwriting the return address on the stack (changing its value to some random garbage makes the program try to jump to that address and read code from there which the OS does not allow and sends the segfault signal) how many bytes you need to modify depends on the layout of the stack. You can use a debugger and look at the addresses of the local variables or look at the disassembly to see how much space is being allocated on the stack, but in this particular case the extra four bytes are the space on the stack for the local variable input. The layout of the stack is return address, then input then the buffer (though the stack grows down so these end up at decreasing addresses). When you put an input less than 16 characters it fits into the buffer. If you put 16-19 characters it starts clobbering the local variable input, and only once you put in 20 or more characters does it start touching the return address and cause the segfault.

    • @henrym5034
      @henrym5034 2 роки тому +2

      @@hedgechasing thanks for the explanation! I definitely have to look at it more

  • @anmoldeepsingh9281
    @anmoldeepsingh9281 Рік тому

    i think the stack smashing wasnt detected probably the way gcc was compiled, its default could have been -fno-stack-protector, so default build task will never include a canary

  • @TehPwnerer
    @TehPwnerer 2 роки тому +1

    Oh the days I coded in C/C++, flush of output buffer is not guaranteed without the flush

  • @cqundefine
    @cqundefine 2 роки тому +3

    sigsegv stands for signal segmentation violation

  • @sorrefly
    @sorrefly 2 роки тому

    09:00 laughs in format string vulnerability and return-to-libc

  • @frixx22
    @frixx22 2 роки тому

    If this is training wheels, I am still at the crawling phase XD. I'll get there one day :')

  • @stopper0203
    @stopper0203 Рік тому

    I don't understand how just adding a few extra characters causes the flag to magically appear. Is it because added the extra characters causes some specific code to execute? If so which part?

  • @adilbougma3114
    @adilbougma3114 2 роки тому

    This is rust will dominated the c language 😂😂 but hey nice reverse engineer 😀 😉

  • @rsvv6828
    @rsvv6828 2 роки тому

    What is the version of Sublime text you are using?? Please answer

  • @roachxyz
    @roachxyz 2 роки тому

    Is overflow on this the same as overflow on Hacknet?

  • @fjr2go
    @fjr2go 2 роки тому

    Nice'n'easy :)

  • @krgrief
    @krgrief Рік тому

    you don’t explain how the buffer overflow even works though..?

  • @Pixailz
    @Pixailz 2 роки тому

    Do you have references / explanation about the {,_COMPLETE}, i searched all day long on Shell expansion and no one say a thing about this tips :)

    • @iyousef46
      @iyousef46 2 роки тому

      It's a bash feature called brace expansion.

  • @zer001
    @zer001 2 роки тому +3

    I think strcpy is the most used function to demonstrate bufferoverflows.

  • @BrAiNeeBug
    @BrAiNeeBug 2 роки тому

    you made a 64bit version, so there more buffers i think.

  • @Angel-Pizzaeater
    @Angel-Pizzaeater 2 роки тому

  • @ethanrodrigo4060
    @ethanrodrigo4060 2 роки тому

    How can this be dangerous?

  • @guilherme5094
    @guilherme5094 2 роки тому

    👍

  • @acidopcodes
    @acidopcodes 2 роки тому +5

    I gave the 69th like 😁

  • @OmarHosam203
    @OmarHosam203 2 роки тому +1

    2nd?

    • @remox8894
      @remox8894 2 місяці тому

      All what required is to enter input of size more than 16 char length. That will cause buffer overflow.
      That fires the handler setup by signal(SIGSEGV,...
      Which gives the flag😂
      SIGSEGV
      (Signal Segmentation Violation) Invalid access to storage − When a program tries to read or write outside the memory it is allocated for it.

  • @alier3217
    @alier3217 2 роки тому

    NVIDIA should be tried for unfair profit and hoarding...

  • @inquisitivemanipulator776
    @inquisitivemanipulator776 2 роки тому

    1st?