Imagine that the server program is a setuid program owned by the root, then after you penetrate the program with a shell running, you become the ROOT and you can remove the whole file system if you want. So it it extremely risky to have a setuid program with stack-overflow vulnerability.

Make sure that all the programs including yours must be complied by "cc",  not "gcc".

1.  In the "ass3" directory, there are two exploitable programs, server1 and server2. I have given you the source codes of server1.c and server2.c. Now you need to write programs, exploit1 and exploit2, to exploit their stack overflow vulnerabilities in server1 and server2respectively. All of your exploit programs should successfully launch a shell eventually.

You should read the articles linked from the course web page before you try to write your programs. Do not use the attack.c that I gave you because it is not flexible. Use some program in the article. Your program should be user friendly and general. I would suggest you to have at least two arguments into your program: bu?ersize and o?set. Run your program something like

exploit1bu?ersize o?set and exploit2 bu?ersize o?set

You can try your program A FEW times to find out the working arguments so you can set up a working bu?er to overflow the stacks for server1 and server2. After you find out what will be the working arguments from your general attack program, put the explanation in your README file and in your report. In your README file, you must let TA know how to run your programs to exploit server1, and server2. Make sure that your programs andparameters work for apache. TA will run your programs on apache.

2.  Answer the following questions.

(1)  Why server2 is hard to attack by bu?er overflow than server1.

(2)  To successfully attack server2, can the assembly shell code be put in the copy2()'s frame? Why or why not?

(3) Tell me your ideas how you layout your bu?er in terms of NOP, shell code, return addresses in order to attack server2 successfully. Tell me which return address you are to change? Is it the return address for copy2 to return to copy1 or the return address for copy1 to return to main? Or the return address for main to return to its parent?

(4) Will the last printf in the main(): printf(" Good Bye!... ) be printed out if you successfully execute the shell program in your input bu?er? Why or why not?

3.  Answer the following questions.

When you try to exploit a server, the results may be one of the following three cases: (1) the server program finishes okay. (2) abort with illegal instruction. (3) abort with bus error. Please explain the causes of each case and what action you like to do when having each case in order to successfully exploit the target server program? You should explain them in terms of bu?er size and return address, etc.

4.  Socket Programming Question. You need to write a program to attack two servers: listen and listen1.

In order for you to get start more easily, I've provided a simple socket application called "listen and speak" in the assignment directory "socket". Two programs are provided. One is called "listen" (and also "listen1"), and the other is called "speak". Invoke "listen" first in one machine by providing an unused port number, for example 7000, and then invoke "speak" in another machine (or THE SAME MACHINE) by providing the name of the machine running "listen" and the same port number. Then you can type some sentences from the "speak" machine. After you type return, the string you just typed in will be displayed in the "listen" machine. Study these two programs, you will know how to write socket programs.

Do the following. Open two X-windown (for example, use putty) on apache. In one window, run "listen 7000" and in another windows, run "speak apache 7000". Then you can do the same thing to run "listen1 6000" and "speak apache 6000" in another X-window.

You can see that each of listen.c and listen1 has a stack overflow vulnerability. Try to exploit it. You need to revise speak.c so the new program, called "attack",can prepare a well-crafted message and send it to listen and listen1. And then a shell should be run in listen or listen1.

Develop your program in that "socket" directory. Write README clearly; tell TA how to run your program. To make the testing easy, TA will run "listen" and "listen1" in apache and run your attack program in apache as well. Make your programs run like this

5.  SUGGESTIONS: Don't think it an easy programming. You must read article 1 and article 2 to get some ideas first. My attack.c there is NOT a good one for you to do this assignment. A program in one article there can be a good one for you to revise to finish this assignment. Check it out.

The programming must be done in SUN Sparc machines, for example, apache.

6.  Make sure you have a subdirectory "socket" under directory "ass3" which contains your codes related to the socket programs.

The grading of your programs is based on the clarity, correctness, e?ciency, and programming styles of your programs. Do not expect that you can get full points even your program runs correctly.

7.  Make sure that your programs work in SUN machine. TAwill test your programs in that machine.

Be honest. If your program does not work, SAY SO. TA will read your programs, compile your programs and test your programs. If your program does not work but you "claim" yours works, you will have severe penalty!