$ echo "Matt Blaze" | ./blame
It's all Matt Blaze's fault.
or, if you prefer:
$ echo "Bill Gates" | ./blame
It's all Bill Gates's fault.
The program is designed to operate as a network service, e.g., from
the "inetd" daemon under Unix.
Source code for blame.c is attached below and is also available at http://www.cis.upenn.edu/~cis551/blame.cTfYB" [8 0 E ,@ =M P PϨÔ`(3 )=!.
Simple-minded string processing aside (it would be more correct, after all, to say that "It's all Bill Gates' fault"), there is a serious problem with the blame program. Despite Feckless' best efforts, a bug allows anyone who can provide input to this program to run arbitrary code on the target machine. (What might happen if it is run as a network service under inetd, as suggested in the comments?)
Your job is to create input that will cause the blame service to print out the helpful message "Now I own your computer" before it terminates. For example:
$ cat exploit_file | ./blame ... Now I own your computerHere, the "..." may be additional output caused as a side-effect of your attack.
Submit the program that generates your exploit_file as well
as any tools you use to generate parameters and constants. Your
software should be sufficiently docTfYB3
B B 0 [8 E 4@ @~ P PϨk
!)=TfYB
[8 0 E -@ =L P PϨk`(u
)>!umented to allow a novice
programmer to port your code to other platforms or to modify it to
exploit similar weaknesses in other programs. In other words, your
submission should be suitable as a tutorial on exploiting (and
avoiding) this class of vulnerability.
/*
* Blame server. Assigns blame to the person of your choice.
*
* Usage: blame
* (reads one line from standard input)
*
* To compile:
* cc blame.c -o blame
*
* Install under inetd as follows:
* blame stream tcp nowait root /path/to/blame blame
*
* Copyright 2004 by FecklTfYB
_ _ [8 0 E Q.@ = P Pϩ`(%
)>!ess C. Coder, PhD.
*/
#include <stdio.h>
#include <string.h>
#define INPUT_BUFFER 256 /* maximum name size */
/*
* read input, copy into s
* gets() is insecure and prints a warning
* so we use this instead
*/
void getline(char *s)
{
int c;
while ((c=getchar()) != EOF)
*s++ = c;
*s = '\0';
}
/*
* convert newlines to nulls in place
*/
void purgenewlines(char *s)
{
int l;
l = strlen(s);
while (l--)
if (s[l] == '\n')
s[l] = '\0';
}
int main()
{
char scapegoat[INPUT_BUFFER];
getline(scapegoat);
/* this check ensures there's no buffer overflow */
if (strlen(scapegoat) < INPUT_BUFFER) {
purgenewlines(scapegoat);
printf("It's all %s's fault.\n", scapegoat);
}
return 0;
}
Last Revised: 6 January 2005
TfYB
B B 0 [8 E 48@ @ P Pϩ0+~
!)>TfYB B B 0 [8 E 4]@ @[I P Pϩ0+x
!)>YfYB=
0 [8 E 8@ @~ P Pϩ0@m
!)>GET /~cis551/project2.html HTTP/1.1
Connection: Keep-Alive
User-Agent: Mozilla/5.0 (compatible; Konqueror/3.3; FreeBSD) (KHTML, like Gecko)
Referer: http://www.cis.upenn.edu/~cis551/
Accept: text/html, image/jpeg, image/png, text/*, image/*, */*
Accept-Encoding: x-gzip, x-deflate, gzip, deflate
Accept-Charset: iso-8859-1, utf-8;q=0.5, *;q=0.5
Accept-Language: en
Host: www.cis.upenn.edu
YfYBE
[8 0 E /@ =J P Pϩ0 `(
)C!HTTP/1.1 200 OK
Date: Sun, 10 Apr 2005 17:46:01 GMT
Server: Apache/1.3.33 (Unix) PHP/4.3.10 mod_perl/1.29 mod_ssl/2.8.22 OpenSSL/0.9.6e
Last-Modified: Wed, 23 Feb 2005 12:02:33 GMT
ETag: "205813-1048-421c70d9"
Accept-Ranges: bytes
Content-Length: 4168
Keep-Alive: timeout=15, max=98
Connection: Keep-Alive
Content-Type: text/html
$ echo "Matt Blaze" | ./blame
It's all Matt Blaze's fault.
In this project, you will do two things. First, modify the
program to to operate as a network service, accepting connections
on a port. Second, modify your networked program (and write a client)
using SSL encryption.
Source code for the original (buffer-overflow-prone) blame.c is attached below and is YfYB [8 0 E 0@ =I P Pϩ ؔ `( )C!also available at http://www.cis.upenn.edu/~cis551/blame.c.
./blameserver 21212should run the blame service on TCP port 21212, such that
echo Matt Blaze | ./blameclient localhost 21212prints the message
It's all Matt Blaze's fault!Your programs should work on the eniac.seas.upenn.edu machine pool.
/*
* Blame server. Assigns blame to the person of your choice.
*
* Usage: blame
* (reads one line from standard input)
*
* To compile:
* cc blame.c -o blame
*
* Install under inetd as follows:
* blame stream tcp nowait root /path/to/blame blame
*
* Copyright 2004 by Feckless C. Coder, PhD.
*/
#include <stdio.h>
#include <string.h>
#define INPUT_BUFFER 256 /* maximum name size */
/*
* read input, copy into s
* gets() is insecure and prints a warning
* so we use this instead
*/
void getline(char *s)
{
int c;
while ((c=getchar()) != EOF)
*s++ = c;
*s = '\0';
}
/*
* convert newlines to nulls in place
*/
void purgenewlines(char *s)
{
int l;
l = strlen(s);
while (l--)
if (s[l] == '\n')
s[l] = '\0';
}
int main()
{
char scapegoat[INPUT_BUFFER];
getline(scapegoat);
/* this check ensures there's no buffer overflow */
if (strlen(scapegoat) < INPUT_YfYBy
[8 0 E 2@ =I P Pϩ( `(
)C!BUFFER) {
purgenewlines(scapegoat);
printf("It's all %s's fault.\n", scapegoat);
}
return 0;
}
Last Revised: 6 January 2005
YfYB
B B 0 [8 E 4|@ @