code injection example c

Understanding and doing Code Injection in C

stackoverflow.com › questions › 1739349 › understanding-and-doing-code-injection-in-c

The general trick has to do with how the program's code and variables are layed out in memory. For example, when a function is called the program (code inserted by the compiler) must store the address of the instruction to return to. So if this is the 32 bit word just before the beginning of the stack, one could do:

 void foo()
 {
    int array[5];
    int var = 0;
    int var2 = 0;

    // read in user input
    printf("Enter index and value to write:");
    scanf("%i", var);
    scanf("%i", var2);

    // malicious user might set var to -1 and var2 to an address to execute
    // if say the 32-bit value before the stack variables is the instruction to
    // return to
    array[var] = var2

    // return now goes to malicious code
 }

(So your job is to construct code so that such a thing is not possible. :) )

The rules for how a function call is implemented, stack variables allocated, values passed, and return values returned back is called the calling convention. I reccomend reading the attached article for a good indepth coverage of C calling conventionts.

Answer from Doug T. on Stack Overflow

Stack Overflow

stackoverflow.com › questions › 1739349 › understanding-and-doing-code-injection-in-c

Understanding and doing Code Injection in C - Stack Overflow

Top answer

1 of 3

11

The general trick has to do with how the program's code and variables are layed out in memory. For example, when a function is called the program (code inserted by the compiler) must store the address of the instruction to return to. So if this is the 32 bit word just before the beginning of the stack, one could do:

 void foo()
 {
    int array[5];
    int var = 0;
    int var2 = 0;

    // read in user input
    printf("Enter index and value to write:");
    scanf("%i", var);
    scanf("%i", var2);

    // malicious user might set var to -1 and var2 to an address to execute
    // if say the 32-bit value before the stack variables is the instruction to
    // return to
    array[var] = var2

    // return now goes to malicious code
 }

(So your job is to construct code so that such a thing is not possible. :) )

The rules for how a function call is implemented, stack variables allocated, values passed, and return values returned back is called the calling convention. I reccomend reading the attached article for a good indepth coverage of C calling conventionts.

2 of 3

2

If you allocate a buffer on the stack, and it overflows, it writes onto the stack. The stack contains the return pointer for the function that allocated the buffer. So, if you overflow a buffer on the stack, you can set the return pointer to something arbitrary; thereby giving you control of the thread of execution.

As to actually injecting the code, that depends. The stack - or rather, the page containing it - is often set not to allow code execution; but historically it would have been possible to store small malicious programs in the buffer itself on the stack. Return oriented programming is a fairly new variant of the return-to-libc attack, both of which work around NX bits.

OWASP Foundation

owasp.org › www-community › attacks › Code_Injection

Code Injection | OWASP Foundation

Author: Weilin Zhong, Rezos ... Bergman, Camilo, Andrew Smith, kingthorin · Code Injection is the general term for attack types which consist of injecting code that is then interpreted/executed by the application. This type of attack exploits poor handling of untrusted data. These types of attacks are usually made possible due to a lack of proper input/output data validation, for example...

Discussions

exploit - C/C++ code injection - Information Security Stack Exchange

I think you are confused between overflows,code injection and shell execute function. ... An injection attack is when you can get a program to interpret data in a way unintended by the developer. For example, ' OR 1=1 --, the single apostrophe is interpreted as "end of string", not just as data. More on security.stackexchange.com

security.stackexchange.com

October 29, 2019

ELI5: How does code injection work? How can something be ran by user input, can't you just avoid letting user input run code?

It can only happen from user input, and you should never need to run it, but in the some cases, like SQL injection, one error in the dev's code can make an entire site vulnerable. Have a look at this Computerphile video. More on reddit.com

r/explainlikeimfive

13

0

February 3, 2015

How do I inject code with a buffer overflow attack?

Check out liveoverflow. He has a video that will do exactly this IIRC. If you’re reading input with gets then you can just overwrite the buffer and subsequently the return address with the desired function’s address. More on reddit.com

r/C_Programming

21

33

May 3, 2019

ELI5: How do hackers "inject" code into a webpage, like in the Newegg checkout process?

There are two main types of code injection vulnerabilities for websites: SQL injection and cross-site scripting (XSS). SQL is the language used to retrieve information from the database. In general queries are formatted like this: SELECT [attributes] FROM [table name] WHERE [condition] For example if you search for "hammer" in a DIY catalog, it may look like this: SELECT brand, name, price FROM tools WHERE type= "hammer" In this case, "hammer" is chosen by the user, and should be handled carefully. An attacker could write some SQL there, and create the following query: SELECT brand, name, price FROM tools WHERE type = "hammer AND SELECT password FROM passwords" Computerphile has a nice video explaining it and also an actual example . In a similar way, attackers can also inject scripts into HTML pages. If you rightclick on any webpage and select "view page source", you can find some More on reddit.com

r/explainlikeimfive

6

13

September 20, 2018

Understanding and doing Code Injection in C

stackoverflow.com › questions › 1739349 › understanding-and-doing-code-injection-in-c

The general trick has to do with how the program's code and variables are layed out in memory. For example, when a function is called the program (code inserted by the compiler) must store the address of the instruction to return to. So if this is the 32 bit word just before the beginning of the stack, one could do:

 void foo()
 {
    int array[5];
    int var = 0;
    int var2 = 0;

    // read in user input
    printf("Enter index and value to write:");
    scanf("%i", var);
    scanf("%i", var2);

    // malicious user might set var to -1 and var2 to an address to execute
    // if say the 32-bit value before the stack variables is the instruction to
    // return to
    array[var] = var2

    // return now goes to malicious code
 }

(So your job is to construct code so that such a thing is not possible. :) )

The rules for how a function call is implemented, stack variables allocated, values passed, and return values returned back is called the calling convention. I reccomend reading the attached article for a good indepth coverage of C calling conventionts.

Answer from Doug T. on Stack Overflow

Videos