hacking-the-art-of-exploitation

methods. If either of these passwords is used, the function returns 1, which
grants access. You should be able to figure most of that out just by looking at
the source code before compiling it. Use the -g option when you do compile
it, though, since we will be debugging this later.
reader@hacking:~/booksrc $ gcc -g -o auth_overflow auth_overflow.c
reader@hacking:~/booksrc $ ./auth_overflow
Usage: ./auth_overflow
reader@hacking:~/booksrc $ ./auth_overflow test
Access Denied.
reader@hacking:~/booksrc $ ./auth_overflow brillig
-=-=-=-=-=-=-=-=-=-=-=-=-=-
Access Granted.
-=-=-=-=-=-=-=-=-=-=-=-=-=reader@hacking:~/booksrc
$ ./auth_overflow outgrabe
-=-=-=-=-=-=-=-=-=-=-=-=-=-
Access Granted.
-=-=-=-=-=-=-=-=-=-=-=-=-=reader@hacking:~/booksrc
$
So far, everything works as the source code says it should. This is to be
expected from something as deterministic as a computer program. But an
overflow can lead to unexpected and even contradictory behavior, allowing
access without a proper password.
reader@hacking:~/booksrc $ ./auth_overflow AAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
-=-=-=-=-=-=-=-=-=-=-=-=-=-
Access Granted.
-=-=-=-=-=-=-=-=-=-=-=-=-=reader@hacking:~/booksrc
$
You may have already figured out what happened, but let’s look at this
with a debugger to see the specifics of it.
reader@hacking:~/booksrc $ gdb -q ./auth_overflow
Using host libthread_db library "/lib/tls/i686/cmov/libthread_db.so.1".
(gdb) list 1
1 #include
2 #include
3 #include
4
5 int check_authentication(char *password) {
6 int auth_flag = 0;
7 char password_buffer[16];
8
9 strcpy(password_buffer, password);
10
(gdb)
Exploitation 123