INTLPOL 268: Hack Lab
Week 6
Buffer Overflows and Exploits
Week 6
What will we learn today?
So far we have attacked web apps and AI systems from the outside. Today we go one level down: into the program and the machine.
- The bug: how a tiny memory mistake lets an attacker take over a program
- The tool: how a framework turns that bug into a working break-in
- The network: how one foothold becomes control of a whole company
- The payload: what attackers leave behind — malware
Recap
Same idea, one level deeper
What we've done
We fed an app or an AI something it trusted when it shouldn't have: a SQL injection, a crafted request, a hidden instruction. The app did our bidding.
What's new today
Now the "something it trusted" is ordinary data that was too big. When a program mishandles it, we don't just bend the app — we take over the computer running it.
Part one
What is a vulnerability?
A program is just instructions and data
When a program runs, the computer loads two things into memory, side by side:
Instructions
The recipe: the exact steps the processor follows, one after another. "Add these. Compare that. Now jump over here."
Data
The stuff it works on: your name, a file you opened, a message that arrived over the network.
The whole game today: get the computer to treat our data as if it were its instructions.
Not everything is allowed to do everything
Operating systems keep programs in lanes. Some can do almost nothing; a few can do anything.
Attackers want to climb from the first lane to the second. That climb is called privilege escalation.
Your computer runs dozens of programs right now
Browser, mail, chat, updater, printer helper, antivirus, the operating system itself — all running at once, all the time.
Each one accepts input from somewhere: a webpage, a file, a message on the network.
Every place a program accepts input is a door an attacker can knock on.
"Attack surface" = how many doors there are
Small surface
A calculator that only reads the buttons you press. Few inputs, little to attack.
Large surface
A web server that listens to the whole internet, parses files, speaks several protocols. Many inputs, many chances to slip up.
The more a program listens, and the less it checks, the more attack surface it has.
How bad is a bug? Impact × reach
Impact — what it lets you do
Denial of service: crash it, knock it offline.
Code execution: run your own commands on it. Much worse.
Reach — who can trigger it
Local: you already have an account on the machine.
Remote: anyone on the network, no account needed.
The crown jewel: remote code execution with no clicks required — take over a machine across the network while nobody touches it.
Part two · the classic bug
The buffer overflow
A buffer is a box of a fixed size
When a program expects some input, it sets aside a box in memory for it — say, room for 12 letters.
That's fine if you type a short name. But what if you pour in 200 letters?
Like pouring a gallon into a 12-ounce glass: the extra has to go somewhere. It spills onto whatever sits next to the box in memory.
Six lines of code, one missing check
strcpy copies until it runs out of input, not when the box is full. Hand it 200 characters and it keeps writing, right past the end of the box.
Example after Wikipedia, "Stack buffer overflow."
Right next to the box is a very important note
When one part of a program calls another, it leaves a note: "when you're done, come back to here."
That note — the return address — sits in memory just past our little box.
Overflow far enough and you rewrite the note
The spilled input overwrites the "come back to here" note.
Now when the program finishes, it doesn't go back where it should. It goes wherever the attacker wrote.
We just stole the steering wheel.
From a crash to running your commands
Crash
Point the note at nonsense — the program dies. Annoying, not dangerous.
Aim
Point the note at instructions the attacker smuggled in as part of that same oversized input.
Control
The program now runs the attacker's instructions — with that program's privileges. This is code execution.
The smuggled instructions are called a payload, or shellcode when their job is to open a command shell.
Defenders fought back — but it still happens
Non-executable memory
Mark the data area "data only." The processor refuses to run instructions from where input lands. (DEP / NX.)
Shuffle the layout
Move things to random addresses each run, so the attacker can't know where to aim. (ASLR.)
Canary in the coal mine
Put a secret value just before the note; if it's been trampled, abort before returning. (Stack canaries.)
These raise the bar a lot. Attackers answer with cleverer techniques — and old, unpatched systems have none of these.
Part three · doing it for real
Exploitation frameworks
Nobody writes every exploit by hand
Finding a new overflow and crafting a reliable payload is hard, specialist work. Most attackers use a framework: a toolbox of exploits other people already built.
Metasploit
The best-known one. A searchable library of thousands of exploits and payloads, plus a "handler" that catches the shell when an exploit lands.
Why it matters for policy
It turns expert attacks into point-and-click. The skill bar drops; the number of people who can do it goes way up.
Every break-in has the same four moves
Find
Scan the target. What programs is it running, and on which ports?
Match
Pick an exploit for a program that's out of date or misconfigured.
Fire
Point it at the target, choose a payload, launch.
Shell
If it works, you get a command prompt on the machine. You're in.
This is exactly the sequence you'll run in today's lab, on your own isolated target.
A real one
EternalBlue: when this got very real
- A remote, no-click overflow in Windows file sharing (SMBv1). Take over a machine across the network with nobody logged in.
- Reportedly developed by the NSA, then stolen and leaked in 2017.
- Within weeks it powered WannaCry and NotPetya — worldwide outages, hospitals, shipping, billions in damage.
- A patch existed before the outbreak. Unpatched machines were hit anyway.
One memory bug, one leak, global consequences. That's why this topic is in a policy class.
Part four
From one machine to the whole company
Real intrusions follow a pattern: the "kill chain"
study the target
get something in
trigger the bug
set up shop
command remotely
spread sideways
the objective
Getting in (steps 1–3) is just the start. The real work is everything after.
After Lockheed Martin's "Cyber Kill Chain."
A made-up company to attack
Malice starts with nothing. She wants Alice's files. She almost never gets there in one jump.
Big companies wire every computer together
To manage thousands of laptops, IT links them to a central domain server. It decides who can log in where, and admins can reach any machine to fix it.
Convenient for IT. Also convenient for an attacker: take the center, and you have everything.
Many roads lead to the CFO's files
- Straight at Alice: a phishing email with malware. Direct, but she might be careful.
- Through Sally: own the IT admin, then use her access to reach Alice "for support."
- Through Bob the intern: own anyone, climb to control of the domain, then help yourself.
- Through the front door: an internet-facing service with an unpatched bug — no phishing needed.
Recently
The "front door" route is everywhere now
In 2023, a ransomware gang found one bug — a SQL injection, like Lab 4 — in MOVEit, a file-transfer appliance many companies exposed to the internet.
One bug, thousands of organizations breached through it — no employee had to click anything.
Internet-facing software is the softest, most valuable target there is.
2009–2010
Operation Aurora
- A sophisticated group broke into Google and dozens of other companies.
- Entry via a browser bug, then they climbed to domain control using the techniques we're about to see.
- Among their targets: the system Google used to respond to law-enforcement data requests.
A textbook kill chain, run by a nation-state, against a company you use every day.
Part five · how the climb works
Passwords, hashes, and moving sideways
First: what is a hash?
- A hash is a fingerprint of some input: same input always gives the same fingerprint.
- Always the same length, no matter how big the input.
- Easy to compute forward; very hard to reverse back to the original.
So systems store the fingerprint of your password, not the password itself.
Why password fingerprints end up on other machines
Sally the admin needs to log into Alice's computer to fix it. To check Sally's password, Alice's computer briefly handles Sally's password fingerprint.
Handy — until you ask: what if Alice's computer is already under attacker control?
Pass-the-hash: you don't even need the password
- Malware on Alice's machine grabs Sally's password fingerprint as it goes by.
- For many systems, the fingerprint is as good as the password — present it and you're logged in as Sally.
- Now the attacker is the IT admin. Repeat the trick to reach the domain server, and the whole company is theirs.
This is lateral movement: hop from machine to machine, collecting stronger and stronger access.
Part six · what they leave behind
Malware
"Malware" is an umbrella word
Virus
Infects other programs and rides along; usually needs a human to spread it.
Worm
Spreads by itself, machine to machine, no human needed.
Trojan
Pretends to be something harmless so you install it yourself.
Rootkit
Hides deep in the system so you can't see it's there.
Two worms worth knowing
The Morris Worm (1988)
The first worm to take out a big chunk of the internet — about 6,000 computers, roughly a tenth of the internet at the time. It spread using an overflow in a common server program. Written by a grad student.
Stuxnet (2010)
The most complex malware of its day. Jumped air-gapped networks to quietly wreck Iranian nuclear centrifuges. Malware that broke physical machines.
The business model now
Ransomware: crime as an industry
- Break in, encrypt everything, demand payment to unlock — and threaten to leak the data too.
- Run by loosely-coupled "affiliate" networks, each specializing in one step. Demands now reach tens of millions.
- Hit Baltimore, Oakland, a Los Angeles hospital, Suffolk County — cities on paper and radio for weeks.
The same kill chain you learned today, pointed at a city or a hospital for money.
Hands on · Lab 6
Lab
- Start your own throwaway practice target on your Kali
- Scan it and spot an out-of-date service
- Launch the matching Metasploit exploit and catch a root shell
- Read the secret only the owner can see — then shut it down
Step-by-step instructions are in the course console: console.hacklab.info