How They Hack: Buffer Overflow & GDB Analysis - James Lyne

Following on from the simple buffer overflow demonstration this shows a more focused use of the ability to overwrite data enabling an attacker to control the return pointer and have the computer execute alternative code. We step through a simple binary, identify the flaw and then exploit it. This video will likely raise more security and exploitation questions than answer them (it is a big topic) but I hope that it inspires interest and enhances your understanding a little.

[mrbangkockney]

Seems you’ve stopped posting vids...but this is by far the best intro to BO and gdp our there. I salute you good sir, and please come back!

[segintendorocks]

This guy is freaking awesome. He explains it so much better than my professor :D.

[muhammadkashif]

This is literally some of the best and practical explaination conveyed so nicely, a low level stuff (pun intended :D), great respect

[OVVAISNAB]

Best video explanation of this seemingly complicated topic, thank you!

[rj-njuk]

Hi James, very nice video. I am interested in system programming, and it is so difficult to find a tutorial video like this. Please don't stop.

[trishaatluri]

sooo helpful - would have been up all night doing my pset if it weren't for this video

[bjarkismari]

How did you find the return pointer just by looking at the stack?

[BeSharpInCSharp]

The only thing that is NOT CLEAR from this video is how you guessed the return address? How did you know exactly which address should be replaced by B ascii values?

[shyngyskerimbekov]

I am delighted, acquire so much understandable infromations, TY man!

[ca]

This video is really high quality content! <3

[JannisAdmek]

This video was so helpful, I watched it twice :)

[manojamrutharaj]

Thanks for this wonderful analysis video....

[GURUYATHI]

I understood properly, thank you sir for the video

[alex]

If i want to put a shellcode, the return address is the bottom of the stacj, isn't it ?

[mohammadahmedragab]

thank you so much for clear explanation. Please where can I find a full course of your courses ?

[claudiocostanzo]

I do the same exact step but i only have seg fault. Can It be because the Memory region of my eip( return pointer) Is only readable?

[ahmedlimam]

Thank I have a little problem, saying that I can write into the buffer through an argv[1] once I figure how much character I need and I figute what the return pointer address is, if I execute ./program my payload + p32(address I need in hex) when I check gdb the return address changed but not to the address I need it to be, as if it read the "\" and the "x" of the little endian p32 as a value on their own, how can I change that?

[kooners]

8:50 I'm really confused on how he can tell it's the return pointer

[User-cvee]

Why does the stack store new data towards the return pointer? Wouldn't going the opposite way ensure rp is never touched?

[evilmulle]

When you print the stack with x/##x $esp, the first address that you call the offset, is that just the first address of the following 4 * 4 bytes?