current community

your communities

more stack exchange communities

Stack Exchange
tour help
Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.
up vote -3 down vote favorite

I was trying to overflow buffers and I was wondering ,

Is there anyway to do a buffer overflows without using environment variables ?

share|improve this question

closed as unclear what you're asking by TildalWave, schroeder, Xander, Mark, Rory Alsop♦ Nov 6 '14 at 8:26

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.
1  
I'm not sure that you understand buffer overflows. Can you elaborate on how you think environment variables are involved? –  schroeder Nov 5 '14 at 21:50
    
Sorry for being vague the last time . I took time to understand how buffer overflow works. My question is when writing an exploit , we design a buffer in the exploit program containing shell code and name it something like $BUF and we run the vulnerable program using this environment variable . I am asking if there is a possibility for me to carry out the same thing without using the environment variable –  daa.. Nov 5 '14 at 22:27
    
This is still confusing. Why do you not want to use a variable? Where would the code come from? –  schroeder Nov 5 '14 at 22:34
    
Alright assume we need to write a program that would execute a shell code by buffer overflowing the target program(The program would pass argument to the target program) .. So if we have to modify the return address in the target program, we have to know what address to replace it with. How do we do that ? –  daa.. Nov 6 '14 at 1:06
    
Your question has nothing to do with variables. Each buffer (in each program) has its own size that needs to be exceeded. You need to know what that is beforehand, then craft a payload that will trigger the overflow and execute your code. You don't use the same code for every potential overflow. –  schroeder Nov 6 '14 at 4:37

1 Answer 1

up vote 3 down vote

Yes, you normally overflow buffers without using environment variables. In fact, I'm not exactly sure how you would manage to overflow a buffer using only an environment variable.

Ok, that last part is slightly facetious, you could potentially malform an environment variable to cause an overflow as well, but you can cause a buffer overflow with any unchecked variable length input. It could be a text box, a command line parameter, an environment variable, a memory value from another program, an API call, whatever... If it takes input of variable length and doesn't check that it fits, it can potentially be used to cause an overflow.

share|improve this answer
    
Thanks for the answer. But what if I have to write an exploit program that would launch the target program and pass an argument to it. In this case we might not know what we have to overwrite the return address with right? –  daa.. Nov 6 '14 at 1:09
    
We don't need to know an address. We need to know an offset. The structures of how a program loads in to memory are generally consistent, so you would just make a payload that is oversized by enough to be able to push in to some control flow in memory and then hijack it to jump wherever we want. It's not the simplest thing to do in practice, which is why not every overflow can be easily exploited, but the basic principal isn't that complicated. –  AJ Henderson Nov 6 '14 at 1:14
    
Thanks a lot! That was useful. –  daa.. Nov 6 '14 at 1:19

Not the answer you're looking for? Browse other questions tagged or ask your own question.