Re: Blind Remote Buffer Overflow

[sirsyko () ISHIBOO COM (Ralph The Wonder Llama)]

> What does a theoretically feasible attack of this nature look like?  Lets
> say that you're up against a webserver that runs some CGI C.  How do you
> find and exploit a buffer overflow without having access to the code?
>
> It seems that you first need to find a buffer overflow.  What is the
> symptom here because when you dump core on one httpd proc then you'll just
> spawn another one.  The service doesn't go down, so how do you know you
> just caused the proc to core?
>
> Then once you've found a buffer overflow, I guess you need to start
> blindly guessing buffer sizes and locations until you get a winning
> combination -- here the fact that webservers respawn would decidedly work
> to your advantage.  You can also probably bet that the buffer size is damn
> close to whatever size causes the proc to core, if you can determine that.
>
> Can anyone flesh this out further, or knock big holes in this process, or
> think of a radically different approach which is better?  Then, how can
> you make it even harder to exploit these kinds of holes blindly?

I'm not much of a security guru, but I really dont see how much of what you've
put into this concept of "blind exploiting" is possible. In order to exploit
something, you need to know the vulnerability. The vulnerability has many
dependencies:

- Machine Architecture
- Operating System
- Application
- What the process behind the application's use of remote input.

There are many ways of giving sight to the blind method of attacking. There
are many way's of "fingerprinting" a machine to find out its architecture
and/or operating system from remote. Its relatively easy to determine the app
from remote as well. Once you've determined the arch/os/application, its
*typically* easy to find either the source code, or a system you'll have local
access to so you can examine the local response to your remote attack. Once
you've nailed down the vulnerability and the exploit you are set.

I'm pretty sure this answers 100% of the attack process to one degree or
another. Part/Most if not All of these steps are usually followed and/or
required to generate a successful attack. Without the ability to
telekinetically examine the resonse to your attack, this is the method you'll
be following.

Please knock holes in my process as well :)