Sploit-Dev: A hands on intro to coding exploits

Presented at Notacon 2 (2005), April 10, 2005, 1 p.m. (60 minutes)

Hacking can cover a wide range of loosely related technical and not so technical pursuits. But when we talk about classic or "real" hacking it comes down to system security. In this talk I will be demonstrating a simple buffer overflow, format string exploit, and a heap based attack for those who may never have seen how an exploit is written. The only tools used will be objdump, gcc, gdb, and emacs. Emphasis will be placed on simplicity and open analysis, for anyone interested more complex exploitable code will be provided for those who want to try on their own. Some discussion will be dedicated to modern glibc implementations and how they affect these common attacks, as well as what exactly things like propolice and other common security patches actually do. While all the demonstrations will be against C code running on linux systems, analogies can be drawn to a number of security issues faced "in the wild". At the end some time will be dedicated to discussion. This will be an excellent opportunity to find out what one major facet of hacking is all about.


Presenters:

  • Eric M. aka RootDruid - NYC 2600
    Druid is a self-taught security enthusiast hailing from New York City. He has spoken at the CCC (Chaos Communications Congress) in Berlin and is excited about this opportunity to speak to an American audience. He has participated in a number of WarGames (Hacking challenges) where he learned the skills he will be demonstrating in his talk. He holds down a crappy job at a help desk. Donations of beer in exchange for information are always welcome.

Links:

Similar Presentations: