Red Squad
BuyMeACoffee
  • 🏠/home/red-squad
    • ⏰Recently Added
    • πŸ₯³Support our projects
    • ⚰️Is There Life After Death ?
  • 🌐Web Hacking
    • 🚩CTFs shortcuts
    • πŸ—ΊοΈAudits plan
      • Exposition Audit - Plan
      • Internal Audit - Plan
      • External Audit - Plan
    • πŸ•΅οΈOSINT
      • πŸ”Search Engines
      • πŸ§‘User OSINT
      • πŸ‡«πŸ‡²Domains, IP, IOT
      • πŸ•ΈοΈWebsite OSINT
      • πŸ—£οΈBreaches/Leaks
      • πŸ’ΌBusiness OSINT
      • πŸ§…TOR network
      • πŸ”¬Source Code
      • πŸ₯ΈDorks
      • βš”οΈVulnerabilities and IOC
      • πŸ“¦MISC
    • Enumeration
      • Network Scanners
      • Directory/Files Scanners
      • Web Scanners
        • Subdomains
    • πŸ”—HTTP Stuff
      • HTTP Methods
        • 403 Bypass
      • Security Headers
      • HTTP Parameters
    • πŸ”Sessions / Tokens
      • Cookies
      • JWT
        • Attacking JWT
    • πŸ’‰Injections
      • HTML | XSS
      • SQLi
        • SQLmap
        • NoSQLi
      • XXE
      • LaTex
    • πŸͺ±Web Vulnerabilities
      • CSRF
      • ClickJacking
      • Files / Upload
        • πŸ—ƒοΈFile Upload Bypass
        • πŸ“¦ZIP Slip
      • IDOR
      • LFI
        • Files to look for
      • Remote Code Execution
    • β›”WAF Bypass
    • ✍️Servers / CMS
      • 🐈Tomcat
      • πŸ’§Drupal
      • ✏️Oracle APEX
      • 🐦Apache
      • πŸ”·WordPress
        • Wordpress eBook Download < 1.2 - CVE-2016-10924
      • ⏩SAP
      • πŸ•΄οΈJenkins
      • πŸ–‡οΈJoomla!
      • 🏒Server-Side Vulnerabilities
        • Server-Side Request Forgery
        • Server-Side Template Injection
    • πŸ–‡οΈAPI
      • GraphQL
  • 🐧Linux Hacking
    • πŸ§—Privilege Escalation
      • Find passwords
      • Ansible
      • Manual Checks
      • Automated Checks
    • πŸ‘£Cover tracks
    • πŸšͺBackdoors
    • β­•Reverse Shells
      • Shell Stabilizing
      • PwnCat
      • Ping-Pong
    • πŸ”’Compiled Binaries
    • 🌊Buffer Overflow
      • Introduction
      • Fundamentals
      • Exploits
    • 🐳Docker Escape
    • 🀝File sharing
  • πŸͺŸWindows Hacking
    • πŸ‘₯Active Directory
      • 1. Reconnaissance
        • Domain Network Enumeration
          • SMB Enumeration
          • LDAP Enumeration
      • 2. Initial Attack Vectors
        • Kerberos
          • Lookupsid
          • findDelegation
          • ASREPRoast
          • Kerbrute
        • AD CS
          • Basics
          • Exploits
        • Network
          • SMBRelay
          • LLMNR_NBT NS Poisoning
            • Relay Poisoning Ressources
          • IPv6 Attacks
        • Impacket
          • Windows Secrets
        • Autologon
        • PowerView.ps1
      • 3. Post-Compromise Enumeration
        • ACLs Abuse
        • Computer enumeration
        • PowerView
        • BloodHound
        • MimiKatz
        • PingCastle
      • 4. Post-Compromise Attacks
        • WSUS Poison
        • AlwaysInstallElevated
        • DCSync
        • Dumping LSASS
        • Dumping NTDS.dit
        • Golden Tickets
        • GPP Attacks
        • Kerberoasting - SPN
        • Pass the Hash
        • Pass the Password
        • Rubeus
      • 5. PrivEsc & MISC
        • Automated scripts
        • Exploits
          • noPac - CVE-2021-42278
          • ZeroLogon - CVE-2020-1472
          • LocalPotato - CVE-2023-21746
          • PrintNightMare - CVE-2021-34527
          • Other CVEs
    • πŸ’‘Useful AD Commands
    • πŸ§—Privilege Escalation
    • 🐚Shells
    • πŸ”“Bypasses
      • UAC
      • Antivirus
      • AppLocker
      • BitLocker
    • πŸ“ƒOffice
      • Analyze office files
      • Forgot password of file ?
      • CVE-2023-21716 (Microsoft Word RCE)
    • πŸ‘©β€πŸ’»SCCM | MECM
      • Configuration Audit
      • Dump
      • Hack It
        • Reconnaisance
        • PXE/OSD Exploitation
        • NTLM Relay from SCCM Clients
        • Privilege Escalation
        • Lateral Movement
        • Malware Deployment
      • Basics
    • πŸ’ŽMicrosoft 365
      • Configuration
      • Hacking
  • πŸ’½Systems
    • πŸ•β€πŸ¦ΊServices Enumeration
    • πŸ–¨οΈPrinters
      • Printer Exploitation Tool (PRET)
      • CUPS
    • πŸ›‘οΈFortinet
    • πŸ“ΉCCTV / IP Cameras
      • Hacking
  • πŸŽ†Networks
    • πŸŒͺ️Pivoting
      • Tools / Guide
        • Proxychains / FoxyProxy
        • SSH Tunnelling / Port Forwarding
        • Plinx.exe
        • Socat
        • Chisel
        • Sshuttle
        • Ligolo-Ng : Pivoting use cases
      • SocksOverRDP
    • πŸ”₯Firewalls
      • πŸ”₯Evasion
    • πŸ”—Proxies
  • πŸ“±Mobile Hacking
    • πŸ€–Android
      • Introduction
      • Reversing
      • Static Analysis
      • Dynamic Analysis
      • Disable SSL Pinning
      • Bypass Root Detection
      • Network / Traffic Analysis
    • 🍏iOS
      • Introduction
      • Static Analysis
      • Dynamic Analysis
      • JailBreak
    • πŸ“ΊIOT
      • IOTGoat OWASP | Walkthrough
      • Resources
  • Configuration
    • ChromeOS
    • Mobile
      • Android
    • IBM
      • AS400
      • AIX
  • πŸ“‘Wireless Hacking
    • πŸŽ†Wi-Fi Attacks
      • EvilTwin
      • Cracking WPA/WPA2
      • Sniffing
    • 🫐Bluetooth
      • BLE Locks Hacking
  • πŸ‘¨β€πŸ’»Code Audit
    • βœ”οΈBest Practices
    • ❌Bad Practices
    • βš’οΈTools
  • πŸ‘Thick Client Hacking
    • πŸ“Thick Client Pentesting Methodology
    • πŸ—„οΈResources
  • πŸ—„οΈMISC
    • πŸ”‘Default Credentials
    • πŸ”»CVEs
      • [CVE-2022-0847] - dirtypipe
      • [CVE-2021-4034] - Pwnkit
      • [CVE-2021-45105] - Log4J
      • [CVE-2018-15473] - OPENSSH < 7.7
    • 🦊Browser Extensions
    • πŸ€–AI
      • chatGPT alternatives
      • Large Language Model Hacking
    • πŸ”­Hacking Labs
    • πŸ”«Exploitation Frameworks
  • πŸ•΅οΈOPSEC
    • πŸ—οΈPrivacy
      • Best tools
      • Online Anonymity
      • Browser Configuration
  • πŸ”‘CRACKING | ENCODING
    • πŸ₯ŠBruteforce tools
    • πŸ“Wordlists
    • 🧨Cracking Tools
    • πŸ”¬Encoding | Decoding Tools
    • πŸ”Steganography | Cipher
  • πŸ”΄RED TEAM
    • πŸ“₯Password Extract
      • Firefox
    • πŸ•΅οΈSpy cam
    • πŸ”’Lock Picking
    • 🎣Phishing
      • Infrastructure
      • Resources
  • πŸŒ€Whistle Blowing
    • πŸ“ΉCCTV
  • πŸ”΅BLUE TEAM
    • 🧩Forensics
    • 🦹Malware Analysis
    • πŸ› οΈTools
    • 🍯HoneyPots
    • πŸŽ†Networks Security
    • πŸͺ™Online IoC Scanners
  • 🐞Bug Bounty Related
    • Searching for CVEs
    • [FR] Legal
    • Dorks
  • πŸ–₯️DEVELOPERS
    • πŸ‘¨β€πŸ’»IDE
  • πŸ“šLEARNING
    • Windows
      • Active Directory
      • Kerberos
      • Pass-the-*
    • SQL
      • SQSHell | sqsh | skwish
      • NoSQL
      • DB infos
    • SSL/TLS
      • Configuration on MariaDB
Powered by GitBook
On this page
  • Brief
  • Central Processing Unit (CPU)
  • Memory
  • Control Unit
  • Instruction Cycle

Was this helpful?

Edit on GitHub
Export as PDF
  1. Linux Hacking
  2. Buffer Overflow

Introduction

PreviousBuffer OverflowNextFundamentals

Last updated 10 months ago

Was this helpful?

Brief

What is a Buffer Overflow ?

In short, buffer overflows are caused by incorrect program code, which cannot process too large amounts of data correctly by the CPU and can, therefore, manipulate the CPU's processing. Suppose too much data is written to a reserved memory buffer or stack that is not limited, for example. In that case, specific registers will be overwritten, which may allow code to be executed.

A buffer overflow can cause the program to crash, corrupt data, or harm data structures in the program's runtime. The last of these can overwrite the specific program's return address with arbitrary data, allowing an attacker to execute commands with the privileges of the process vulnerable to the buffer overflow by passing arbitrary machine code. This code is usually intended to give us more convenient access to the system to use it for our own purposes. Such buffer overflows in common servers, and Internet worms also exploit client software.

The most significant cause of buffer overflows is the use of programming languages that do not automatically monitor limits of memory buffer or stack to prevent (stack-based) buffer overflow. These include the C and C++ languages, which emphasize performance and do not require monitoring.

Central Processing Unit (CPU)

CPU Architecture

The Central Processing Unit (CPU) is the functional unit in a computer that provides the actual processing power. It is responsible for processing information and controlling the processing operations. To do this, the CPU fetches commands from memory one after the other and initiates data processing. Each CPU has an architecture on which it was built. The best-known CPU architectures are:

  • x86/i386 - (AMD & Intel)

  • x86-64/amd64 - (Microsoft & Sun)

  • ARM - (Acorn) Each of these CPU architectures is built in a specific way, called Instruction Set Architecture (ISA), which the CPU uses to execute its processes. ISA, therefore, describes the behavior of a CPU concerning the instruction set used. The instruction sets are defined so that they are independent of a specific implementation. Above all, ISA gives us the possibility to understand the unified behavior of machine code in assembly language concerning registers, data types, etc.

There are four different types of ISA:

  • CISC - Complex Instruction Set Computing

  • RISC - Reduced Instruction Set Computing

  • VLIW - Very Long Instruction Word

  • EPIC - Explicitly Parallel Instruction Computing

In the Von-Neumann architecture, the most important units, the Arithmetical Logical Unit (ALU) and Control Unit (CU), are combined in the actual Central Processing Unit (CPU).

The CPU is responsible for executing the instructions and for flow control.

The instructions are executed one after the other, step by step.

The commands and data are fetched from memory by the CU.

The connection between processor, memory, and input/output unit is called a bus system, which is not mentioned in the original Von-Neumann architecture but plays an essential role in practice.

In the Von-Neumann architecture, all instructions and data are transferred via the bus system.

Memory

Memory

It can be divided into 2 categories :

  • Primary memory

    • The Cache and Random Access Memory (RAM).

    • We can think of it as leaving something at one of our friends to pick it up again later. But for this, it is necessary to know the friend's address to pick up what we have left behind. It is the same as RAM. RAM describes a memory type whose memory allocations can be accessed directly and randomly by their memory addresses. The cache is integrated into the processor and serves as a buffer, which in the best case, ensures that the processor is always fed with data and program code. Before the program code and data enter the processor for processing, the RAM serves as data storage. The size of the RAM determines the amount of data that can be stored for the processor. However, when the primary memory loses power, all stored contents are lost.

  • Secondary memory

    • The external data storage, such as HDD/SSD, Flash Drives and CD/DVD-ROMs of a computer, which is not directly accessed by the CPU, but via the I/O interfaces. In other words, it is a mass storage device. It is used to permanently store data that does not need to be processed at the moment. Compared to primary memory, it has a higher storage capacity, can store data permanently even without a power supply, and works much slower.

Control Unit

Control Unit (CU)

The Control Unit (CU) is responsible for the correct interworking of the processor's individual parts. An internal bus connection is used for the tasks of the CU.

The tasks of the CU can be summarised as follows:

  • Reading data from the RAM

  • Saving data in RAM

  • Provide, decode and execute an instruction

  • Processing the inputs from peripheral devices

  • Processing of outputs to peripheral devices

  • Interrupt control

  • Monitoring of the entire system

Instruction Cycle

Instruction
Description
  1. FETCH

The next machine instruction address is read from the Instruction Address Register (IAR). It is then loaded from the Cache or RAM into the Instruction Register (IR).

  1. DECODE

The instruction decoder converts the instructions and starts the necessary circuits to execute the instruction.

  1. FETCH OPERANDS

If further data have to be loaded for execution, these are loaded from the cache or RAM into the working registers.

  1. EXECUTE

The instruction is executed. This can be, for example, operations in the ALU, a jump in the program, the writing back of results into the working registers, or the control of peripheral devices. Depending on the result of some instructions, the status register is set, which can be evaluated by subsequent instructions.

  1. UPDATE INSTRUCTION POINTER

If no jump instruction has been executed in the EXECUTE phase, the IAR is now increased by the length of the instruction so that it points to the next machine instruction.

🐧
🌊
CPU Architecture