Draw the stack memory allocation graph to show the stack memory of the function foo() in executing target code

Programming assignment 1 required to download a .zip file on webcourse (project1.zip Download project1.zip), and also need you to work on the department Eustis3 Linux machine: “eustis3.eecs.ucf.edu”. If you are on off-campus network, you need to first connect to UCF campus network by using VPN first (check our lecture slides on eustis). You need to log in to Eustis3 machine by using SSH client software.
Delivery:
Submit your source code (the modified exploit.c) and a project report document (in word or PDF format) through WebCourse homework submission page. Your project report should contain:
Explain how you design the overflowed buffer.
Draw the stack memory allocation graph to show the stack memory of the function foo() in executing target code (before running the line : strcpy(buf); in foo() function) You should show the addresses of
return address on stack,
the four local variables localBuf, len, var1, ptr,.
Please refer to the stack memory graph for the example code I drew in my lecture.
Show how you use Gdb installed in Eustis to find out the stack information. You must put the screen shot image of the SSH shell showing the Gdb running procedure in your report (if one screenshot is not enough to show the complete procedure, then use several screen-shot pictures).
Show the screen-shot image of your exploit code that successfully creates a shell in compromise (showing double $ signs and one ‘exit’ command will return back to your ssh shell), somewhat like my own exploit code here (you must show the directly execution of your exploit code, not running under GDB):
exploit-run-example.PNG
Objective:
You need to complete the coding of the attack program (exploit.c) to obtain a shell by exploiting stack overflow vulnerability of a given target application (target.c). In reality, if this target application is running on a server accepting remote user input, you can use your exploit code to obtain a command shell (most likely to have root privilege) on the remote server without any password.
This project is modified from the programming project 1 in U. Berkley’s Dr. Dawn Song’s course “CS161: computer security” in Fall 2008:
http://inst.eecs.berkeley.edu/~cs161/fa08/
Target
The target (target.c) is a simple application which copies the command-line parameter into its own internal buffer stored on the stack. The source code is provided for your reference. Of course you can build your own target while working on the assignment, but the submitted code MUST use the prebuilt target.c.
Exploit
The exploit is the application (exploit.c) which calls the target (executable program) and passes in an artfully crafted character buffer which causes the target program to give you a shell.
The compressed file attached to the assignment on WebCourse is “CAP6135-project1-source.zip”. You can unzip it under your own machine and upload extracted folders and files up to your account on Eustis machine, or, you can upload this .zip file onto Eustis machine directly and use this command to extract it:
czou@net1547:~$ unzip project1.zip
which will generate two directories: targets/ and exploits/ under current directory.
What you need to modify is only the exploit.c code under the exploits/ directory (do not modify the target.c code). You will need to modify “exploit.c” to add your buffer overflow code. Noted that you will need to modify the following line in the exploit.c code:
#define TARGET “/home/net/czou/project1/targets/target”
to use your own “target” directory.
The following are the suggested steps to complete this assignment:
Familiarize yourself with gdb. Be sure to watch my lecture on how I used gdb. You will need gdb to debug your target/exploit and display memory/stack information. With its help, you can decide where is the return address to overwrite and how to jump to execute the provided shellcode. Look up commands: break, run, continue, info f, p/x, backtrace, attach…
Draw the stack (locations of parameters, local variables and registers) of the target application once execution reaches the first statement of the foo function.
Figure out the length of the exploit buffer.
Figure out where in the exploit buffer the new RETURN address will go.
Compute the new RETURN address.
The code to spawn a shell is provided in the exploits/shellcode.h file. You can use exploits/testshellcode to test it.
Important notes:
Eustis3.eecs.ucf.edu (the server you’ll be working on) employs a technique called “Stack address randomization”, which randomizes the beginning of the stack for each new process. Therefore your SP register will always be different when you start a new process. This behavior is not desirable for this assignment, because we want the SP to be the same every time we execute the exploit/target (see the aforementioned tutorial for why this is so important).
The way around this is by using the wrapper setarch in the following way:
czou@eustis:~/exploits$ setarch i686 -R ./exploit
The –R parameter disables stack address randomization and creates a new process by executing ./exploit.
In addition, please use the compile command in the README under each directory to compile and generate your executable code. The compile options will disable both “StackGuard” defense and None-executable Stack defense used by our Unix server.

Calculate your order
Pages (275 words)
Standard price: $0.00
Client Reviews
4.9
Sitejabber
4.6
Trustpilot
4.8
Our Guarantees
100% Confidentiality
Information about customers is confidential and never disclosed to third parties.
Original Writing
We complete all papers from scratch. You can get a plagiarism report.
Timely Delivery
No missed deadlines – 97% of assignments are completed in time.
Money Back
If you're confident that a writer didn't follow your order details, ask for a refund.

Calculate the price of your order

You will get a personal manager and a discount.
We'll send you the first draft for approval by at
Total price:
$0.00
Power up Your Academic Success with the
Team of Professionals. We’ve Got Your Back.
Power up Your Study Success with Experts We’ve Got Your Back.