EC-Council Certified Secure Programmer

Page 46• Figures: Fake Chunk, Overwritten Chunk• OpenSSL SSLv2 Malformed Client Key Remote Buffer Overflow Vulnerability CAN-2002-0656• Exploitation• Exploitation Sample Code• The Complication• Improving the Exploit• Integer Bug Exploits• Integer Wrapping• Program: Addition-Based Integer Wrapping• Multiplication-Based Integer Wrapping• Bypassing Size Checkso Unsigned Size Check Without Integer Wrappingo Signed Size Check Without Integer Wrapping• Using the Metasploit Framework• Determining Attack Vector• Finding the Offset: Overwriting the Return Address• The First Attack String• Overwriting EIP with a Known Pattern• Selecting a Control Vector• Finding a Return Address• Selecting the Search Method in the Metasploit Opcode Database• Search Method in Metasploit Opcode Database• Using the Return Address:o Inserting the Return Addresso Verifying Return Address Reliability• Nop Sleds: Increasing Reliability with a Nop Sled• Choosing a Payload and Encodero Listing Available Payloadshttp://www.eccouncil.orgEC-Council