Главная
Study mode:
on
1
Intro
2
Brief reminder
3
Simple illustration
4
Mismanaged bounds check
5
Size restrictions?
6
250 bytes example
7
Another design concept
8
Double injection
9
How to find descriptor
10
"Might" be possible?
11
Correct return address?
12
Pop another frame
13
Situation #1 illustrated
14
Calculate return address
15
Function calls
16
Why do they look like this?
17
Clean return requirement
18
Server
19
Initial injection
20
First payload
21
Find socket descriptor
22
Using the socket
23
Second payload
24
Still using the same socket
25
Finding return address
26
Code
27
Restore internal registers
28
Summary
29
Benefits
30
IDS Countermeasures
31
Other countermeasures
32
Questions?
Description:
Explore advanced techniques for evading Intrusion Detection Systems (IDS) when designing buffer overflow exploits in this 40-minute Black Hat Europe 2001 conference talk by Anders Ingeborn. Delve into concepts such as mismanaged bounds checks, size restrictions, and double injection methods. Learn how to find socket descriptors, calculate return addresses, and handle function calls effectively. Examine practical scenarios, including server exploitation through initial and secondary payloads. Gain insights into restoring internal registers, understanding the benefits of these techniques, and potential IDS countermeasures. Enhance your knowledge of exploit development and security vulnerabilities while considering the ethical implications and defensive strategies against such attacks.

IDS Evasion Design Tricks for Buffer Overflow Exploits

Black Hat
Add to list
0:00 / 0:00