Smashing the Stack for Fun and Profit (1996)

What a classic! Phrack stopped publishing some time ago but the world of security ploughs on, who can recommend similar modern resources to Phrack?<p>Here&#x27;s a few I&#x27;m aware of:<p><a href="https:&#x2F;&#x2F;www.alchemistowl.org&#x2F;pocorgtfo&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.alchemistowl.org&#x2F;pocorgtfo&#x2F;</a><p><a href="https:&#x2F;&#x2F;secret.club&#x2F;" rel="nofollow">https:&#x2F;&#x2F;secret.club&#x2F;</a>

This article, and then working through the book &quot;Hacking and the Art of Exploitation&quot; taught me the true fundamentals of the C programming language, and Linux. The other key ingredient was working through the classic &quot;digital evolution&quot; wargames where you&#x27;d SSH into a box as level1 and work your way up from there.

In 2017 I got a second hand Cisco ASA just to play with the shadowbrokers tools. EXTRABACON was the codename for the SNMP exploit using a buffer overflow.<p>This was an interesting excercise because there were NO logs of this happening on the Cisco ASA, not even when ramping every loglevel to debug. Well only on the console port. Exception in readline() or something like it. Doing stuff for security monitoring in daily life this ehm was alarming, but not unexpected. Fixing “No logs” is often a challenge for blue teams.<p>Anyway it was alarming enough to find and read through the Common Criteria EAL4+ certification docs for the Cisco ASA only to find that SNMP was excluded from certification scope. I still have the idea in the back of my head to explore scope exclusions in other certification docs for other unfortunate exclusions.<p>Also the lack of mitigations like stack canaries, ASLR or others was quite surprising for a certified black box security device on the network perimeter.

2009 had the main discussion: <a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=943185" rel="nofollow">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=943185</a><p>I thought there were others but maybe not? Single-comment threads from 2016, 2014, 2012, 2011:<p><a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=11007757" rel="nofollow">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=11007757</a><p><a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=10821934" rel="nofollow">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=10821934</a><p><a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=8773298" rel="nofollow">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=8773298</a><p><a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=4903622" rel="nofollow">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=4903622</a><p><a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=3061955" rel="nofollow">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=3061955</a>

A classic, but these days if you want to reproduce those bugs you need to build your code with -fno-stack-protector, enable executable stack, disable ASLR in the kernel, etc.

I think the main thing to discuss here is how, 25 yrs later, we&#x27;re still getting overflow bugs.

This paper also inspired the recent academic paper &quot;Attacking Zcash Protocol For Fun And Profit&quot; available at <a href="https:&#x2F;&#x2F;attackingzcash.com" rel="nofollow">https:&#x2F;&#x2F;attackingzcash.com</a> and on IACR: <a href="https:&#x2F;&#x2F;eprint.iacr.org&#x2F;2020&#x2F;627" rel="nofollow">https:&#x2F;&#x2F;eprint.iacr.org&#x2F;2020&#x2F;627</a><p>It describes new kinds of metadata leakage attacks that can be launched against privacy coins, by adversaries with large budgets, such as professional criminal organizations, blockchain analysis companies and nation states. The privacy coin HUSH has developed this defensive technology and was first to implement it in September 2019.<p>There is a YouTube video where the author explains why he named the paper this way, this link has the timestamp where it&#x27;s talked about: <a href="https:&#x2F;&#x2F;youtu.be&#x2F;berM7Dnnoz4?t=405" rel="nofollow">https:&#x2F;&#x2F;youtu.be&#x2F;berM7Dnnoz4?t=405</a><p>&quot;This is a whole new research field I am creating, that is why I called it Attacking Zcash Protocol For Fun And Profit, just like Smashing The Stack for Fun And Profit, it created a whole new field&quot;<p>Also, for the hardcore HN nerds: The paper focuses on Zcash Protocol, but the ideas apply to any cryptocoin with a transaction graph, so Monero is definitely vulnerable. Much more vulnerable that Zcash Protocol.

This has been required reading for all the pentesters at my org for the past 20 years.

Reading this article back in the day is how I learned how stack smashing works! I also remember when the EFF stopped hosting Phrack because most of their bandwidth was people downloading every issue off the EFF’s web server.

<a href="http:&#x2F;&#x2F;smashthestack.org&#x2F;wargames.html" rel="nofollow">http:&#x2F;&#x2F;smashthestack.org&#x2F;wargames.html</a><p>&gt; The Smash the Stack Wargaming Network hosts several Wargames. A Wargame in our context can be described as an ethical hacking environment that supports the simulation of real world software vulnerability theories or concepts and allows for the legal execution of exploitation techniques. Software can be an Operating System, network protocol, or any userland application.

Gera&#x27;s Insecure Programming tutorial on advanced Buffer Overflows was quite seminal. The site is gone but there&#x27;s a GitHub repo now.<p><a href="https:&#x2F;&#x2F;github.com&#x2F;gerasdf&#x2F;InsecureProgramming" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;gerasdf&#x2F;InsecureProgramming</a>

I sometimes wish time would rewind so I can experience the hacking scene in it&#x27;s full glory.

Does someone know why weren&#x27;t stack overflow exploits more common in the early 90s?<p>If the Morris worm used them in 88, how did the technique get lost until this phrack article come out?<p>Makes me wonder if there are still entire classes of exploits that are undiscovered out there.

A true classic that is just as relevant today as ever.<p>Know thy stack!<p>Yes, you still have a .text section!

I learned so much from this article about how memory works when I was starting out, thanks phrack!

how I loved trying this in the computer science lab when this 1st hit gopher.

Being totally immature here, but &quot;Smashing the stack for fun and profit&quot; would make a great book title for the Chaturbate memoir.

This and the SYNflood attack are IMHO the best hacking papers I ever seen.<p>This one ages extremely well.

Elias is my hero.