Exploit › Module 2 › Lesson 1
BOF Named
Buffer overflow names writing past allocation bounds — recognize the class on $PWN_LAB toys; defenders use bounds checks and safe APIs.
Visual · pwn_bof_named
BOF class literacy. $PWN_LAB only. Original Cyberlium.
Opening
A buffer overflow corrupts adjacent memory — the name matters for triage even when you never craft a payload.
Stack buffer overflow: a write continues past a local array, clobbering saved frame data or return metadata. Heap overflow: excess bytes corrupt adjacent heap chunks. Both break memory safety; severity depends on layout and mitigations — not on whether you can build shellcode. Cyberlium names BOF on YOUR toy C at $PWN_LAB so you can spot strcpy/gets patterns and recommend fixes. You will NOT receive byte-by-byte overflow recipes or return-address overwrite tutorials. Next: UAF Named.
1. Stack vs heap BOF (named)
Stack BOF often involves fixed-size locals on the call frame — classic unsafe copies without length checks. Heap BOF involves allocations from malloc — overflow poisons neighboring user data or allocator metadata.
On $PWN_LAB, compile a toy with an obvious narrow buffer and observe gdb stop at fault — document class name and line, not exploit bytes.
Command guide
Try these commands — Stack vs heap BOF (named)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
CWE-120 — https://cwe.mitre.org/data/definitions/120.html (buffer overflow named) CWE-121 — https://cwe.mitre.org/data/definitions/121.html (stack-based overflow) GCC fortify — https://gcc.gnu.org/onlinedocs/gcc/Instrumentation-Options.html#index-fstack-protector
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install build-essential
macOS:
Command — copy this
xcode-select --install # or brew install gcc
Windows: Use WSL or MinGW
═══ LINUX / macOS ═══
Optional command
sudo apt install build-essential # gcc
Command — copy this
export LAB_PWN=${LAB_PWN:-$HOME/cyberlium-lab/t24-pwn}
cat > "$LAB_PWN/src/bof_vuln.c" <<'EOF'
#include <stdio.h>
int main(void) {
char buf[32];
puts("YOUR educational toy — gets() is intentionally unsafe");
gets(buf); /* BUG: unbounded read — literacy demo only */
printf("you typed: %s
", buf);
return 0;
}
EOFCommand — copy this
cat > "$LAB_PWN/src/bof_safe.c" <<'EOF'
#include <stdio.h>
int main(void) {
char buf[32];
puts("SAFE fixed version — fgets with bounds");
if (!fgets(buf, sizeof(buf), stdin)) return 1;
buf[strcspn(buf, "
")] = 0;
printf("you typed: %s
", buf);
return 0;
}
EOFCommand — copy this
gcc -Wall -Wno-deprecated-declarations -O0 -g -o "$LAB_PWN/bin/bof_vuln" "$LAB_PWN/src/bof_vuln.c" gcc -Wall -O0 -g -o "$LAB_PWN/bin/bof_safe" "$LAB_PWN/src/bof_safe.c" grep -E 'gets|fgets|BUG|SAFE' "$LAB_PWN/src/bof_vuln.c" "$LAB_PWN/src/bof_safe.c"
Primary tools to practice this lesson: gcc, grep. Reference sites: CWE-120 (https://cwe.mitre.org/data/definitions/120.html); CWE-121 (https://cwe.mitre.org/data/definitions/121.html); GCC fortify (https://gcc.gnu.org/onlinedocs/gcc/Instrumentation-Options.html#index-fstack-protector). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Common unsafe patterns (defender view)
gets, unbounded strcpy/strcat, sprintf without bounds, read() without length cap. Modern guidance: strncpy with explicit NUL, snprintf, fgets, read with sizeof checks.
Static analysis and compiler warnings (-Wall -Wextra) flag many patterns before runtime.
3. Mitigations defenders enable
Stack canaries detect some stack smashes before return. NX/DEP marks data non-executable — raises bar for code injection (literacy: attackers historically pivoted techniques; defenders layer controls). FORTIFY_SOURCE wraps selected libc calls.
Ship: BOF card — definition, one unsafe API, one mitigation, one $PWN_LAB observation sentence. Next: UAF Named.
4. What you ship: BOF class card for $PWN_LAB
BOF definition, stack vs heap one-liner, unsafe API + mitigation each. Toy crash note — no payload bytes. chmod 600.
5. What you record before the next lesson
Date. BOF class card. $PWN_LAB named. File t24-m02-l01-bof-named.txt chmod 600.
6. Wrong vs right: weaponized exploits vs memory-safety literacy
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Write return-address overwrite steps. Test BOF against a live web server.
Right
Write BOF class card from YOUR toy crash observation. Next: UAF Named.
Mission: name BOF on YOUR toy
1) Define stack and heap BOF in one line each. 2) Name one unsafe API and one safer alternative. 3) List two mitigations (canary, NX). 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Crash at RET with canary message still teaches BOF literacy.
Knowledge Check
APPLY: Buffer overflow literacy on Cyberlium means:
Multiple choice
Knowledge Check
APPLY: True or False: gets() is a classic unsafe pattern associated with BOF.
True or False
Knowledge Check
APPLY: Stack canaries primarily help:
Multiple choice