Yesterday's meeting introduced the fundamentals of Binary Exploitation, with a focus on understanding how Linux-based systems execute code and how memory vulnerabilities can be leveraged to gain control of a program. Our session covered environment setup, assembly language basics, and the mechanics of the stack before diving into buffer overflow attacks. Members were then given a set of challenges to practice these techniques on a dedicated platform.

Assembly Language

The first part of the meeting was dedicated to Assembly Language, the low-level language that represents what a CPU actually does. We explored basic syntax and the role of registers - small, fast storage locations within the CPU used for data manipulation. Key registers discussed included:

• •General Purpose Registers: rax, rbx, rcx, rdx, etc., used for various arithmetic and logical operations.
• •Special Purpose Registers: rsp (Stack Pointer), which tracks the top of the stack; rbp (Base Pointer), which defines the base of the current stack frame; and rip (Instruction Pointer), which points to the next command to be executed.

The Stack

Understanding the stack was critical to the session. The stack is a special region of memory used to store local variables and manage function calls. We reviewed how data is added and removed using push and pop instructions, and how the stack "grows down" from high memory addresses to low addresses. We also discussed how function calls use the stack to store "return addresses" - the location the program should jump back to once a function finishes its execution.

Buffer Overflows

The core exploitation technique covered was the buffer overflow. This vulnerability occurs when a program writes more data to a buffer than it was designed to hold, causing the excess data to "spill over" and overwrite adjacent memory. In a basic attack, a user can provide a carefully crafted input that overwrites other local variables or, more critically, the return address on the stack. By overwriting the return address, an attacker can hijack the program's control flow to execute unintended code.