add example of bypassing authentication using buffer overflow.

1 files changed, 33 insertions, 0 deletions

diff --git a/auth_overflow.c b/auth_overflow.c
new file mode 100644
index 0000000..96848bc
--- /dev/null
+++ b/auth_overflow.c
@@ -0,0 +1,33 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+int check_authentication(const char *password)
+{
+  int auth_flag = 0;
+  char password_buffer[16];
+
+  strcpy(password_buffer, password);
+
+  if (strcmp(password_buffer, "brillig") == 0)
+    auth_flag = 1;
+  if (strcmp(password_buffer, "outgrabe") == 0)
+    auth_flag = 1;
+
+  return auth_flag;
+}
+
+int main(int argc, const char *argv[])
+{
+  if (argc < 2) {
+    printf("Usage: %s <password>\n", argv[0]);
+    exit(0);
+  }
+  if (check_authentication(argv[1])) {
+    printf("\n,-=-=-=-=-=-=-=-=-=-=-=-\n");
+    printf("      Access Granted.\n");
+    printf("\n,-=-=-=-=-=-=-=-=-=-=-=-\n");
+  } else {
+    printf("\nAccess Denied.\n");
+  }
+}