Into the Darkness: Dissection and Explanation of Proven Attack Source Code

As of October 17, 2002, the SANS / FBI Top Twenty Vulnerability List (Version 3.21) was led (on the UNIX side) by a group of vulnerabilities falling under the umbrella of the Remote Procedure Call. This paper will not attempt to advise the reader on how to protect against an RPC attack, nor lecture on the horrible effects of a successful RPC compromise. This paper was written for system administrators or junior programmers who know what an attack can do, but don't know the 'how'. The concept of overflowing a static buffer, cracking a weak password or sending a malformed packet is easy to explain in broad terms, but actually describing one step by step is not something I've been able to find readily accessible. The intent of this paper is to show the reader how an RPC attack works at the source code level. While in-depth programming experience is not a prerequisite for reading this paper, the reader is assumed to have a good working knowledge of general UNIX system internals.