What's a good program to practice buffer overflows on (for educational purposes only)?

I have recently learned the basics of buffer overflows, and I have written a few very simple pieces of C/C++ code with unsafe buffers and have produced some interesting results.

Now my question is this: Can you name a program that's actually out there in the wild that has a known buffer ove开发者_运维问答rflow vulnerability? I am especially looking for something that runs over a network, if possible.

I have seen tutorials and read articles and even watched videos that have talked about/demonstrated the buffer overflow vulnerability in the Ability FTP Server ver. 2.34, but I can not for the life of me find a single copy of it online anywhere. I can find plenty of downloads of non-vulnerable versions, but non of the educationally useful ones. Any help on this front would also be appreciated.

Thanks a bunch.

---

There is a great book which teaches exploiting buffer overflows (amongst other vulnerabilities). Book comes with a Linux LiveCD which is nicely set up with compilers/debuggers and plenty of exploitable programs.

Highly recommended if you haven't already picked it up:

Hacking. The Art of Exploitation

---

Can you name a program that's actually out there in the wild that has a known buffer overflow vulnerability?

Yes, but hopefully it will be patched before you are successfully able to demonstrate your attack. The longer a known vulnerability exists the more likely a the vulnerability will be patched (see queing theory). So, it is really the 'in the wild' part that is too restrictive. Why not try some historical vulnerabilities. The Buffer Overfolw Page at Perdue is a good place to start. They list RPC DCOM in ntdll.dll and Sendmail 8.11 has a Remote Buffer Overflow bug. Additionally telnetd has a buffer overflow bug you can find in FreeBSD 4.3-RELEASE systems.

---

The ability server is super to practice on. I wrote a research paper about this some years ago, which you can access here:

http://blog.sat0ri.com/reverse-code-engineering/2009/03/finding-exploiting-and-fixing-bugs-in-binaries/

This give a good introduction to vulnerabilities and uses the method vulnerability as an example.

I hope it is useful!

Regards, sharpe