Or are there techniques to just get a shell?

What I am interested in is if I have compiled some C code using only a small library with insignificant possible calls, does this restrict the attacker from doing anything?


It probably helps a little, raising the bar and requiring a more sophisticated attack, but I wouldn't hang my security hat on this.

The better way to think about it is that, in the worst case, they have the ability to add arbitrary code to your program. They can do anything that C code can do, including read/writes to files on your filesystem (ie reading your data or inserting backdoors into other programs) or calling exec() to run other programs. So yes, a buffer overflow can do anything a shell can do.

If you want to be on the safe side, consider a buffer overflow to be game over and instead spend your time and effort on defence in depth around the service that could be vulnerable. For example limiting who can send data to this service by putting it behind an authentication server, firewalls, and deep packet inspection; follow the principle of least privilege to lock down privileges of the user running the service, etc.

TL;DR: good developers should always be double-checking their code to avoid having buffer overflows or null pointer dereferences, meanwhile good sys admins should always assume the devs have been sloppy and wrap the service in an onion of security to minimize the potential damage.

  • 4
    In reality (with NX+ASLR), you can't usually execute arbitrary code from a buffer overflow. You're limited to (ab)using the compiled code, so a smaller binary with less library calls will be harder to exploit.
    – grc
    Jun 19 '16 at 14:52
  • 4
    @grc if you put up a better answer's I'll happily upvote it. Jun 19 '16 at 15:03
  • 1
    @whatever489 Sorry for the generic answer, I know it's not really what you were looking for. If somebody does post an answer analyzing what can be exploited through a buffer overflow, I'd love to read it too! Jun 19 '16 at 20:53
  • 1
    @whatever489 Maybe it would tip off the sys admins, or maybe advanced hackers (like those employed by government cyber warfare departments) can get in, plant their persistent backdoor, extract their data, and clean up any traces of the attack all in a minute or two. Trouble is: we have no idea what the best hackers are capable of, so I always assume the worst. Jun 19 '16 at 21:56
  • 1
    I know. I'm just saying that attacker is not limited to that small library, but to whole libc which is implicitly linked.
    – domen
    Jun 20 '16 at 9:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.