Or are there techniques to just get a shell?
What I am interested in is if I have compiled some C code using only a small library with insignificant possible calls, does this restrict the attacker from doing anything?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
It probably helps a little, raising the bar and requiring a more sophisticated attack, but I wouldn't hang my security hat on this.
The better way to think about it is that, in the worst case, they have the ability to add arbitrary code to your program. They can do anything that C code can do, including read/writes to files on your filesystem (ie reading your data or inserting backdoors into other programs) or calling
exec() to run other programs. So yes, a buffer overflow can do anything a shell can do.
If you want to be on the safe side, consider a buffer overflow to be game over and instead spend your time and effort on defence in depth around the service that could be vulnerable. For example limiting who can send data to this service by putting it behind an authentication server, firewalls, and deep packet inspection; follow the principle of least privilege to lock down privileges of the user running the service, etc.
TL;DR: good developers should always be double-checking their code to avoid having buffer overflows or null pointer dereferences, meanwhile good sys admins should always assume the devs have been sloppy and wrap the service in an onion of security to minimize the potential damage.