What can protect a C file from buffer overflows?

Question

Looking around trying to answer my question i found those compilation parameters:

1. PIE
2. RelRO
3. NX
4. Heap exec
5. Sf (source fortification)
6. SSP
7. ASLR (not a compilation parameter, i know)

From what I understand, none of these protection are responsible for the issue which I'm facing. I'm attempting to do a buffer overflow on a binary with at least the ASLR activated. Using gdb-peda and I managed to find the offset at which i overwrite the saved value of the IP register. This offset is 170. Using a cyclic pattern (pattern_create 174 within gdb-peda) containing 174 characters and ending with 'AtAA' i manage to get IP to contain EIP: 0x41417441 ('AtAA') after the ret instruction.

At that point I was like : "Yeah that looks good". I then (not knowing at that time that ASLR was up) built my payload and it weighed also 174 bytes.

When running this binary with this payload, i can't manage to alter neither the value of EIP nor the one of EBP. While it worked perflecty fine with the cyclic pattern with the exact same length. Meaning that i can cause the program to segfault because the instruction at 0x41417441 is not a proper instruction.

So I assume that there is some kind of protection which understand that there is some shellcode in the stack and that it protects the ip register ? Even tho it doesn"t at any point raise an exception.

Thanks !

Answer 1

Try to attempt an overflow with your payload under GDB and debug it. I bet the problem is that your payload contains characters considered special by the input function in the binary, such as \0 or \n. Input function simply stops writing to the buffer after encountering them.