Security Features enabled in Linux Debian and Ubuntu

Question

i am actually doing some tutorials about ROP on Linux. So i tried to follow the tutorial and compiled some of the example codes to try ROP in a small scope. But actually when i am trying to exploit the executables either get some message like:

./a.out "$(python -c 'print "A"*0x70 + "BBBB" + "\x00\x40\x06\x2d"')"                                       
*** stack smashing detected ***: ./a.out terminated

So i tryed to compile the Binarys without the gcc Securityfeatures like:

gcc -ggdb -o a.out -mpreferred-stack-boundary=4 myfirstrop.c -z execstack or
gcc -ggdb -o a.out -fno-stack-protector -mpreferred-stack-boundary=4 myfirstrop.c -z execstack

But i either get the stack smashing message or it prints some message like "Bus-error" So the question is, is there something like an overview of all the Security features enabled per default on Linux Debian/Ubuntu Systems? So i kann check them all and might disable them features. If not i have to install DVL in a VM and Start from there over again. Thanks in advance

Answer 1

The hardening guide on the official Debian wiki is the one of the most complete resource for Debian I have come across. You should also ensure things like ASLR is turned off if you are just getting started with exploit writing.

It's highly recommended that you use a VM for this though, basic exploits requires turning off a lot of protections to work, and this can be dangerous if you use your day-to-day machine. VMs also has a handy snapshot feature that you can use to rollback the system if something unexpected happens.