2

i am actually doing some tutorials about ROP on Linux. So i tried to follow the tutorial and compiled some of the example codes to try ROP in a small scope. But actually when i am trying to exploit the executables either get some message like:

./a.out "$(python -c 'print "A"*0x70 + "BBBB" + "\x00\x40\x06\x2d"')"                                       
*** stack smashing detected ***: ./a.out terminated

So i tryed to compile the Binarys without the gcc Securityfeatures like:

gcc -ggdb -o a.out -mpreferred-stack-boundary=4 myfirstrop.c -z execstack or
gcc -ggdb -o a.out -fno-stack-protector -mpreferred-stack-boundary=4 myfirstrop.c -z execstack

But i either get the stack smashing message or it prints some message like "Bus-error" So the question is, is there something like an overview of all the Security features enabled per default on Linux Debian/Ubuntu Systems? So i kann check them all and might disable them features. If not i have to install DVL in a VM and Start from there over again. Thanks in advance

4

The hardening guide on the official Debian wiki is the one of the most complete resource for Debian I have come across. You should also ensure things like ASLR is turned off if you are just getting started with exploit writing.

It's highly recommended that you use a VM for this though, basic exploits requires turning off a lot of protections to work, and this can be dangerous if you use your day-to-day machine. VMs also has a handy snapshot feature that you can use to rollback the system if something unexpected happens.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.