Hot answers tagged

97 votes
Accepted

Is it dangerous to compile arbitrary C?

A bit of a weird one, but: it's a denial-of-service risk, or potential information disclosure. Because C's preprocessor will cheerfully include any file specified in an #include directive, somebody ...
user avatar
  • 39.5k
43 votes

Is it dangerous to compile arbitrary C?

Compiler bombs C is a very powerful language, and some of the terrible things you can do with it would shock you. For example, you can create a 16 byte C program that takes 27 minutes to compile, and ...
user avatar
29 votes

Is it dangerous to compile arbitrary C?

@AndréBorie is correct. Compilers and the corresponding configuration will not be well vetted for security issues, so generally speaking you should not compile untrusted code. The risk is that a ...
user avatar
  • 13.8k
16 votes

Is it dangerous to compile arbitrary C?

Yes, it's dangerous: but as people have said it's possible to do. I'm the author and maintainer of the online compilers at https://gcc.godbolt.org/, and I've found it pretty workable to make it safe ...
user avatar
15 votes

Compiling a buffer overflow example in modern Linux?

While the accepted answer is correct in suggesting moving everything to a different function does not explain why. As you can see in this question and answer main() functions often perform a stack ...
user avatar
  • 12.3k
12 votes

Is it dangerous to compile arbitrary C?

You would not want to be running the compiler as root, though I have seen this happen for "ease and convenience" reasons. It would be all too easy for an attacker to include something like: #include ...
user avatar
7 votes

Is compiling untrusted code safe?

It is not only possible, it has been documented several times in the past. http://www.cvedetails.com/vulnerability-list/vendor_id-72/product_id-960/GNU-GCC.html For example, http://www.cvedetails....
user avatar
  • 2,107
7 votes

How do I harden compilers (as suggested by Lynis)?

Security is always a balance between ease of use and protection. The most secure system I can imagine is a switched off computer lying in a bank safe. Unfortunately it is also hard to use... Removing ...
user avatar
7 votes

Is it possible to crack g++ rand()?

The compiler itself is irrelevant; the rand() function is implemented in libc. The glibc implementation uses a linear congruential generator (LCG) or a linear feedback shift register (LFSR) for its ...
user avatar
  • 132k
5 votes

How does gcc compiler guard stack for stack overflow?

In a classical stack overflow attack the attacker manages to place its own code (processor instructions) on the stack by overflowing some stack based data structures with attacker controlled content. ...
user avatar
5 votes
Accepted

Software mitigation for Spectre v2

Should you recompile your software with these flags enabled? In general, no. Most software used by the average person is not seriously threatened by Spectre. It's a very difficult attack to pull ...
user avatar
  • 34.4k
5 votes
Accepted

Compiling a buffer overflow example in modern Linux?

Your example does segfault here (or cause the program termination if the stack protector is active). Maybe you should try to move the buffer overflow into another function. Perhaps your gcc version ...
user avatar
  • 17.3k
5 votes
Accepted

gnu gcc source archives signed with expired GPG key?

The pedantic answer to your question is: when gcc-9.3.0 was released, the key was not yet expired: $ gpg --verify gcc-9.3.0.tar.gz.sig gcc-9.3.0.tar.gz gpg: Signature made Thu 12 Mar 2020 07:32:47 AM ...
user avatar
  • 6,193
4 votes

Is compiling untrusted code safe?

At least C++ compilation is turing complete so it is possible/easy to produce infinite loop impacting system performance and producing infinite output (exhausting ram and/or disk place). More info on ...
user avatar
4 votes
Accepted

Gentoo Hardened vs other distros

Its all in the source! Gentoo hardened is an security driven distro the hardened profile really packs a great deal into making it really secure. But is it worth the compile? A big question among the ...
user avatar
4 votes
Accepted

Compiling with GCC retpoline flags

There is a benefit from doing this. These options enabled retpoline to mitigate Spectre V2. This is important in programs which handle sensitive or confidential data where the variable performance ...
user avatar
  • 64k
3 votes

Is it dangerous to compile arbitrary C?

If you allow an user to provide an archive containing the code you can have issues, not exactly with the compiler but the linker it uses ;) ld follows symbolic links if they point to a file that do ...
user avatar
  • 131
3 votes

How does gcc compiler guard stack for stack overflow?

The OS and the compiler does two things to prevent BOF. The OS deny's to execute code stored in the stack(it only allows the CPU to execute instructions stored in .text section) but you are injecting ...
user avatar
3 votes

How do I harden compilers (as suggested by Lynis)?

From a hacker/pentester perspective, I can say that having a compiler on a target machine and/or python/ruby can be very very useful. So I agree with one of the previous answers that removing it from ...
user avatar
  • 2,634
2 votes

the state of ASLR, PIE, SSP on Debian in 2018?

you can check if a binary is compiled with PIE stack protection fortify source RO relocations Immediate binding by using hardening-check. E.g. hardening-check $(which sshd) Package devscripts ...
user avatar
2 votes

How do I compare the safety of a compiled program with optimization flag?

Compiler options can influence the security of the resulting program in several different ways. Generally speaking, optimization can hurt security. However, this is not a reason to always turn off ...
user avatar
2 votes
Accepted

Memory address problem in GNU Debugger

This is because your program was compiled as a position independant executable (PIE). Instead of the addresses being hardcoded into the binary, they are only stored as offsets from 0, which explains ...
user avatar
1 vote

dirtycow exploit without gcc

The DirtyCOW PoC page contains a list of proof of concept exploits, including several that do not require GCC. There is one written in Go and even one which requires only an assembler. You can also ...
user avatar
  • 64k
1 vote

Unable to understand $EIP changes with Buffer Overflow

First, you better try to overflow the saved eip of a regular function, not main(). It is not really different, but the main() function is a bit specific and might give you a distorted view of reality. ...
user avatar
  • 813
1 vote

Unable to understand $EIP changes with Buffer Overflow

Try using the Switch "-g" , when you compile your c File with gcc. Or there is something with the Security Features, that prevent your Code. Did you try to break your Code ? E.g. "break main" ...
user avatar
  • 259
1 vote
Accepted

How does GCC's -mmitigate-rop work?

Looks like it was added: https://gcc.gnu.org/ml/gcc-patches/2015-11/msg01773.html I don't know if more was added later: but I think this code just looks for an instruction that can be re-interpreted ...
user avatar
1 vote

Segmentation fault in shellcode

First of all, your shell.c code is right. The problem is that you are executing an exploit generated for Windows platform, as you can see: msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.1....
user avatar
  • 402
1 vote

Shellcode not executing properly

sys_execve asks for the following arguments: EBX: Pointer to the command ECX: Pointer to extra arguments EDX: Pointer to extra arguments ESI: Pointer to a pt_regs structure You have only setted the ...
user avatar
  • 157
1 vote
Accepted

Issues testing buffer overflow

I suppose you need to compile the code disabling the stack protections. For example, try in this way: gcc -g -fno-stack-protector -zexecstack -o vuln vuln.c -g (enable debugging information) -f no-...
user avatar
  • 101

Only top scored, non community-wiki answers of a minimum length are eligible