97
votes
Accepted
Is it dangerous to compile arbitrary C?
A bit of a weird one, but: it's a denial-of-service risk, or potential information disclosure.
Because C's preprocessor will cheerfully include any file specified in an #include directive, somebody ...
- 39.5k
43
votes
Is it dangerous to compile arbitrary C?
Compiler bombs
C is a very powerful language, and some of the terrible things you can do with it would shock you. For example, you can create a 16 byte C program that takes 27 minutes to compile, and ...
- 535
29
votes
Is it dangerous to compile arbitrary C?
@AndréBorie is correct. Compilers and the corresponding configuration will not be well vetted for security issues, so generally speaking you should not compile untrusted code.
The risk is that a ...
- 13.8k
16
votes
Is it dangerous to compile arbitrary C?
Yes, it's dangerous: but as people have said it's possible to do. I'm the author and maintainer of the online compilers at https://gcc.godbolt.org/, and I've found it pretty workable to make it safe ...
- 269
15
votes
Compiling a buffer overflow example in modern Linux?
While the accepted answer is correct in suggesting moving everything to a different function does not explain why.
As you can see in this question and answer main() functions often perform a stack ...
- 12.3k
12
votes
Is it dangerous to compile arbitrary C?
You would not want to be running the compiler as root, though I have seen this happen for "ease and convenience" reasons. It would be all too easy for an attacker to include something like:
#include ...
- 1,870
7
votes
Is compiling untrusted code safe?
It is not only possible, it has been documented several times in the past.
http://www.cvedetails.com/vulnerability-list/vendor_id-72/product_id-960/GNU-GCC.html
For example, http://www.cvedetails....
- 2,107
7
votes
How do I harden compilers (as suggested by Lynis)?
Security is always a balance between ease of use and protection. The most secure system I can imagine is a switched off computer lying in a bank safe. Unfortunately it is also hard to use... Removing ...
- 25.6k
7
votes
Is it possible to crack g++ rand()?
The compiler itself is irrelevant; the rand() function is implemented in libc.
The glibc implementation uses a linear congruential generator (LCG) or a linear feedback shift register (LFSR) for its ...
- 132k
5
votes
How does gcc compiler guard stack for stack overflow?
In a classical stack overflow attack the attacker manages to place its own code (processor instructions) on the stack by overflowing some stack based data structures with attacker controlled content. ...
- 183k
5
votes
Accepted
Software mitigation for Spectre v2
Should you recompile your software with these flags enabled? In general, no.
Most software used by the average person is not seriously threatened by Spectre. It's a very difficult attack to pull ...
- 34.4k
5
votes
Accepted
Compiling a buffer overflow example in modern Linux?
Your example does segfault here (or cause the program termination if the stack protector is active).
Maybe you should try to move the buffer overflow into another function. Perhaps your gcc version ...
- 17.3k
5
votes
Accepted
gnu gcc source archives signed with expired GPG key?
The pedantic answer to your question is: when gcc-9.3.0 was released, the key was not yet expired:
$ gpg --verify gcc-9.3.0.tar.gz.sig gcc-9.3.0.tar.gz
gpg: Signature made Thu 12 Mar 2020 07:32:47 AM ...
- 6,193
4
votes
Is compiling untrusted code safe?
At least C++ compilation is turing complete so it is possible/easy to produce infinite loop impacting system performance and producing infinite output (exhausting ram and/or disk place).
More info on ...
- 161
4
votes
Accepted
Gentoo Hardened vs other distros
Its all in the source! Gentoo hardened is an security driven distro the hardened profile really packs a great deal into making it really secure.
But is it worth the compile? A big question among the ...
4
votes
Accepted
Compiling with GCC retpoline flags
There is a benefit from doing this. These options enabled retpoline to mitigate Spectre V2. This is important in programs which handle sensitive or confidential data where the variable performance ...
- 64k
3
votes
Is it dangerous to compile arbitrary C?
If you allow an user to provide an archive containing the code you can have issues, not exactly with the compiler but the linker it uses ;)
ld follows symbolic links if they point to a file that do ...
- 131
3
votes
How does gcc compiler guard stack for stack overflow?
The OS and the compiler does two things to prevent BOF.
The OS deny's to execute code stored in the stack(it only allows the CPU to execute instructions stored in .text section) but you are injecting ...
- 427
3
votes
How do I harden compilers (as suggested by Lynis)?
From a hacker/pentester perspective, I can say that having a compiler on a target machine and/or python/ruby can be very very useful. So I agree with one of the previous answers that removing it from ...
- 2,634
2
votes
the state of ASLR, PIE, SSP on Debian in 2018?
you can check if a binary is compiled with
PIE
stack protection
fortify source
RO relocations
Immediate binding
by using hardening-check. E.g. hardening-check $(which sshd)
Package devscripts ...
- 21
2
votes
How do I compare the safety of a compiled program with optimization flag?
Compiler options can influence the security of the resulting program in several different ways. Generally speaking, optimization can hurt security. However, this is not a reason to always turn off ...
2
votes
Accepted
Memory address problem in GNU Debugger
This is because your program was compiled as a position independant executable (PIE). Instead of the addresses being hardcoded into the binary, they are only stored as offsets from 0, which explains ...
- 12.2k
1
vote
dirtycow exploit without gcc
The DirtyCOW PoC page contains a list of proof of concept exploits, including several that do not require GCC. There is one written in Go and even one which requires only an assembler. You can also ...
- 64k
1
vote
Unable to understand $EIP changes with Buffer Overflow
First, you better try to overflow the saved eip of a regular function, not main(). It is not really different, but the main() function is a bit specific and might give you a distorted view of reality.
...
- 813
1
vote
Unable to understand $EIP changes with Buffer Overflow
Try using the Switch "-g" , when you compile your c File with gcc.
Or there is something with the Security Features, that prevent your Code.
Did you try to break your Code ?
E.g.
"break main" ...
- 259
1
vote
Accepted
How does GCC's -mmitigate-rop work?
Looks like it was added:
https://gcc.gnu.org/ml/gcc-patches/2015-11/msg01773.html
I don't know if more was added later: but I think this code just looks for an instruction that can be re-interpreted ...
- 1,939
1
vote
Segmentation fault in shellcode
First of all, your shell.c code is right.
The problem is that you are executing an exploit generated for Windows platform, as you can see:
msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.1....
- 402
1
vote
Shellcode not executing properly
sys_execve asks for the following arguments:
EBX: Pointer to the command
ECX: Pointer to extra arguments
EDX: Pointer to extra arguments
ESI: Pointer to a pt_regs structure
You have only setted the ...
- 157
1
vote
Accepted
Issues testing buffer overflow
I suppose you need to compile the code disabling the stack protections. For example, try in this way:
gcc -g -fno-stack-protector -zexecstack -o vuln vuln.c
-g (enable debugging information)
-f no-...
- 101
Only top scored, non community-wiki answers of a minimum length are eligible