97
votes
Accepted
Is it dangerous to compile arbitrary C?
A bit of a weird one, but: it's a denial-of-service risk, or potential information disclosure.
Because C's preprocessor will cheerfully include any file specified in an #include directive, somebody ...
- 46.3k
44
votes
Is it dangerous to compile arbitrary C?
Compiler bombs
C is a very powerful language, and some of the terrible things you can do with it would shock you. For example, you can create a 16 byte C program that takes 27 minutes to compile, and ...
- 545
29
votes
Is it dangerous to compile arbitrary C?
@AndréBorie is correct. Compilers and the corresponding configuration will not be well vetted for security issues, so generally speaking you should not compile untrusted code.
The risk is that a ...
- 14k
16
votes
Is it dangerous to compile arbitrary C?
Yes, it's dangerous: but as people have said it's possible to do. I'm the author and maintainer of the online compilers at https://gcc.godbolt.org/, and I've found it pretty workable to make it safe ...
- 269
12
votes
Is it dangerous to compile arbitrary C?
You would not want to be running the compiler as root, though I have seen this happen for "ease and convenience" reasons. It would be all too easy for an attacker to include something like:
#include ...
- 1,890
7
votes
How do I harden compilers (as suggested by Lynis)?
Security is always a balance between ease of use and protection. The most secure system I can imagine is a switched off computer lying in a bank safe. Unfortunately it is also hard to use... Removing ...
- 26.5k
7
votes
Is it possible to crack g++ rand()?
The compiler itself is irrelevant; the rand() function is implemented in libc.
The glibc implementation uses a linear congruential generator (LCG) or a linear feedback shift register (LFSR) for its ...
- 135k
6
votes
How does gcc compiler guard stack for stack overflow?
In a classical stack overflow attack the attacker manages to place its own code (processor instructions) on the stack by overflowing some stack based data structures with attacker controlled content. ...
- 198k
5
votes
Accepted
gnu gcc source archives signed with expired GPG key?
The pedantic answer to your question is: when gcc-9.3.0 was released, the key was not yet expired:
$ gpg --verify gcc-9.3.0.tar.gz.sig gcc-9.3.0.tar.gz
gpg: Signature made Thu 12 Mar 2020 07:32:47 AM ...
- 6,428
5
votes
Accepted
Software mitigation for Spectre v2
Should you recompile your software with these flags enabled? In general, no.
Most software used by the average person is not seriously threatened by Spectre. It's a very difficult attack to pull ...
- 34.6k
4
votes
Is it dangerous to compile arbitrary C?
If you allow an user to provide an archive containing the code you can have issues, not exactly with the compiler but the linker it uses ;)
ld follows symbolic links if they point to a file that do ...
- 141
4
votes
Accepted
Compiling with GCC retpoline flags
There is a benefit from doing this. These options enabled retpoline to mitigate Spectre V2. This is important in programs which handle sensitive or confidential data where the variable performance ...
- 66.5k
4
votes
Accepted
Gentoo Hardened vs other distros
Its all in the source! Gentoo hardened is an security driven distro the hardened profile really packs a great deal into making it really secure.
But is it worth the compile? A big question among the ...
3
votes
How do I harden compilers (as suggested by Lynis)?
From a hacker/pentester perspective, I can say that having a compiler on a target machine and/or python/ruby can be very very useful. So I agree with one of the previous answers that removing it from ...
- 2,634
3
votes
Linux x86_64 Assembly works standalone, but Segfaults when ran as shellcode in C
This line seems to describe what actually killed it.
--- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=0xfffffffffffffffc} ---
It's attempting to access something at 0xfffffffffffffffc, and ...
- 201
3
votes
How does gcc compiler guard stack for stack overflow?
The OS and the compiler does two things to prevent BOF.
The OS deny's to execute code stored in the stack(it only allows the CPU to execute instructions stored in .text section) but you are injecting ...
- 427
2
votes
How do I compare the safety of a compiled program with optimization flag?
Compiler options can influence the security of the resulting program in several different ways. Generally speaking, optimization can hurt security. However, this is not a reason to always turn off ...
2
votes
Accepted
Memory address problem in GNU Debugger
This is because your program was compiled as a position independant executable (PIE). Instead of the addresses being hardcoded into the binary, they are only stored as offsets from 0, which explains ...
- 12.7k
2
votes
the state of ASLR, PIE, SSP on Debian in 2018?
you can check if a binary is compiled with
PIE
stack protection
fortify source
RO relocations
Immediate binding
by using hardening-check. E.g. hardening-check $(which sshd)
Package devscripts ...
- 21
2
votes
Linux x86_64 Assembly works standalone, but Segfaults when ran as shellcode in C
I would probably think that this is due to you trying to execute code which is stored in the heap (your shellcode table). The heap in x86-64 architecture does not allow executable code.
One way to get ...
- 21
1
vote
Is switching my C/C++ compiler for security testing generally reliable?
Each compiler covers the basics. GCC and Clang also have unique warnings that one compiler does and the others don't. You'll want to turn on as many warnings as possible, treat warnings as errors. ...
- 11
1
vote
Unable to understand $EIP changes with Buffer Overflow
First, you better try to overflow the saved eip of a regular function, not main(). It is not really different, but the main() function is a bit specific and might give you a distorted view of reality.
...
- 853
1
vote
dirtycow exploit without gcc
The DirtyCOW PoC page contains a list of proof of concept exploits, including several that do not require GCC. There is one written in Go and even one which requires only an assembler. You can also ...
- 66.5k
1
vote
Accepted
How does GCC's -mmitigate-rop work?
Looks like it was added:
https://gcc.gnu.org/ml/gcc-patches/2015-11/msg01773.html
I don't know if more was added later: but I think this code just looks for an instruction that can be re-interpreted ...
- 1,974
1
vote
Segmentation fault in shellcode
First of all, your shell.c code is right.
The problem is that you are executing an exploit generated for Windows platform, as you can see:
msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.1....
- 442
1
vote
Shellcode not executing properly
sys_execve asks for the following arguments:
EBX: Pointer to the command
ECX: Pointer to extra arguments
EDX: Pointer to extra arguments
ESI: Pointer to a pt_regs structure
You have only setted the ...
- 167
1
vote
Accepted
Issues testing buffer overflow
I suppose you need to compile the code disabling the stack protections. For example, try in this way:
gcc -g -fno-stack-protector -zexecstack -o vuln vuln.c
-g (enable debugging information)
-f no-...
- 111
1
vote
How do I harden compilers (as suggested by Lynis)?
Nobody is given you answer specific to lynis. From your question, you need to know how to do this because lynis suggests that you harden the compiler binary for root access only. So here how I did it ...
- 137
1
vote
Is it possible to crack g++ rand()?
Google says:
In order to generate random-like numbers, srand is usually initialized to some distinctive runtime value, like the value returned by function time (declared in header <ctime\>). ...
- 14.4k
Only top scored, non community-wiki answers of a minimum length are eligible