Hot answers tagged

97 votes
Accepted

Is it dangerous to compile arbitrary C?

A bit of a weird one, but: it's a denial-of-service risk, or potential information disclosure. Because C's preprocessor will cheerfully include any file specified in an #include directive, somebody ...
CBHacking's user avatar
  • 47.5k
44 votes

Is it dangerous to compile arbitrary C?

Compiler bombs C is a very powerful language, and some of the terrible things you can do with it would shock you. For example, you can create a 16 byte C program that takes 27 minutes to compile, and ...
DJMcMayhem's user avatar
29 votes

Is it dangerous to compile arbitrary C?

@AndréBorie is correct. Compilers and the corresponding configuration will not be well vetted for security issues, so generally speaking you should not compile untrusted code. The risk is that a ...
700 Software's user avatar
16 votes

Is it dangerous to compile arbitrary C?

Yes, it's dangerous: but as people have said it's possible to do. I'm the author and maintainer of the online compilers at https://gcc.godbolt.org/, and I've found it pretty workable to make it safe ...
Matt Godbolt's user avatar
13 votes

Is it dangerous to compile arbitrary C?

You would not want to be running the compiler as root, though I have seen this happen for "ease and convenience" reasons. It would be all too easy for an attacker to include something like: #include ...
Colin Cassidy's user avatar
7 votes

How do I harden compilers (as suggested by Lynis)?

Security is always a balance between ease of use and protection. The most secure system I can imagine is a switched off computer lying in a bank safe. Unfortunately it is also hard to use... Removing ...
Serge Ballesta's user avatar
7 votes

Is it possible to crack g++ rand()?

The compiler itself is irrelevant; the rand() function is implemented in libc. The glibc implementation uses a linear congruential generator (LCG) or a linear feedback shift register (LFSR) for its ...
Polynomial's user avatar
  • 135k
6 votes

How does gcc compiler guard stack for stack overflow?

In a classical stack overflow attack the attacker manages to place its own code (processor instructions) on the stack by overflowing some stack based data structures with attacker controlled content. ...
Steffen Ullrich's user avatar
5 votes
Accepted

gnu gcc source archives signed with expired GPG key?

The pedantic answer to your question is: when gcc-9.3.0 was released, the key was not yet expired: $ gpg --verify gcc-9.3.0.tar.gz.sig gcc-9.3.0.tar.gz gpg: Signature made Thu 12 Mar 2020 07:32:47 AM ...
mricon's user avatar
  • 6,498
5 votes
Accepted

Software mitigation for Spectre v2

Should you recompile your software with these flags enabled? In general, no. Most software used by the average person is not seriously threatened by Spectre. It's a very difficult attack to pull ...
Mark's user avatar
  • 34.6k
4 votes

Is it dangerous to compile arbitrary C?

If you allow an user to provide an archive containing the code you can have issues, not exactly with the compiler but the linker it uses ;) ld follows symbolic links if they point to a file that do ...
cym13's user avatar
  • 141
4 votes
Accepted

Compiling with GCC retpoline flags

There is a benefit from doing this. These options enabled retpoline to mitigate Spectre V2. This is important in programs which handle sensitive or confidential data where the variable performance ...
forest's user avatar
  • 66.6k
4 votes
Accepted

Gentoo Hardened vs other distros

Its all in the source! Gentoo hardened is an security driven distro the hardened profile really packs a great deal into making it really secure. But is it worth the compile? A big question among the ...
Cameron Does Things's user avatar
3 votes

How do I harden compilers (as suggested by Lynis)?

From a hacker/pentester perspective, I can say that having a compiler on a target machine and/or python/ruby can be very very useful. So I agree with one of the previous answers that removing it from ...
kaidentity's user avatar
  • 2,644
3 votes
Accepted

Memory address problem in GNU Debugger

This is because your program was compiled as a position independant executable (PIE). Instead of the addresses being hardcoded into the binary, they are only stored as offsets from 0, which explains ...
multithr3at3d's user avatar
3 votes

Linux x86_64 Assembly works standalone, but Segfaults when ran as shellcode in C

This line seems to describe what actually killed it. --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=0xfffffffffffffffc} --- It's attempting to access something at 0xfffffffffffffffc, and ...
David A's user avatar
  • 201
3 votes

How does gcc compiler guard stack for stack overflow?

The OS and the compiler does two things to prevent BOF. The OS deny's to execute code stored in the stack(it only allows the CPU to execute instructions stored in .text section) but you are injecting ...
Henok Tesfaye's user avatar
2 votes

How do I compare the safety of a compiled program with optimization flag?

Compiler options can influence the security of the resulting program in several different ways. Generally speaking, optimization can hurt security. However, this is not a reason to always turn off ...
Gilles 'SO- stop being evil''s user avatar
2 votes

the state of ASLR, PIE, SSP on Debian in 2018?

you can check if a binary is compiled with PIE stack protection fortify source RO relocations Immediate binding by using hardening-check. E.g. hardening-check $(which sshd) Package devscripts ...
user3692267's user avatar
2 votes

Linux x86_64 Assembly works standalone, but Segfaults when ran as shellcode in C

I would probably think that this is due to you trying to execute code which is stored in the heap (your shellcode table). The heap in x86-64 architecture does not allow executable code. One way to get ...
J-Ro's user avatar
  • 21
1 vote

Is switching my C/C++ compiler for security testing generally reliable?

Each compiler covers the basics. GCC and Clang also have unique warnings that one compiler does and the others don't. You'll want to turn on as many warnings as possible, treat warnings as errors. ...
Steve's user avatar
  • 11
1 vote

dirtycow exploit without gcc

The DirtyCOW PoC page contains a list of proof of concept exploits, including several that do not require GCC. There is one written in Go and even one which requires only an assembler. You can also ...
forest's user avatar
  • 66.6k
1 vote

Unable to understand $EIP changes with Buffer Overflow

First, you better try to overflow the saved eip of a regular function, not main(). It is not really different, but the main() function is a bit specific and might give you a distorted view of reality. ...
perror's user avatar
  • 853
1 vote
Accepted

How does GCC's -mmitigate-rop work?

Looks like it was added: https://gcc.gnu.org/ml/gcc-patches/2015-11/msg01773.html I don't know if more was added later: but I think this code just looks for an instruction that can be re-interpreted ...
Douglas Leeder's user avatar
1 vote

Segmentation fault in shellcode

First of all, your shell.c code is right. The problem is that you are executing an exploit generated for Windows platform, as you can see: msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.1....
slayer's user avatar
  • 452
1 vote

Shellcode not executing properly

sys_execve asks for the following arguments: EBX: Pointer to the command ECX: Pointer to extra arguments EDX: Pointer to extra arguments ESI: Pointer to a pt_regs structure You have only setted the ...
L00P3R's user avatar
  • 167
1 vote
Accepted

Issues testing buffer overflow

I suppose you need to compile the code disabling the stack protections. For example, try in this way: gcc -g -fno-stack-protector -zexecstack -o vuln vuln.c -g (enable debugging information) -f no-...
nemux's user avatar
  • 111
1 vote

How do I harden compilers (as suggested by Lynis)?

Nobody is given you answer specific to lynis. From your question, you need to know how to do this because lynis suggests that you harden the compiler binary for root access only. So here how I did it ...
MaXi32's user avatar
  • 137
1 vote

Is it possible to crack g++ rand()?

Google says: In order to generate random-like numbers, srand is usually initialized to some distinctive runtime value, like the value returned by function time (declared in header <ctime\>). ...
Tobi Nary's user avatar
  • 14.4k

Only top scored, non community-wiki answers of a minimum length are eligible