71
votes
Accepted
Does a buffer overflow vulnerability always mean a code execution vulnerability?
No, a buffer overflow might:
Be against a buffer on the heap not the stack. This might still lead to code execution but will be much more complicated to exploit.
Be limited in size, so not able to ...
- 1,974
59
votes
How big is a canary word on Linux, typically?
Let's try it out! Here is a very simple example program.
int test(int a)
{
return a;
}
Compile it with GCC and intercept the compilation at the assembly stage. (The -S flag will do this.) Rename ...
- 810
46
votes
Does a buffer overflow vulnerability always mean a code execution vulnerability?
Douglas gives a correct answer. Not all buffer overflows give code execution. However, I felt it was missing a very important caution.
Even if a buffer overflow does not allow arbitrary code ...
- 1,858
25
votes
How big is a canary word on Linux, typically?
As i can read in this page: Stack Smashing Protector
The stack canary is native word sized and if chosen randomly, an attacker will have to guess the right value among 2^32 or 2^64 combinations
- 359
17
votes
Accepted
How is the stack protection enforced in a binary?
On a linux box with an Intel CPU, lets say I compiled by binary with -fstack-protect-all.
Since it is not explicitly stated, it will be assumed that this refers to ELF binaries compiled using GCC ...
- 1,289
10
votes
If the stack grows downwards, how can a buffer overflow overwrite content above the variable?
If the stack grows downward, functions that are called later get stack frames at lower memory addresses. Also, the return address is pushed to the stack before space for local variables is reserved, ...
- 2,165
9
votes
Accepted
Why must a ret2libc attack follow the order "system(),exit(),command?
The ret2libc (and return oriented programming (ROP)) technique relies on overwriting the stack to create a new stack frame that calls the system function. This wikipedia article explains stack frames ...
- 5,959
6
votes
How does gcc compiler guard stack for stack overflow?
In a classical stack overflow attack the attacker manages to place its own code (processor instructions) on the stack by overflowing some stack based data structures with attacker controlled content. ...
- 198k
5
votes
If the stack grows downwards, how can a buffer overflow overwrite content above the variable?
The stack only grows downwards when something is allocated on it. On the other hand, reading off the end of an array means reading upwards in memory.
Let's say the stack pointer says 0x1002. At this ...
- 1,092
5
votes
Accepted
Exploit does not work outside GDB
My guess is that in your solution the stack is a bit misaligned outside gdb and the one you see inside gdb is a bit elsewhere.
I did solve the challange and I used a simple trick to bypass this ...
- 291
4
votes
Accepted
Why do registers get overwritten upon overflow?
Buffer overflows do not directly modify registers; rather, they are used to overwrite the function return address (the first element in the function's stack frame, 4(%ebp) in x86) and place custom ...
- 1,289
4
votes
Accepted
Why are stack canaries not enabled by default on GCC?
It's hard to speak for the maintainers of GCC as I couldn't find a direct quote but let me give two reasons it may not be on by default:
Stack canaries have been shown to be less than foolproof. ...
- 2,017
4
votes
Accepted
Is Stack Exchange immune to DDoS and DoS attacks?
Nothing is immune to DDoS attacks, no resource is infinite. It may take a bit more effort, but any service can be taken down if you have enough resources. Upstream connections can be saturated, ...
- 6,898
3
votes
How does gcc compiler guard stack for stack overflow?
The OS and the compiler does two things to prevent BOF.
The OS deny's to execute code stored in the stack(it only allows the CPU to execute instructions stored in .text section) but you are injecting ...
- 427
3
votes
Accepted
C - Simple Buffer Overflow Exploitation, how is the EIP overwritten in different type calling functions?
My guess is that you overwrote other local variables (i or sending_str) and thus caused premature crash.
You will have to look at the generated code to see what’s going on. Depending on settings the ...
- 1,111
3
votes
Understanding a crash
Your file input has probably affected the value of EDI in some way, or caused control flow to take a path it would not otherwise take. I would normally look a few instructions back and try to ...
- 16.1k
3
votes
Accepted
Some vulnerable projects in C or C++ for a lecture?
Open Security Training has some great resources to teach developers about secure code practices including a virtual machine with compilers and vulnerable code samples
Also look at NIST's SAMATE TEST ...
- 111
3
votes
If the stack grows downwards, how can a buffer overflow overwrite content above the variable?
There is a difference between buffer overflow and stack overflow. Allocated buffers may not use the stack, but the heap. This depends on how they are allocated and what the compiler though would be ...
- 3,378
3
votes
Accepted
How are stack canaries padded by unmapped pages?
It would be clear to say that the reference copy of the canary value is surrounded by unmapped pages. That is, the page containing the canary value has at least one unmapped page immediately before it ...
2
votes
Accepted
Restoring the stack frame after payload is executed
Technically it seems to be possible, but only in case you know the code path (i.e. you know the exploit would be triggered only from a specific address of the application). Seems like what you need to ...
- 3,524
2
votes
Why must a ret2libc attack follow the order "system(),exit(),command?
The reason exit() is included is to terminate the program gracefully. If you don't have exit() at the end of your chain the program will either continue to run weirdly or most likely terminate with a ...
- 565
2
votes
Accepted
Can one prevent stack overflow by storing strings in memory backwards?
If your code doesn't protect from writing into adjacent memory spaces, then no you can't reverse the order and be protected from a buffer overflow. Reversing the way the string is stored just changes ...
- 5,175
2
votes
If the stack grows downwards, how can a buffer overflow overwrite content above the variable?
A stack grows downward by push instruction, but writes and reads upwards. for example, if your stack occupy address 10 to 5 which is a length of 6 usable address, when you have a push instruction, the ...
- 21
2
votes
How is the stack protection enforced in a binary?
GCC's stack protection is software-based, and isn't related to DEP's hardware-based protection. When an OS enables DEP, all programs running on it (or some subset defined by the user) are ...
- 5,734
2
votes
How big is a canary word on Linux, typically?
The number of bits used must equal the Word size of the processor. So if you have a 32 bits processor, its Word size is 32, hence the canary word is 32 bits long.
- 121
2
votes
Hard-wired vs relative addresses in shellcode
There's two types of issues that I think you might be conflating. One is the address of functions called by your shellcode that are provided by the vulnerable application or by libraries loaded, and ...
- 16.1k
2
votes
Why do we need to remove null bytes from shell code?
You are correct in this situation; strcpy will indeed stop reading when it reaches a null byte, but this only needs to be done to shellcode that is passed directly to a string function that expects ...
- 12.7k
2
votes
C - Simple Buffer Overflow Exploitation, how is the EIP overwritten in different type calling functions?
Voted @manduca for best answer because the answer provided the direction of research and more testing. And after several tests, I was able to conclude the complete answer to my question asked:
the ...
- 345
2
votes
Stackpivoting techniques
Assuming you're building a ROP chain that needs to manipulate the stack, you can always go for semantically equivalent gadgets, e.g. PUSH/POP, MOV ESP XXX, (SUB,ADD) ESP instructions to build the ...
- 610
2
votes
Accepted
Bufferoverflow - jmp esp. Do I need nops sled? Does call esp also work?
I figured out an answer to the second question. According to this (https:// www.offensive-security.com /metasploit-unleashed/alphanumeric-shellcode/), the shellcode generated by Metasploit needs to ...
Only top scored, non community-wiki answers of a minimum length are eligible