71 votes
Accepted

Does a buffer overflow vulnerability always mean a code execution vulnerability?

No, a buffer overflow might: Be against a buffer on the heap not the stack. This might still lead to code execution but will be much more complicated to exploit. Be limited in size, so not able to ...
user avatar
59 votes

How big is a canary word on Linux, typically?

Let's try it out! Here is a very simple example program. int test(int a) { return a; } Compile it with GCC and intercept the compilation at the assembly stage. (The -S flag will do this.) Rename ...
user avatar
46 votes

Does a buffer overflow vulnerability always mean a code execution vulnerability?

Douglas gives a correct answer. Not all buffer overflows give code execution. However, I felt it was missing a very important caution. Even if a buffer overflow does not allow arbitrary code ...
user avatar
  • 1,818
25 votes

How big is a canary word on Linux, typically?

As i can read in this page: Stack Smashing Protector The stack canary is native word sized and if chosen randomly, an attacker will have to guess the right value among 2^32 or 2^64 combinations
user avatar
16 votes
Accepted

How is the stack protection enforced in a binary?

On a linux box with an Intel CPU, lets say I compiled by binary with -fstack-protect-all. Since it is not explicitly stated, it will be assumed that this refers to ELF binaries compiled using GCC ...
user avatar
  • 1,269
9 votes
Accepted

Why must a ret2libc attack follow the order "system(),exit(),command?

The ret2libc (and return oriented programming (ROP)) technique relies on overwriting the stack to create a new stack frame that calls the system function. This wikipedia article explains stack frames ...
user avatar
  • 5,710
9 votes

If the stack grows downwards, how can a buffer overflow overwrite content above the variable?

If the stack grows downward, functions that are called later get stack frames at lower memory addresses. Also, the return address is pushed to the stack before space for local variables is reserved, ...
user avatar
  • 2,086
5 votes

How does gcc compiler guard stack for stack overflow?

In a classical stack overflow attack the attacker manages to place its own code (processor instructions) on the stack by overflowing some stack based data structures with attacker controlled content. ...
user avatar
5 votes
Accepted

Exploit does not work outside GDB

My guess is that in your solution the stack is a bit misaligned outside gdb and the one you see inside gdb is a bit elsewhere. I did solve the challange and I used a simple trick to bypass this ...
user avatar
  • 291
4 votes

If the stack grows downwards, how can a buffer overflow overwrite content above the variable?

The stack only grows downwards when something is allocated on it. On the other hand, reading off the end of an array means reading upwards in memory. Let's say the stack pointer says 0x1002. At this ...
user avatar
  • 1,062
4 votes
Accepted

Why do registers get overwritten upon overflow?

Buffer overflows do not directly modify registers; rather, they are used to overwrite the function return address (the first element in the function's stack frame, 4(%ebp) in x86) and place custom ...
user avatar
  • 1,269
3 votes

How does gcc compiler guard stack for stack overflow?

The OS and the compiler does two things to prevent BOF. The OS deny's to execute code stored in the stack(it only allows the CPU to execute instructions stored in .text section) but you are injecting ...
user avatar
3 votes
Accepted

C - Simple Buffer Overflow Exploitation, how is the EIP overwritten in different type calling functions?

My guess is that you overwrote other local variables (i or sending_str) and thus caused premature crash. You will have to look at the generated code to see what’s going on. Depending on settings the ...
user avatar
  • 1,111
3 votes

Understanding a crash

Your file input has probably affected the value of EDI in some way, or caused control flow to take a path it would not otherwise take. I would normally look a few instructions back and try to ...
user avatar
  • 15.8k
3 votes
Accepted

Some vulnerable projects in C or C++ for a lecture?

Open Security Training has some great resources to teach developers about secure code practices including a virtual machine with compilers and vulnerable code samples Also look at NIST's SAMATE TEST ...
user avatar
3 votes

If the stack grows downwards, how can a buffer overflow overwrite content above the variable?

There is a difference between buffer overflow and stack overflow. Allocated buffers may not use the stack, but the heap. This depends on how they are allocated and what the compiler though would be ...
user avatar
3 votes
Accepted

How are stack canaries padded by unmapped pages?

It would be clear to say that the reference copy of the canary value is surrounded by unmapped pages. That is, the page containing the canary value has at least one unmapped page immediately before it ...
user avatar
2 votes
Accepted

Restoring the stack frame after payload is executed

Technically it seems to be possible, but only in case you know the code path (i.e. you know the exploit would be triggered only from a specific address of the application). Seems like what you need to ...
user avatar
  • 3,504
2 votes

Why must a ret2libc attack follow the order "system(),exit(),command?

The reason exit() is included is to terminate the program gracefully. If you don't have exit() at the end of your chain the program will either continue to run weirdly or most likely terminate with a ...
user avatar
  • 555
2 votes
Accepted

Can one prevent stack overflow by storing strings in memory backwards?

If your code doesn't protect from writing into adjacent memory spaces, then no you can't reverse the order and be protected from a buffer overflow. Reversing the way the string is stored just changes ...
user avatar
  • 5,105
2 votes

If the stack grows downwards, how can a buffer overflow overwrite content above the variable?

A stack grows downward by push instruction, but writes and reads upwards. for example, if your stack occupy address 10 to 5 which is a length of 6 usable address, when you have a push instruction, the ...
user avatar
2 votes

How is the stack protection enforced in a binary?

GCC's stack protection is software-based, and isn't related to DEP's hardware-based protection. When an OS enables DEP, all programs running on it (or some subset defined by the user) are ...
user avatar
  • 5,724
2 votes

How big is a canary word on Linux, typically?

The number of bits used must equal the Word size of the processor. So if you have a 32 bits processor, its Word size is 32, hence the canary word is 32 bits long.
user avatar
  • 121
2 votes

Hard-wired vs relative addresses in shellcode

There's two types of issues that I think you might be conflating. One is the address of functions called by your shellcode that are provided by the vulnerable application or by libraries loaded, and ...
user avatar
  • 15.8k
2 votes

Why do we need to remove null bytes from shell code?

You are correct in this situation; strcpy will indeed stop reading when it reaches a null byte, but this only needs to be done to shellcode that is passed directly to a string function that expects ...
user avatar
2 votes

C - Simple Buffer Overflow Exploitation, how is the EIP overwritten in different type calling functions?

Voted @manduca for best answer because the answer provided the direction of research and more testing. And after several tests, I was able to conclude the complete answer to my question asked: the ...
user avatar
  • 335
2 votes

Stackpivoting techniques

Assuming you're building a ROP chain that needs to manipulate the stack, you can always go for semantically equivalent gadgets, e.g. PUSH/POP, MOV ESP XXX, (SUB,ADD) ESP instructions to build the ...
user avatar
2 votes
Accepted

Bufferoverflow - jmp esp. Do I need nops sled? Does call esp also work?

I figured out an answer to the second question. According to this (https:// www.offensive-security.com /metasploit-unleashed/alphanumeric-shellcode/), the shellcode generated by Metasploit needs to ...
user avatar
2 votes
Accepted

Cannot exploit stack-based buffer overflow with ASLR-disabled, since RSP differs heavily between executions?

The GCC -no-pie option partly disables ASLR: the binary will be loaded at fixed base address (i.e. 0x400000); however, other memory segments (e.g. stack) may still be loaded at random base addresses. ...
user avatar
2 votes
Accepted

Why Does Only 1 Of These 2 Almost-identical Payloads Give Me A Shell?

How are you determining the address of buffer[]? If you're running the app under gdb, printing the address, and then running the exploit script using that address against the application running ...
user avatar

Only top scored, non community-wiki answers of a minimum length are eligible