Podcast #128: We chat with Kent C Dodds about why he loves React and discuss what life was like in the dark days before Git. Listen now.
59

Let's try it out! Here is a very simple example program. int test(int a) { return a; } Compile it with GCC and intercept the compilation at the assembly stage. (The -S flag will do this.) Rename the assembly file (so it won't be overwritten) and compile again, this time also adding the -fstack-protector-all and -mstack-protector-guard=global flags. The ...


24

As i can read in this page: Stack Smashing Protector The stack canary is native word sized and if chosen randomly, an attacker will have to guess the right value among 2^32 or 2^64 combinations


10

On a linux box with an Intel CPU, lets say I compiled by binary with -fstack-protect-all. Since it is not explicitly stated, it will be assumed that this refers to ELF binaries compiled using GCC with the -fstack-protector-all argument. GCC Stack Protection Mechanisms -fstack-protector-all is an extension of -fstack-protector: -fstack-protector ...


8

If the stack grows downward, functions that are called later get stack frames at lower memory addresses. Also, the return address is pushed to the stack before space for local variables is reserved, so the return address gets a higher address than the local variables. But arrays and buffers are still indexed upwards in memory, so writing past the end of the ...


7

The ret2libc (and return oriented programming (ROP)) technique relies on overwriting the stack to create a new stack frame that calls the system function. This wikipedia article explains stack frames in great detail: https://en.wikipedia.org/wiki/Call_stack#Stack_and_frame_pointers The stack frame dictates the order the function call and parameters are ...


5

In a classical stack overflow attack the attacker manages to place its own code (processor instructions) on the stack by overflowing some stack based data structures with attacker controlled content. Now, the attacker needs to have this content on the stack to be taken as instructions by the processor and get it executed. But, the processor will only execute ...


4

Buffer overflows do not directly modify registers; rather, they are used to overwrite the function return address (the first element in the function's stack frame, 4(%ebp) in x86) and place custom code on the stack which will be executed when the overwritten return address is loaded into EIP/RIP. In x86 machines, the operations performed by call and ret are ...


3

My guess is that you overwrote other local variables (i or sending_str) and thus caused premature crash. You will have to look at the generated code to see what’s going on. Depending on settings the compiler can do interesting things to your code, including inlining the called function altogether, thus making your return address overwrite take effect much ...


3

Your file input has probably affected the value of EDI in some way, or caused control flow to take a path it would not otherwise take. I would normally look a few instructions back and try to determine how EDI came to have that value, or perhaps break at the beginning of the function where the crash occurs and step through it (or a few functions further up ...


3

My guess is that in your solution the stack is a bit misaligned outside gdb and the one you see inside gdb is a bit elsewhere. I did solve the challange and I used a simple trick to bypass this problem. If you setup environment variables, they will be on the stack, which is RWE in this challange. So you can actually pass the shellcode and a nopsled to the ...


3

The stack only grows downwards when something is allocated on it. On the other hand, reading off the end of an array means reading upwards in memory. Let's say the stack pointer says 0x1002. At this address is a return pointer you care about. If you allocate, say, a 2-byte array, the stack grows downward: the stack pointer is changed to 0x1000, and the ...


3

There is a difference between buffer overflow and stack overflow. Allocated buffers may not use the stack, but the heap. This depends on how they are allocated and what the compiler though would be better/faster/etc. A stack overflow does indeed override memory below, which may have been assigned to another (prior) call or ultimately the heap. The heap ...


3

It would be clear to say that the reference copy of the canary value is surrounded by unmapped pages. That is, the page containing the canary value has at least one unmapped page immediately before it and one unmapped page immediately after. The goal is to make it unlikely that an attacker can read or modify this value. To reach this value, an attacker needs ...


2

If your code doesn't protect from writing into adjacent memory spaces, then no you can't reverse the order and be protected from a buffer overflow. Reversing the way the string is stored just changes the shellcode payload arrangement (i.e. the payload may come first and the NOPS [x\00] may go in last). Like this: x\DEx\ADx\BEx\EF\x00x\00x\00 vs x\00x\...


2

A stack grows downward by push instruction, but writes and reads upwards. for example, if your stack occupy address 10 to 5 which is a length of 6 usable address, when you have a push instruction, the stack will go down and add an extra memory which will result in your stack occupying address 10 - 4 which is 7 usable addresses. but when you are writing to ...


2

Technically it seems to be possible, but only in case you know the code path (i.e. you know the exploit would be triggered only from a specific address of the application). Seems like what you need to do is: Overwrite only the return address on stack (and nothing else); In your executed code store the old ESP/RSP in one of the throwaway registers, and set ...


2

GCC's stack protection is software-based, and isn't related to DEP's hardware-based protection. When an OS enables DEP, all programs running on it (or some subset defined by the user) are automatically protected through hardware flags, regardless of any compiler flags used to build the binary. When the stack protection flags are enabled in GCC, it provides ...


2

The number of bits used must equal the Word size of the processor. So if you have a 32 bits processor, its Word size is 32, hence the canary word is 32 bits long.


2

Assuming you're building a ROP chain that needs to manipulate the stack, you can always go for semantically equivalent gadgets, e.g. PUSH/POP, MOV ESP XXX, (SUB,ADD) ESP instructions to build the stack: https://www.corelan.be/index.php/2010/06/16/exploit-writing-tutorial-part-10-chaining-dep-with-rop-the-rubikstm-cube/#chainingbasics http://neilscomputerblog....


2

You are correct in this situation; strcpy will indeed stop reading when it reaches a null byte, but this only needs to be done to shellcode that is passed directly to a string function that expects null-terminated strings. Of course, null bytes are valid machine code. Since you are only injecting the address to your payload and not the actual payload itself,...


2

Voted @manduca for best answer because the answer provided the direction of research and more testing. And after several tests, I was able to conclude the complete answer to my question asked: the type of the function return value had nothing to do with the problem, it was simply the wrong assumption for each of the two scenarios in the question, the EIP ...


2

Open Security Training has some great resources to teach developers about secure code practices including a virtual machine with compilers and vulnerable code samples Also look at NIST's SAMATE TEST Suite for C and C++ vulnerable code, For e.g. C test suite contains good examples of Format String, Buffer overflow vulnerabilities in C. You can find ...


1

The video @schroeder linked too is great. Maybe you need a simpler explanation though. Data execution prevention is software or hardware that monitors the location of executable code in memory. It is useful because if you ran malicious code from a part of memory reserved for trusted programs, it would be harder to detect. Windows keeps track of memory to ...


1

Try jumping to 0xe5894855 instead. The 0x06ca migth be just a pointer.


1

x86_64 is little endian so the mandatory zero bytes come at the end of the address/string and are already present in the existing return address. That means you don't need to write those last few bytes. You might still have problems if there were zero bytes less significant than the most significant non-zero byte. These are best avoided by careful target ...


1

The OS and the compiler does two things to prevent BOF. The OS deny's to execute code stored in the stack(it only allows the CPU to execute instructions stored in .text section) but you are injecting your malicious code in the stack, so you can disable this option by specifying -z execstack. The compiler adds a secret int variable(guard) before vulnerable ...


1

There's two types of issues that I think you might be conflating. One is the address of functions called by your shellcode that are provided by the vulnerable application or by libraries loaded, and the other is absolute versus relative jumps within your shellcode. Library Calls Let's assume, for a second, that you're attempting a return-to-libc style ...


1

Relative addresses will always have an upper hand over the hardcoded ones, why? let me explain: Let's say you run the application again after exit or a reboot, it may not get loaded onto the same addresses in memory ASLR - Address space layout randomization- a security feature in OS systems which will never load the executable in the same space... this will ...


1

I figured out an answer to the second question. According to this (https:// www.offensive-security.com /metasploit-unleashed/alphanumeric-shellcode/), the shellcode generated by Metasploit needs to get its absolute memory address to work. First five instructions of the shellcode serve this purpose. These are: Important part are the fcmovnu and fnstenv ...


1

I tried those exercises 1 year ago, it was fun and educative. Wasn't able to solve them all though. If I write 40 characters to the username, then the for loop overwrites one byte of the message length field. Yes, here is your exploit. I would try something like this: #!/bin/bash echo bruteforcin all things while true do python -c 'print "A"...


Only top voted, non community-wiki answers of a minimum length are eligible