full-disclosure - Exploiting buffer overflows via protected GCC

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Fri, 13 Feb 2009 11:50:11 -0500
From: Jason Starks <jstarks440@...il.com>
To: full-disclosure@...ts.grok.org.uk
Subject: Exploiting buffer overflows via protected GCC

I came across a problem that I am sure many security researchers have seen
before:

jason@...o:~$ cat bof.c
#include <stdio.h>
#include <string.h>

int main()
{

char buf[512];

memset(buf, 'A', 528);

return 0;

}
jason@...o:~$

jason@...o:~$ ./bof
*** stack smashing detected ***: ./bof terminated
======= Backtrace: =========
/lib/tls/i686/cmov/libc.so.6(__fortify_fail+0x48)[0xb7f08548]
/lib/tls/i686/cmov/libc.so.6(__fortify_fail+0x0)[0xb7f08500]
./bof[0x8048467]
[0x41414141]
======= Memory map: ========
08048000-08049000 r-xp 00000000 08:01 5630493    /home/jason/bof
08049000-0804a000 r--p 00000000 08:01 5630493    /home/jason/bof
0804a000-0804b000 rw-p 00001000 08:01 5630493    /home/jason/bof
09407000-09428000 rw-p 09407000 00:00 0          [heap]
b7dfe000-b7e0b000 r-xp 00000000 08:01 2696597    /lib/libgcc_s.so.1
b7e0b000-b7e0c000 r--p 0000c000 08:01 2696597    /lib/libgcc_s.so.1
b7e0c000-b7e0d000 rw-p 0000d000 08:01 2696597    /lib/libgcc_s.so.1
b7e0d000-b7e0e000 rw-p b7e0d000 00:00 0
b7e0e000-b7f66000 r-xp 00000000 08:01 2713045    /lib/tls/i686/cmov/
libc-2.8.90.so
b7f66000-b7f68000 r--p 00158000 08:01 2713045    /lib/tls/i686/cmov/
libc-2.8.90.so
b7f68000-b7f69000 rw-p 0015a000 08:01 2713045    /lib/tls/i686/cmov/
libc-2.8.90.so
b7f69000-b7f6c000 rw-p b7f69000 00:00 0
b7f83000-b7f85000 rw-p b7f83000 00:00 0
b7f85000-b7f9f000 r-xp 00000000 08:01 2696604    /lib/ld-2.8.90.so
b7f9f000-b7fa0000 r-xp b7f9f000 00:00 0          [vdso]
b7fa0000-b7fa1000 r--p 0001a000 08:01 2696604    /lib/ld-2.8.90.so
b7fa1000-b7fa2000 rw-p 0001b000 08:01 2696604    /lib/ld-2.8.90.so
bfb8c000-bfba1000 rw-p bffeb000 00:00 0          [stack]
Aborted
jason@...o:~$

I have googled my brains out for a solution, but all I have gathered is that
my Ubuntu's gcc is compiled with SSP and everytime I try to overwrite the
return address it also overwrites the canary's value, and triggers a stop in
the program. I've disassembled it and anybody who can help me probably
doesn't need me to explain much more, but I would like to know a way to get
this. There seems to be some people on this list who may know something on
how to exploit on *nix systems with this protection enabled.

I do not want to just disable the protection and exploit it normally, I want
to learn how to exploit it this way.

Jason

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/