full-disclosure - Re: Exploiting buffer overflows via protected GCC

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20090213223024.GA28738@suse.de>
Date: Fri, 13 Feb 2009 23:30:25 +0100
From: Marcus Meissner <meissner@...e.de>
To: Jason Starks <jstarks440@...il.com>
Cc: full-disclosure@...ts.grok.org.uk
Subject: Re: Exploiting buffer overflows via protected GCC

On Fri, Feb 13, 2009 at 11:50:11AM -0500, Jason Starks wrote:
> I came across a problem that I am sure many security researchers have seen
> before:
> 
> jason@...o:~$ cat bof.c
> #include <stdio.h>
> #include <string.h>
> 
> int main()
> {
> 
> char buf[512];
> 
> memset(buf, 'A', 528);
> 
> return 0;
> 
> }
> jason@...o:~$
> 
> jason@...o:~$ ./bof
> *** stack smashing detected ***: ./bof terminated
> ======= Backtrace: =========
> /lib/tls/i686/cmov/libc.so.6(__fortify_fail+0x48)[0xb7f08548]
> jason@...o:~$
> 
> I have googled my brains out for a solution, but all I have gathered is that
> my Ubuntu's gcc is compiled with SSP and everytime I try to overwrite the
> return address it also overwrites the canary's value, and triggers a stop in
> the program. I've disassembled it and anybody who can help me probably
> doesn't need me to explain much more, but I would like to know a way to get
> this. There seems to be some people on this list who may know something on
> how to exploit on *nix systems with this protection enabled.
> 
> I do not want to just disable the protection and exploit it normally, I want

Perhaps you should learn first exactly _what_ caught your buffer overflow.

Hint: It was not SSP aka -fstack-protector.

Ciao, Marcus

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/