Full Disclosure mailing list archives
Exploiting buffer overflows via protected GCC
From: Jason Starks <jstarks440 () gmail com>
Date: Fri, 13 Feb 2009 11:50:11 -0500
I came across a problem that I am sure many security researchers have seen before: jason@uboo:~$ cat bof.c #include <stdio.h> #include <string.h> int main() { char buf[512]; memset(buf, 'A', 528); return 0; } jason@uboo:~$ jason@uboo:~$ ./bof *** stack smashing detected ***: ./bof terminated ======= Backtrace: ========= /lib/tls/i686/cmov/libc.so.6(__fortify_fail+0x48)[0xb7f08548] /lib/tls/i686/cmov/libc.so.6(__fortify_fail+0x0)[0xb7f08500] ./bof[0x8048467] [0x41414141] ======= Memory map: ======== 08048000-08049000 r-xp 00000000 08:01 5630493 /home/jason/bof 08049000-0804a000 r--p 00000000 08:01 5630493 /home/jason/bof 0804a000-0804b000 rw-p 00001000 08:01 5630493 /home/jason/bof 09407000-09428000 rw-p 09407000 00:00 0 [heap] b7dfe000-b7e0b000 r-xp 00000000 08:01 2696597 /lib/libgcc_s.so.1 b7e0b000-b7e0c000 r--p 0000c000 08:01 2696597 /lib/libgcc_s.so.1 b7e0c000-b7e0d000 rw-p 0000d000 08:01 2696597 /lib/libgcc_s.so.1 b7e0d000-b7e0e000 rw-p b7e0d000 00:00 0 b7e0e000-b7f66000 r-xp 00000000 08:01 2713045 /lib/tls/i686/cmov/ libc-2.8.90.so b7f66000-b7f68000 r--p 00158000 08:01 2713045 /lib/tls/i686/cmov/ libc-2.8.90.so b7f68000-b7f69000 rw-p 0015a000 08:01 2713045 /lib/tls/i686/cmov/ libc-2.8.90.so b7f69000-b7f6c000 rw-p b7f69000 00:00 0 b7f83000-b7f85000 rw-p b7f83000 00:00 0 b7f85000-b7f9f000 r-xp 00000000 08:01 2696604 /lib/ld-2.8.90.so b7f9f000-b7fa0000 r-xp b7f9f000 00:00 0 [vdso] b7fa0000-b7fa1000 r--p 0001a000 08:01 2696604 /lib/ld-2.8.90.so b7fa1000-b7fa2000 rw-p 0001b000 08:01 2696604 /lib/ld-2.8.90.so bfb8c000-bfba1000 rw-p bffeb000 00:00 0 [stack] Aborted jason@uboo:~$ I have googled my brains out for a solution, but all I have gathered is that my Ubuntu's gcc is compiled with SSP and everytime I try to overwrite the return address it also overwrites the canary's value, and triggers a stop in the program. I've disassembled it and anybody who can help me probably doesn't need me to explain much more, but I would like to know a way to get this. There seems to be some people on this list who may know something on how to exploit on *nix systems with this protection enabled. I do not want to just disable the protection and exploit it normally, I want to learn how to exploit it this way. Jason
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Exploiting buffer overflows via protected GCC Jason Starks (Feb 13)
- Re: Exploiting buffer overflows via protected GCC Valdis . Kletnieks (Feb 13)
- Re: Exploiting buffer overflows via protected GCC ArcSighter Elite (Feb 13)
- Re: Exploiting buffer overflows via protected GCC Jubei Trippataka (Feb 16)
- Re: Exploiting buffer overflows via protected GCC Valdis . Kletnieks (Feb 17)
- Message not available
- Re: Exploiting buffer overflows via protected GCC James Matthews (Feb 14)
- Re: Exploiting buffer overflows via protected GCC ArcSighter Elite (Feb 16)
- Re: Exploiting buffer overflows via protected GCC Marcus Meissner (Feb 16)
- Re: Exploiting buffer overflows via protected GCC James Matthews (Feb 14)
- Re: Exploiting buffer overflows via protected GCC Valdis . Kletnieks (Feb 13)