[Full-disclosure] Exploiting buffer overflows via protected GCC

[Jason Starks <jstarks440@xxxxxxxxx>]

I came across a problem that I am sure many security researchers have seen
before:

jason@uboo:~$ cat bof.c
#include <stdio.h>
#include <string.h>

int main()
{

char buf[512];

memset(buf, 'A', 528);

return 0;

}
jason@uboo:~$

jason@uboo:~$ ./bof
*** stack smashing detected ***: ./bof terminated
======= Backtrace: =========
/lib/tls/i686/cmov/libc.so.6(__fortify_fail+0x48)[0xb7f08548]
/lib/tls/i686/cmov/libc.so.6(__fortify_fail+0x0)[0xb7f08500]
./bof[0x8048467]
[0x41414141]
======= Memory map: ========
08048000-08049000 r-xp 00000000 08:01 5630493    /home/jason/bof
08049000-0804a000 r--p 00000000 08:01 5630493    /home/jason/bof
0804a000-0804b000 rw-p 00001000 08:01 5630493    /home/jason/bof
09407000-09428000 rw-p 09407000 00:00 0          [heap]
b7dfe000-b7e0b000 r-xp 00000000 08:01 2696597    /lib/libgcc_s.so.1
b7e0b000-b7e0c000 r--p 0000c000 08:01 2696597    /lib/libgcc_s.so.1
b7e0c000-b7e0d000 rw-p 0000d000 08:01 2696597    /lib/libgcc_s.so.1
b7e0d000-b7e0e000 rw-p b7e0d000 00:00 0
b7e0e000-b7f66000 r-xp 00000000 08:01 2713045    /lib/tls/i686/cmov/
libc-2.8.90.so
b7f66000-b7f68000 r--p 00158000 08:01 2713045    /lib/tls/i686/cmov/
libc-2.8.90.so
b7f68000-b7f69000 rw-p 0015a000 08:01 2713045    /lib/tls/i686/cmov/
libc-2.8.90.so
b7f69000-b7f6c000 rw-p b7f69000 00:00 0
b7f83000-b7f85000 rw-p b7f83000 00:00 0
b7f85000-b7f9f000 r-xp 00000000 08:01 2696604    /lib/ld-2.8.90.so
b7f9f000-b7fa0000 r-xp b7f9f000 00:00 0          [vdso]
b7fa0000-b7fa1000 r--p 0001a000 08:01 2696604    /lib/ld-2.8.90.so
b7fa1000-b7fa2000 rw-p 0001b000 08:01 2696604    /lib/ld-2.8.90.so
bfb8c000-bfba1000 rw-p bffeb000 00:00 0          [stack]
Aborted
jason@uboo:~$

I have googled my brains out for a solution, but all I have gathered is that
my Ubuntu's gcc is compiled with SSP and everytime I try to overwrite the
return address it also overwrites the canary's value, and triggers a stop in
the program. I've disassembled it and anybody who can help me probably
doesn't need me to explain much more, but I would like to know a way to get
this. There seems to be some people on this list who may know something on
how to exploit on *nix systems with this protection enabled.

I do not want to just disable the protection and exploit it normally, I want
to learn how to exploit it this way.

Jason

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/