Re: [Full-disclosure] Exploiting buffer overflows via protected GCC

[Marcus Meissner <meissner@xxxxxxx>]

On Fri, Feb 13, 2009 at 11:50:11AM -0500, Jason Starks wrote:
> I came across a problem that I am sure many security researchers have seen
> before:
> 
> jason@uboo:~$ cat bof.c
> #include <stdio.h>
> #include <string.h>
> 
> int main()
> {
> 
> char buf[512];
> 
> memset(buf, 'A', 528);
> 
> return 0;
> 
> }
> jason@uboo:~$
> 
> jason@uboo:~$ ./bof
> *** stack smashing detected ***: ./bof terminated
> ======= Backtrace: =========
> /lib/tls/i686/cmov/libc.so.6(__fortify_fail+0x48)[0xb7f08548]
> jason@uboo:~$
> 
> I have googled my brains out for a solution, but all I have gathered is that
> my Ubuntu's gcc is compiled with SSP and everytime I try to overwrite the
> return address it also overwrites the canary's value, and triggers a stop in
> the program. I've disassembled it and anybody who can help me probably
> doesn't need me to explain much more, but I would like to know a way to get
> this. There seems to be some people on this list who may know something on
> how to exploit on *nix systems with this protection enabled.
> 
> I do not want to just disable the protection and exploit it normally, I want

Perhaps you should learn first exactly _what_ caught your buffer overflow.

Hint: It was not SSP aka -fstack-protector.

Ciao, Marcus

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/