4

I'm trying to learn about stack base overflow and write a simple code to exploit stack. But somehow it doesn't work at all but showing only Abort trap on my machine (mac os leopard)

I guess Mac os treats overflow differently, it won't allow me to overwrite memory through c code. for example,

strcpy(buffer, input) // lets say char buffer[6] but input is 7 bytes 

on Linux machine, this code successfully overwrite next stack, but prevented on mac os (Abort trap)

Anyone know how to perform a simple stack-base overflow on mac machine?

2
  • Hint: compile to assembly with -S flag and try to work out the difference. Jun 11, 2010 at 21:43
  • Reading through the response to some of the other buffer-overflow questions on this site is probably a good place to start.
    – jschmier
    Jun 12, 2010 at 16:06

4 Answers 4

15

@joveha's answer is correct, with GCC you have to compile with the -fno-stack-protector to turn of the buffer overflow protections.

However, additionally you’ll need to disable the FORTIFY_SOURCE option, otherwise you’ll get “Abort trap” if you try to do a buffer overflow that uses something like strcpy or memcpy.

To disable it, simply compile with the flag -D_FORTIFY_SOURCE=0, for example:

gcc -g -fno-stack-protector -D_FORTIFY_SOURCE=0 -o overflow overflow.c

Source: Turning off buffer overflow protections in GCC.

1
  • This helped me.
    – lkahtz
    Oct 3, 2019 at 15:14
5

include

int main(int argc, char **argv) {
    char buffer[4];
    puts("Hello");
    gets(buffer);
    return 0;)
}

and call it as:

printf "0123456789abcdefghij\260\037" | ./a.out

\260\037 is the address of main(0x1fb0 here) in octal and in little endian order.

You should see hello print two times before a bus error. The trick is to use a debugger(even gdb will do) to know both where you want to end up and where is the return address. It won't be the same as in Linux!

MacOS X for i386(most OSes for i386 in fact including Linux and Windows) and especially <=Leopard are not the most secure OS.

EDIT: just realized I was using clang as the compiler. So you will need to adapt it to gcc but I can tell you it works with little change :p.

1
  • For me, this doesn't seem to work. I keep getting "warning: this program uses gets(), which is unsafe." instead of the expected outcome. Nov 9, 2020 at 5:00
4

Stack overflow?

The term stack overflow refers to the situation when the stack size attempts to grow beyond the maximum limit allowed by the current platform and/or configuration. What you are trying to do has no relation to stack overflow at all. If you want to see stack overflow, write an infinitely recursive function, execute it and just wait till it overflows:

void foo() {
  foo();
}

(Hoping that the compiler will not optimize the tail recursion into a cycle. If it does, make it a bit more complicated, non-tail recursive.)

What you seem to be trying to do is to reproduce the infamous buffer overflow exploit. While the buffer in question is supposed to be allocated in the stack, the exploit has never been referred to as "stack overflow". In order to actually demonstrate the exploit, it is not sufficient to just overrun the bounds of some buffer. The whole point is to plant a pre-determined value in the area of the stack originally occupied by the stored return address, so that when the function finishes, it "returns" to some other (presumably malicious) code instead of the original calling code.

So, what is it you are trying to do? Stack overflow? Or buffer overflow?

3
  • Yes, this is a buffer overflow, but not a stack overflow (unless the system only has 6 bytes of stack ;). Jun 11, 2010 at 21:56
  • To be more helpful, let's tell him that what he's referring to is a "buffer overflow"
    – bobDevil
    Jun 11, 2010 at 21:56
  • 3
    Don't sweat it REALFREE, your question is fine. These guys are just talking to themselves :)
    – joveha
    Jun 12, 2010 at 16:10
3

Your compiler on Mac OS has compiled in a stack canary which gives you the abort trap. Search in your compiler manual on how to disable it.

With GCC this option is -fno-stack-protector.

On a separate note, overflow with 1 byte will surely not be enough to trigger anything but a compiler stack check. Use something like 12 bytes :)

1
  • 1
    GNU stack canary protection only starts at sizeof(buffer)>=8 but that's for versions that enable it by default(like Kubuntu Karmic 64) Neither gcc or clang do it for me in Leopard. Abort trap does suggest his version does, though. Maybe he is actually using Snow Leopard.
    – user14554
    Jun 13, 2010 at 2:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.