8

The modern compiler GCC is so powerful that it can even prevent buffer overflow in compilation phase so that OS can not run code on stack space.

For example:

void function(char *str) 
{
   char buffer[16];

   strncpy(buffer, str, 256);
}

void main() 
{
  char large_string[256];
  int i;

  for( i = 0; i < 256; i++)
    large_string[i] = 'A';

  function(large_string);
}

The only way I can get the magic 0x41414141 is to set GCC compile parameter such like:

gcc -fno-stack-protector -z execstack stackoverflow.c -o stackoverflow

(I tested it on ubuntu 10.04 x86 lucid 32bits box)

Is there any way I can bypass the GCC stack smashing protection ?

19
  • Which limitation are you referring to, and why do you want to bypass whatever it is? Oct 23, 2012 at 6:55
  • You want to intentionally corrupt the stack? Why? And your code has a bug, btw. You forgot to NULL-terminate large_string. The strcpy() won't be limited to just 255 bytes.
    – Nikos C.
    Oct 23, 2012 at 6:57
  • I think you mean to ask if it's possible to bypass the gcc stack protection, if so you should edit the question to make that clear. Oct 23, 2012 at 6:57
  • 1
    @NikosChantziaras With that bug it's even better! Oct 23, 2012 at 6:58
  • 1
    Then compile it without the protection. Where's the problem?
    – Nikos C.
    Oct 23, 2012 at 7:06

2 Answers 2

7

You should disable the stack protection when compiling:

gcc  -fno-stack-protector -z execstack stackoverflow.c -o stackoverflow

And you may want to also disable address space randomization (ASLR):

sudo sh -c 'echo 0 > /proc/sys/kernel/randomize_va_space'

Now you can try the buffer overflows, I recommend reading Smashing the Stack for Fun and Profit

Edit:

Like I said in my comment, it's safe to assume that it's acceptable in your assignment to disable the stack protection, however, if you want to bypass the stack protection you should check SOF for question related to canaries like this questions:

Is there any way to bypass SSP (StackSmashing Protection)/Propolice?

8
  • Is there a way that I can directly smashing the stack without any parameter setting? Oct 23, 2012 at 7:15
  • Your assignment asks for exploiting a buffer overflow I think it's safe to assume that disabling the stack protection is acceptable, otherwise the problem is really much more complicated. Oct 23, 2012 at 7:22
  • yes, I think so. Just so curious if there is a way to bypass such powerful stack protection. In the other side, Is that right to say it is safe for a code even though there is a stack overflow hole in it since the code in stack can not be ran after the stack-protected compilation.(The worst case for such problem is program termination, the hacker can not run shellcode through it) Oct 23, 2012 at 7:27
  • Just a minor correction: your echo command will not work. It should be something like sudo sh -c 'echo 0 > /proc/sys/kernel/randomize_va_space'.
    – mtvec
    Oct 23, 2012 at 7:43
  • @Job Thanks ! I always forget that :) Oct 23, 2012 at 7:46
1

There are certainly ways to circumvent the stack smashing protection (called stack canaries) although it won't be easy in your example. See my answer here for some of the weaknesses of stack canaries.

2
  • Could you give a simple workable example for such stack canaries Oct 23, 2012 at 7:31
  • @JustForTest: I'm afraid not. The only way to circumvent the stack canary in your example would be to overwrite it with the same value. Since there is no memory leakage vulnerability, the only way to do this is to brute force it which probably isn't viable...
    – mtvec
    Oct 23, 2012 at 7:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.