Linux Stack Protection By Default

Modern gcc compiler (v9.2.0) protects the stack by default and you will notice it because instead of SIGSEGV on stack overflow you will get a SIGABRT, but it also generates coredumps.

In this case the compiler adds the variable local_10. This variable helds a canary value that is checked at the end of the function.
The memset overflows the four bytes stack variable and modifies the canary value.

The 64bits canary 0x5429851ebaf95800 can't be predicted, but in specific situations is not re-generated and can be bruteforced or in other situations can be leaked from memory for example using a format string vulnerability or an arbitrary read wihout overflowing the stack.

If the canary doesn't match, the libc function __stack_chck_fail is called and terminates the prorgam with a SIGABORT which generates a coredump, in the case of archlinux managed by systemd and are stored on "/var/lib/systemd/coredump/"


❯❯❯ ./test 
*** stack smashing detected ***: terminated
fish: './test' terminated by signal SIGABRT (Abort)

❯❯❯ sudo lz4 -d core.test.1000.c611b7caa58a4fa3bcf403e6eac95bb0.1121.1574354610000000.lz4
[sudo] password for xxxx: 
Decoding file core.test.1000.c611b7caa58a4fa3bcf403e6eac95bb0.1121.1574354610000000 
core.test.1000.c611b : decoded 249856 bytes 

 ❯❯❯ sudo gdb /home/xxxx/test core.test.1000.c611b7caa58a4fa3bcf403e6eac95bb0.1121.1574354610000000 -q 

We specify the binary and the core file as a gdb parameters. We can see only one LWP (light weight process) or linux thread, so in this case is quicker to check. First of all lets see the back trace, because in this case the execution don't terminate in the segfaulted return.

We can see on frame 5 the address were it would had returned to main if it wouldn't aborted.

Happy Idea: we can use this stack canary aborts to detect stack overflows. In Debian with prevous versions it will be exploitable depending on the compilation flags used.
And note that the canary is located as the last variable in the stack so the previous variables can be overwritten without problems.

Read more

1. Hak5 Tools
2. Hacker Tools For Windows
3. Hacker Tools For Pc
4. Hacker Tools For Ios
5. Pentest Tools Port Scanner
6. Pentest Recon Tools
7. Pentest Tools List
8. Hack Apps
9. Hacking Tools For Pc
10. Hacking Tools Windows 10
11. Hacking Tools Hardware
12. Hak5 Tools
13. Hacker Tools For Pc
14. Hacker Tools 2020
15. Pentest Tools List
16. Hacker Tools List
17. Pentest Tools Apk
18. Hacker
19. Install Pentest Tools Ubuntu
20. Hack Tools For Mac
21. Pentest Recon Tools
22. Hacking Tools 2020
23. Hacker Tool Kit
24. Hack Tools Pc
25. Game Hacking
26. Blackhat Hacker Tools
27. Tools For Hacker
28. Hacking Tools Software
29. Pentest Tools Tcp Port Scanner
30. Pentest Tools Online
31. Hacking Tools Free Download
32. Hacking Tools 2020
33. Hacking Tools
34. What Are Hacking Tools
35. Hacking Tools For Kali Linux
36. Pentest Tools Android
37. Top Pentest Tools
38. Hack Tools For Mac
39. Hack Tools Download
40. Pentest Tools Review
41. Hacking Tools For Games
42. Pentest Tools Kali Linux
43. Hacking App
44. Hacker Tools Mac
45. Hacking Tools Online
46. Computer Hacker
47. Pentest Tools Kali Linux
48. Pentest Tools For Windows
49. Pentest Tools For Mac
50. Tools For Hacker
51. Hacking Tools Name
52. Best Pentesting Tools 2018
53. Hacking Tools For Windows Free Download
54. Best Hacking Tools 2020
55. Hacker Tools 2020
56. Pentest Tools Windows
57. Pentest Tools Linux
58. Hacker Tools Online
59. Pentest Tools Bluekeep
60. Hacker Tools Github
61. Hacker Tools Software
62. Hack And Tools
63. Computer Hacker
64. Hacking Tools For Windows Free Download
65. Hacking Tools Github
66. Hacking App
67. New Hacker Tools
68. Hack Rom Tools
69. Free Pentest Tools For Windows
70. Pentest Tools Subdomain
71. Bluetooth Hacking Tools Kali
72. Pentest Tools Windows
73. Hack Tools For Ubuntu