Hacker Newsnew | past | comments | ask | show | jobs | submit | jergal's commentslogin

Apologies, guys :)


:)


Indeed, classical music helps me sometimes, when I feel like doing silly things, as opposed to study/research.


Amongst other things, for users using gcc ( >= 4.0 ) you have the flag `f-stack-protector' set by default, by setting the `-fno-stack-protector' flag explicitly, you effectively turn of compiler stack canary protection.

For those with a non-executable stack, by setting /proc/sys/kernel/randomize_va_space to 0, you effectively turn off any Address Space Layout Randomization (ASLR).

If by now, you're still unable to acquire a segmentation violation, try looking into the execshield stack markings, and so on, which may probably very easily be identified via some search engine.

Otherwise, it should be trivially capable to overflow a stack based buffer via the conventional routines, should they lack boundary checks.

Stack based buffer overflows pose as big a problem now, as they did 13 years ago, and probably more-so.


The flags for disabling executable stack are: "-Wl,-z execstack" "-Wa,--execstack"

I also added -U_FORTIFY_SOURCE in the Makefile for the exploit project that the security course I'm TAing is currently working on. Not sure if that was entirely necessary.


Look at the output of `objdump -d prog | grep call | grep _chk | wc -l', if the value returned is zero/0/0x0 you haven't got FORTIFY_SOURCE enabled, and would be unnecessary to add -U_FORTIFY_SOURCE.

However this is dependant upon implementation set restrictions and defaults.


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: