Linux Stack Protection By Default

Modern gcc compiler (v9.2.0) protects the stack by default and you will notice it because instead of SIGSEGV on stack overflow you will get a SIGABRT, but it also generates coredumps.

In this case the compiler adds the variable local_10. This variable helds a canary value that is checked at the end of the function.
The memset overflows the four bytes stack variable and modifies the canary value.

The 64bits canary 0x5429851ebaf95800 can't be predicted, but in specific situations is not re-generated and can be bruteforced or in other situations can be leaked from memory for example using a format string vulnerability or an arbitrary read wihout overflowing the stack.

If the canary doesn't match, the libc function __stack_chck_fail is called and terminates the prorgam with a SIGABORT which generates a coredump, in the case of archlinux managed by systemd and are stored on "/var/lib/systemd/coredump/"


❯❯❯ ./test 
*** stack smashing detected ***: terminated
fish: './test' terminated by signal SIGABRT (Abort)

❯❯❯ sudo lz4 -d core.test.1000.c611b7caa58a4fa3bcf403e6eac95bb0.1121.1574354610000000.lz4
[sudo] password for xxxx: 
Decoding file core.test.1000.c611b7caa58a4fa3bcf403e6eac95bb0.1121.1574354610000000 
core.test.1000.c611b : decoded 249856 bytes 

 ❯❯❯ sudo gdb /home/xxxx/test core.test.1000.c611b7caa58a4fa3bcf403e6eac95bb0.1121.1574354610000000 -q 

We specify the binary and the core file as a gdb parameters. We can see only one LWP (light weight process) or linux thread, so in this case is quicker to check. First of all lets see the back trace, because in this case the execution don't terminate in the segfaulted return.

We can see on frame 5 the address were it would had returned to main if it wouldn't aborted.

Happy Idea: we can use this stack canary aborts to detect stack overflows. In Debian with prevous versions it will be exploitable depending on the compilation flags used.
And note that the canary is located as the last variable in the stack so the previous variables can be overwritten without problems.

Related posts

1. Hacking Tools For Windows 7
2. Hacker Tools Hardware
3. Hacker Tools Linux
4. Hacker Tools Free
5. Hacking Tools
6. Github Hacking Tools
7. Hacker Tools Github
8. Pentest Tools For Ubuntu
9. Hacking Tools For Windows
10. Hack Tools For Windows
11. How To Install Pentest Tools In Ubuntu
12. Hacker Tools
13. Hack Tools
14. Hackrf Tools
15. Blackhat Hacker Tools
16. Hack Tools 2019
17. Hacker Tools For Mac
18. Pentest Tools For Mac
19. Bluetooth Hacking Tools Kali
20. Hacking Tools Online
21. Hacker Security Tools
22. Hacker Tools Apk Download
23. Hacks And Tools
24. Hacker Tools Software
25. Hacking Tools Usb
26. Hacking App
27. New Hack Tools
28. Pentest Tools Website
29. Pentest Automation Tools
30. Pentest Tools Nmap
31. Hacking Tools Mac
32. Hackrf Tools
33. Black Hat Hacker Tools
34. Hacking Tools 2019
35. Ethical Hacker Tools
36. Github Hacking Tools
37. Hacking Tools Online
38. Pentest Tools Subdomain
39. Pentest Tools Download
40. Tools For Hacker
41. Pentest Tools List
42. Hack Tools Online
43. Pentest Tools Alternative
44. How To Hack
45. Hack And Tools
46. Pentest Tools Website Vulnerability
47. Hacker Tools Windows
48. Hacker Hardware Tools
49. Pentest Tools Nmap
50. Pentest Tools For Windows
51. Pentest Tools Windows
52. Hacking Apps
53. Pentest Tools Port Scanner
54. Pentest Tools Github
55. Hack Website Online Tool
56. What Is Hacking Tools
57. How To Make Hacking Tools
58. Blackhat Hacker Tools
59. Hack Tools Online
60. What Is Hacking Tools
61. Hacker
62. Best Pentesting Tools 2018
63. Hacker Tool Kit
64. Hack And Tools
65. Pentest Automation Tools
66. New Hack Tools
67. Hack Tools Mac
68. Hack Website Online Tool
69. Hacking Tools For Windows
70. Pentest Tools Apk
71. Pentest Reporting Tools
72. Tools For Hacker
73. What Is Hacking Tools
74. Kik Hack Tools
75. Pentest Tools Website
76. Pentest Tools Url Fuzzer
77. Blackhat Hacker Tools
78. Hack Tools Online
79. Hacking Tools Hardware
80. New Hacker Tools
81. Hacker Tools 2020
82. Hack Rom Tools
83. Hacking Tools Windows 10
84. Hackers Toolbox
85. Hacking Tools
86. Hacker Search Tools
87. Hacking Apps
88. Hacker Tools Free Download
89. Hacker Tools Mac
90. Hacker Tools
91. Computer Hacker
92. Hack Tools Pc
93. Best Hacking Tools 2020
94. Hacker Tool Kit
95. Pentest Tools Review