buffer overflows

infiniteedge · Tux's lil' helper Joined: 03 Mar 2004 Posts: 149

I'm making an exercise for some students of mine to learn buffer overflows and wanted to know how I would have to compile Gentoo to make buffer overflows exploits the easiest. Eg, zero protections on gcc, zero protections in the kernel, zero protection period. I seem to remember that in recent version of kernel 2.6 there is some sort of environment variable address randomization to make it harder to find your exploit code in memory (if you're putting it in an environment variable)?

Anyway, gimme anything you got. Thanks.

kinkos · Posted: Tue Sep 27, 2005 4:22 am Post subject:

I was given this project over the summer, and i have some advice. STay away from amd64 processors. there seems to be a serious issue with demonstrating that buffer overflow attempt. I'll go into the frustrating detail if you really want. Other than that, make sure its not a hardened system, for the obvious reasons. (after spending a summer researching the very exploits you want to demonstrate, i'm not sure if its possible on the hardened amd64 system i created). You may also like to try using an outdated version of gentoo, or possibly something like red-hat 6. sure, no one uses it any more, but its just for demonstration purposes, right? Also, the more recent the compiler, the more protections that are added by patches. I'm pretty sure that gcc 3.4.3 even comes with a significant amount of anti-exploit techniques compiled in by default.

In summary
-no amd64
-no hardened
-old
-vanilla everything (add vanilla to use flags, turns off all patches)

HTH
_________________
Open Source, Open Mind

Suicidal · l33t Joined: 30 Jul 2003 Posts: 959 Location: /dev/null

Gentoo would be kinda difficult to use as an example for buffer overflow vulnerabilities since it is so up to date and vulnerable packages are frequently removed from portage.

A better example would be buying an old linux bible book that has something like redhat 7.3 or even 9.

Even better you could have them compile horrible code like the following:

buffer.cc

allucid · Veteran Joined: 02 Nov 2002 Posts: 1314 Location: atlanta

Make sure you aren't using hardened gcc version since (I think) it has 'smash the stack' protection (ssp).

kinkos · Posted: Tue Sep 27, 2005 5:45 am Post subject:

Hardened gentoo is scary secure. As a regular user, you can;t see ANY processes that you don't own, not even init. Especially from the /proc interface. Like Suicidal said, an old linux bible with redhat 7.3 or some such.
_________________
Open Source, Open Mind

infiniteedge · Tux's lil' helper Joined: 03 Mar 2004 Posts: 149

this isn't just for a demonstration, I need to be running gentoo on a series of UMLs that all the students have access to. Do you know specific flags for gcc that will turn off the protections you speak about? For amd64 I believe you were running into the NX or no-execute bit. we wont be running on amd64.

kinkos · Posted: Tue Sep 27, 2005 7:35 pm Post subject:

infiniteedge · Tux's lil' helper Joined: 03 Mar 2004 Posts: 149

while this thread is great, what I'm really looking for are more things like the 'vanilla' use flag. does someone know *specific* command line flags to use with gcc to turn off all buffer overflow protection it has? I took a quick look and couldn't find any.

allucid · Veteran Joined: 02 Nov 2002 Posts: 1314 Location: atlanta

The only explicit protection I know of is ssp which is compiled in so you won't find a flag for it. I believe it's only in hardened kernels though so you shouldn't have a problem (unless you are using hardened gcc).

kinkos · Posted: Wed Sep 28, 2005 8:00 pm Post subject:

I've done a little digging. Currently, SSP (Stack Smashing Protection) isn't build into gcc by default, but added as a patch. As of GCC 4.1, it WILL be in by default, meaning you have to use an old version at that point.

However, gentoo has SSP pactching in through the ebuilds.

Taking a look at this,