Security Blog
Posts tagged buffer overflows
Flow of a Buffer Overflow Payload
13 years
Here is the flow of a buffer overflow payload with a NOP Sled.
- Jump to overwritten return address that (hopefully) points to somewhere in the NOPs (0×90)
- Consume the No Operations (NOPs)
- Execute the shell code
Turning off buffer overflow protections in GCC
13 years
As I’m learning more and more about exploiting buffer overflows I’m realizing that it’s actually pretty hard to run the examples that teach you how to exploit buffer overflows. GCC (and other compilers) have built in support for mitigating the simple buffer overflows and it’s turned on by default.
With GCC you have to compile with the -fno-stack-protector option otherwise you get “***stack smashing detected***,” this is pretty well known and documented all over the net.
However, additionally you’ll need to disable the FORTIFY_SOURCE option otherwise you’ll get “Abort trap” if you try to do a buffer overflow that uses something like strcpy or memcpy.
To disable it, simply compile with the flag -D_FORTIFY_SOURCE=0 (e.g. gcc -g -fno-stack-protector -D_FORTIFY_SOURCE=0 -o overflow_example overflow_example.c)
Types of Overflows: Stack-Based Overflows
13 years
A buffer is simply some fixed space in memory used to store data. In C, you create a buffer by declaring an array of some primitive type such as a ‘char array[SIZE]‘ or int ‘array[SIZE]‘. (more…)