Basic Stack Overflow attacks in Linux

1.1 Linux Stack Overflow Protection Mechanism

The basic stack overflow attack is the first buffer overflow attack method. It is the basis of all other buffer overflow attacks. However, because this attack method takes a long time, the GCC compiler and Linux operating system provide some mechanisms to prevent this attack method from harming the system. The following describes the existing stack protection mechanism and the method to disable the corresponding protection mechanism, which provides a good experimental environment for further analysis of basic stack overflow.

1. Memory Address randomization Mechanism

In Ubuntu and other Linux kernel-based systems, the memory address randomization mechanism is used to initialize the stack. This will make it very difficult to guess the specific memory address.

The method to disable the memory address randomization mechanism is:

Sysctl-w kernel. randomize_va_space = 0

2. Shielding and protection mechanism for executable programs

For Federal systems, the executable program blocking protection mechanism is implemented by default. This mechanism does not allow execution of code stored in the stack, which makes the buffer overflow attack ineffective. This mechanism is not used by default in Ubuntu.

The method to disable the protection mechanism of executable programs is:

Sysctl-w kernel.exe c-shield = 0

3. gcc compiler gs Verification Code Mechanism

The gcc compiler provides special protection measures to prevent buffer overflow. The specific method is that gcc first places a random gs verification code before the buffer is written after the buf end address and the return address, check the value at the end of the buffer write operation. Generally, buffer overflow overwrites the memory from the low address to the high address. Therefore, if you want to overwrite the return address, you need to overwrite the gs verification code. In this way, you can compare the data of the gs verification code before and after writing to determine whether overflow exists.

To disable the gcc compiler's gs Verification Code mechanism, follow these steps:

Use the-fno-stack-protector option during gcc compilation.

4. ld linker stack segment unexecutable Mechanism

When linking a program, if all. o file stack segments are marked as unexecutable, so the entire library stack segment will be marked as unexecutable; on the contrary, even if there is only one. if the stack segment of file 0 is marked as executable, the stack segment of the entire library is marked as executable. The method to check the enforceability of stack segments is:

If you are checking the ELF Library: readelf-lW $ BIN | grep GNU_STACK, check whether the E tag exists.

If you are checking the generated. o file: scanelf-e $ BIN, check whether there is an X mark.

If the ld linker marks the stack segment as unexecutable, a segment error will still occur even if the eip is controlled to generate a jump.

To disable the unexecutable mechanism of the ld linker, follow these steps:

Use the-z execstack option during gcc compilation.

1.1 Basic Stack Overflow Attack principle and Experiment

Next, we will use an example of stack overflow attack to explain in detail the detailed steps of the basic stack overflow attack.

Before testing, we should first use the method described above to disable the corresponding stack protection mechanism.

Root @ linux :~ /Pentest # sysctl-w kernel. randomize_va_space = 0 Kernel. randomize_va_space = 0 Root @ linux :~ /Pentest # sysctl-w kernel.exe c-shield = 0 Error:"Kernel.exe c-shield"Is an unknown key

The Code is as follows:

Root @ linux :~ /Pentest # cat vulnerable. c # Include <stdio. h> # Include <string. h> IntMain (IntArgc,Char** Argv ){ CharBuffer [500]; Strcpy (buffer, argv [1]); Return0; }

Compile source code:

Root @ linux :~ /Pentest # gcc-fno-stack-protector-z execstack-g-o vulnerable. c

Use gdb to debug the program:

Root @ linux :~ /Pentest # gdb vulnerable GNU gdb (Ubuntu/Linaro 7.2-1ubuntu11) 7.2 Copyright (C) 2010 Free Software Foundation, Inc. License GPLv3 +: gnu gpl version 3 or later // Gnu.org/licenses/gpl.html> This is free software: you are free to change and redistribute it. There is no warranty, to the extent permitted by law. Type"Show copying" And"Show warranty" ForDetails. This GDB was configuredI686-linux-gnu". For bug reporting instructions, please see: <Http:// Www.gnu.org/software/gdb/bugs/>... Reading symbols from/root/pentest/vulnerable... done. (Gdb) disass main Dump of worker er codeForFunction main: 0x080483c4 <+ 0>: push % ebp 0x080483c5 <+ 1>: mov % esp, % ebp 0x080483c7 <+ 3>: and {1} xfffffff0, % esp 0x080483ca <+ 6>: sub {1} x210, % esp 0x080483d0 <+ 12>: mov 0xc (% ebp), % eax 0x080483d3 <+ 15>: add {1} x4, % eax 0x080483d6 <+ 18>: mov (% eax), % eax 0x080483d8 <+ 20>: mov % eax, 0x4 (% esp) 0x080483dc <+ 24>: lea 0x1c (% esp), % eax 0x080483e0 <+ 28>: mov % eax, (% esp) 0x080483e3 <+ 31>: call 0x80482f4 <strcpy @ plt> 0x080483e8 <+ 36>: mov {1} x0, % eax 0x080483ed <+ 41>: leave 0x080483ee <+ 42>: ret End of worker er dump. (Gdb)

1 2 3 Next Page