Linux Stack Protection By Default

Modern gcc compiler (v9.2.0) protects the stack by default and you will notice it because instead of SIGSEGV on stack overflow you will get a SIGABRT, but it also generates coredumps.

In this case the compiler adds the variable local_10. This variable helds a canary value that is checked at the end of the function.
The memset overflows the four bytes stack variable and modifies the canary value.

The 64bits canary 0x5429851ebaf95800 can't be predicted, but in specific situations is not re-generated and can be bruteforced or in other situations can be leaked from memory for example using a format string vulnerability or an arbitrary read wihout overflowing the stack.

If the canary doesn't match, the libc function __stack_chck_fail is called and terminates the prorgam with a SIGABORT which generates a coredump, in the case of archlinux managed by systemd and are stored on "/var/lib/systemd/coredump/"


❯❯❯ ./test 
*** stack smashing detected ***: terminated
fish: './test' terminated by signal SIGABRT (Abort)

❯❯❯ sudo lz4 -d core.test.1000.c611b7caa58a4fa3bcf403e6eac95bb0.1121.1574354610000000.lz4
[sudo] password for xxxx: 
Decoding file core.test.1000.c611b7caa58a4fa3bcf403e6eac95bb0.1121.1574354610000000 
core.test.1000.c611b : decoded 249856 bytes 

 ❯❯❯ sudo gdb /home/xxxx/test core.test.1000.c611b7caa58a4fa3bcf403e6eac95bb0.1121.1574354610000000 -q 

We specify the binary and the core file as a gdb parameters. We can see only one LWP (light weight process) or linux thread, so in this case is quicker to check. First of all lets see the back trace, because in this case the execution don't terminate in the segfaulted return.

We can see on frame 5 the address were it would had returned to main if it wouldn't aborted.

Happy Idea: we can use this stack canary aborts to detect stack overflows. In Debian with prevous versions it will be exploitable depending on the compilation flags used.
And note that the canary is located as the last variable in the stack so the previous variables can be overwritten without problems.




More info

• Hacker Tools List
• Hacker Tool Kit
• What Are Hacking Tools
• Nsa Hack Tools
• Nsa Hack Tools Download
• Nsa Hacker Tools
• Hacker Tool Kit
• Pentest Tools Linux
• Hacker Tool Kit
• Game Hacking
• Pentest Automation Tools
• Hack Tool Apk No Root
• Hacker Tools 2020
• Hacking Tools Name
• Hacking Tools Kit
• Hacking Tools Software
• Pentest Tools Url Fuzzer
• Pentest Tools Linux
• Hacking Tools Kit
• New Hack Tools
• Pentest Tools For Ubuntu
• Pentest Tools Url Fuzzer
• Termux Hacking Tools 2019
• Hack Website Online Tool
• Pentest Tools Find Subdomains
• Kik Hack Tools
• Beginner Hacker Tools
• Blackhat Hacker Tools
• Hack Tool Apk
• Pentest Recon Tools
• Hacker Tools Github
• Hack Tools Online
• Hack Tool Apk No Root
• Hacker Hardware Tools
• Hacker Techniques Tools And Incident Handling
• Hacker Search Tools
• Hacking Tools And Software
• Pentest Tools Website Vulnerability
• Hack Rom Tools
• Pentest Tools Tcp Port Scanner
• Hacking Tools Usb
• Hacker Tools Github
• Hack Website Online Tool
• Pentest Tools Online
• Physical Pentest Tools
• Hacking Tools For Windows 7
• Wifi Hacker Tools For Windows
• Install Pentest Tools Ubuntu
• Hacker Tools List
• Hacking Tools For Games
• Underground Hacker Sites
• Hackers Toolbox
• Hacker Tools Software
• Termux Hacking Tools 2019
• Black Hat Hacker Tools
• Hack Tools