How to turn off gcc compiler optimization to enable buffer overflow
I’m working on a homework problem that requires disabling compiler optimization protection for it to work. I’m using gcc 4.4.1 on ubuntu linux, but can’t figure out which flags are are the right ones. I realize it’s architecture dependant – my machine runs w/ 32-bit Intel processor. Thanks. |
|||
That’s a good problem. In order to solve that problem you will also have to disable ASLR otherwise the address of g() will be unpredictable. Disable ASLR:
Disable canaries:
After canaries and ASLR are disabled it should be a straight forward attack like the ones described in Smashing the Stack for Fun and Profit Here is a list of security features used in ubuntu: https://wiki.ubuntu.com/Security/Features You don’t have to worry about NX bits, the address of g() will always be in a executable region of memory because it is within the TEXT memory segment. NX bits only come into play if you are trying to execute shellcode on the stack or heap, which is not required for this assignment. Now go and clobber that EIP! |
|||||||||||||||||
|
Urm, all of the answers so far have been wrong with Rook’s answer being correct. Entering:
Followed by:
Disables ASLR, SSP/Propolice and Ubuntu’s NoneXec (which was placed in 9.10, and fairly simple to work around see the mprotect(2) technique to map pages as executable and jmp) should help a little, however these “security features” are by no means infallible. Without the `-z execstack’ flag, pages have non-executable stack markings. |
|||||||||||||||||||||
|
On newer distros (as of 2016), it seems that PIE is enabled by default so you will need to disable it explicitly when compiling. Here’s a little summary of commands which can be helpful when playing locally with buffer overflow exercises in general: Disable canary:
Disable DEP:
Disable PIE:
Disable all of protection mechanisms listed above (warning: for local testing only):
For 32-bit machines, you’ll need to add the |
||
I know it’s an old thread, but I want to point out that you don’t need to disable ASLR in order to do a buffer overflow! Although ASLR is Enabled(kernel_randomize_va_space = 2) it will not take effect unless the compiled executable is PIE, so unless u compiled your file with -fPIC -pie flag, ASLR will not take effect. I think only disabling the canaries with -fno-stack-protector is enough. If you want to check if ASLR is working or not(Position independent code must be set), use: hardening-check executable_name |
|||
I won’t quote the entire page but the whole manual on optimisation is available here: http://gcc.gnu.org/onlinedocs/gcc-4.4.3/gcc/Optimize-Options.html#Optimize-Options From the sounds of it you want at least
|