Buffer Overflow - Ubuntu 18: shellcode in environmental variable
I'm trying to reproduce this tutorial https://blog.techorganic.com/2015/04/10/64-bit-linux-stack-smashing-tutorial-part-1/
I have prepared my vulnerable program (named bofme) and compiled it with no-stack-protector, no-pie, and -z execstack. I have also disabled the ASLR ( echo 0 > sudo tee /proc/sys/kernel/randomize_va_spac ).
After the definition of the environment variable PWN I used this program (https://gist.github.com/superkojiman/6a6e44db390d6dfc329a ) to retrieve its address for the vulnerable binary (getenvaddr PWN ./bofme ) and I got an address.
When I tried to launch the exploit I got a segmentation fault, but then I realized that multiple successive execution of getenvaddr return different addresses for the PWN variable...this makes me confused. Is there any additional protection in Ubuntu 18 other then ASLR?
security environment-variables buffer-overflow ubuntu-18.04
asked Nov 25 '18 at 15:24
Luigi Luigi
11
add a comment |
I'm trying to reproduce this tutorial https://blog.techorganic.com/2015/04/10/64-bit-linux-stack-smashing-tutorial-part-1/
I have prepared my vulnerable program (named bofme) and compiled it with no-stack-protector, no-pie, and -z execstack. I have also disabled the ASLR ( echo 0 > sudo tee /proc/sys/kernel/randomize_va_spac ).
After the definition of the environment variable PWN I used this program (https://gist.github.com/superkojiman/6a6e44db390d6dfc329a ) to retrieve its address for the vulnerable binary (getenvaddr PWN ./bofme ) and I got an address.
When I tried to launch the exploit I got a segmentation fault, but then I realized that multiple successive execution of getenvaddr return different addresses for the PWN variable...this makes me confused. Is there any additional protection in Ubuntu 18 other then ASLR?
security environment-variables buffer-overflow ubuntu-18.04
asked Nov 25 '18 at 15:24
Luigi Luigi
11
I also disable kASLR, but still having the same behavior which is not the one I see in Ubuntu 16 where executinggetenvaddr PWN ./bofmemultiple times always returns the same address.
– Luigi
Nov 26 '18 at 22:42
solved, I cannot figure out why but " echo 0 > sudo tee /proc/sys/kernel/randomize_va_space" do not set randomize_va_space to 0. GDB PEDA, when asked returns ASLR is OFF....nevertheless acat /proc/sys/kernel/randomize_va_spacereturns 2. To solve the problem I had to usesudo sysctl -w /proc/sys/kerne/randomize_va_space=0...
– Luigi
Nov 27 '18 at 13:20
sorry:sudo sysctl -w kernel.randomize_va_space=0
– Luigi
Nov 27 '18 at 15:51
add a comment |
I'm trying to reproduce this tutorial https://blog.techorganic.com/2015/04/10/64-bit-linux-stack-smashing-tutorial-part-1/
I have prepared my vulnerable program (named bofme) and compiled it with no-stack-protector, no-pie, and -z execstack. I have also disabled the ASLR ( echo 0 > sudo tee /proc/sys/kernel/randomize_va_spac ).
After the definition of the environment variable PWN I used this program (https://gist.github.com/superkojiman/6a6e44db390d6dfc329a ) to retrieve its address for the vulnerable binary (getenvaddr PWN ./bofme ) and I got an address.
When I tried to launch the exploit I got a segmentation fault, but then I realized that multiple successive execution of getenvaddr return different addresses for the PWN variable...this makes me confused. Is there any additional protection in Ubuntu 18 other then ASLR?
security environment-variables buffer-overflow ubuntu-18.04
asked Nov 25 '18 at 15:24
Luigi Luigi
11
I'm trying to reproduce this tutorial https://blog.techorganic.com/2015/04/10/64-bit-linux-stack-smashing-tutorial-part-1/
I have prepared my vulnerable program (named bofme) and compiled it with no-stack-protector, no-pie, and -z execstack. I have also disabled the ASLR ( echo 0 > sudo tee /proc/sys/kernel/randomize_va_spac ).
After the definition of the environment variable PWN I used this program (https://gist.github.com/superkojiman/6a6e44db390d6dfc329a ) to retrieve its address for the vulnerable binary (getenvaddr PWN ./bofme ) and I got an address.
When I tried to launch the exploit I got a segmentation fault, but then I realized that multiple successive execution of getenvaddr return different addresses for the PWN variable...this makes me confused. Is there any additional protection in Ubuntu 18 other then ASLR?
security environment-variables buffer-overflow ubuntu-18.04
security environment-variables buffer-overflow ubuntu-18.04
asked Nov 25 '18 at 15:24
Luigi Luigi
11
asked Nov 25 '18 at 15:24
Luigi Luigi
11
asked Nov 25 '18 at 15:24
Luigi Luigi
11
asked Nov 25 '18 at 15:24
Luigi Luigi
11
asked Nov 25 '18 at 15:24
Luigi Luigi
11
11
I also disable kASLR, but still having the same behavior which is not the one I see in Ubuntu 16 where executinggetenvaddr PWN ./bofmemultiple times always returns the same address.
– Luigi
Nov 26 '18 at 22:42
solved, I cannot figure out why but " echo 0 > sudo tee /proc/sys/kernel/randomize_va_space" do not set randomize_va_space to 0. GDB PEDA, when asked returns ASLR is OFF....nevertheless acat /proc/sys/kernel/randomize_va_spacereturns 2. To solve the problem I had to usesudo sysctl -w /proc/sys/kerne/randomize_va_space=0...
– Luigi
Nov 27 '18 at 13:20
sorry:sudo sysctl -w kernel.randomize_va_space=0
– Luigi
Nov 27 '18 at 15:51
add a comment |
I also disable kASLR, but still having the same behavior which is not the one I see in Ubuntu 16 where executinggetenvaddr PWN ./bofmemultiple times always returns the same address.
– Luigi
Nov 26 '18 at 22:42
solved, I cannot figure out why but " echo 0 > sudo tee /proc/sys/kernel/randomize_va_space" do not set randomize_va_space to 0. GDB PEDA, when asked returns ASLR is OFF....nevertheless acat /proc/sys/kernel/randomize_va_spacereturns 2. To solve the problem I had to usesudo sysctl -w /proc/sys/kerne/randomize_va_space=0...
– Luigi
Nov 27 '18 at 13:20
sorry:sudo sysctl -w kernel.randomize_va_space=0
– Luigi
Nov 27 '18 at 15:51
I also disable kASLR, but still having the same behavior which is not the one I see in Ubuntu 16 where executing
getenvaddr PWN ./bofme multiple times always returns the same address.– Luigi
Nov 26 '18 at 22:42
I also disable kASLR, but still having the same behavior which is not the one I see in Ubuntu 16 where executing
getenvaddr PWN ./bofme multiple times always returns the same address.– Luigi
Nov 26 '18 at 22:42
solved, I cannot figure out why but " echo 0 > sudo tee /proc/sys/kernel/randomize_va_space" do not set randomize_va_space to 0. GDB PEDA, when asked returns ASLR is OFF....nevertheless a
cat /proc/sys/kernel/randomize_va_space returns 2. To solve the problem I had to use sudo sysctl -w /proc/sys/kerne/randomize_va_space=0 ...– Luigi
Nov 27 '18 at 13:20
solved, I cannot figure out why but " echo 0 > sudo tee /proc/sys/kernel/randomize_va_space" do not set randomize_va_space to 0. GDB PEDA, when asked returns ASLR is OFF....nevertheless a
cat /proc/sys/kernel/randomize_va_space returns 2. To solve the problem I had to use sudo sysctl -w /proc/sys/kerne/randomize_va_space=0 ...– Luigi
Nov 27 '18 at 13:20
sorry:
sudo sysctl -w kernel.randomize_va_space=0– Luigi
Nov 27 '18 at 15:51
sorry:
sudo sysctl -w kernel.randomize_va_space=0– Luigi
Nov 27 '18 at 15:51
add a comment |
0
active
oldest
votes
Your Answer
StackExchange.ifUsing("editor", function () {
StackExchange.using("externalEditor", function () {
StackExchange.using("snippets", function () {
StackExchange.snippets.init();
});
});
}, "code-snippets");
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "1"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53468969%2fbuffer-overflow-ubuntu-18-shellcode-in-environmental-variable%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
0
active
oldest
votes
0
active
oldest
votes
active
oldest
votes
active
oldest
votes
Thanks for contributing an answer to Stack Overflow!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53468969%2fbuffer-overflow-ubuntu-18-shellcode-in-environmental-variable%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
I also disable kASLR, but still having the same behavior which is not the one I see in Ubuntu 16 where executing
getenvaddr PWN ./bofmemultiple times always returns the same address.– Luigi
Nov 26 '18 at 22:42
solved, I cannot figure out why but " echo 0 > sudo tee /proc/sys/kernel/randomize_va_space" do not set randomize_va_space to 0. GDB PEDA, when asked returns ASLR is OFF....nevertheless a
cat /proc/sys/kernel/randomize_va_spacereturns 2. To solve the problem I had to usesudo sysctl -w /proc/sys/kerne/randomize_va_space=0...– Luigi
Nov 27 '18 at 13:20
sorry:
sudo sysctl -w kernel.randomize_va_space=0– Luigi
Nov 27 '18 at 15:51