1. Use Stack Protector All (stack Canaries For Macbook Pro
2. Use Stack Protector All (stack Canaries For Mac Os
3. Use Stack Protector All (stack Canaries For Macular Degeneration
4. Use Stack Protector All (stack Canaries For Macs

In this tutorial, we will explore a defense mechanism againststack overflows, namely the stack canary. It is indeedthe most primitive form of defense, yet powerful and performant,so very popular in most, if not all, binariesyou can find in modern distributions. The lab challenges showcasea variety of designs of stack canaries, and highlight their subtlepros and cons in various target applications.

It's a bit stronger than -fstack-protector without a random canary value, but I wouldn't call it 'strong' per se. It is trivial for any malicious hacker to get the random canary value at runtime from the stack and use it in the stack smashing attack to bypass the protection. 'strong' would indicate that it will not be trivial to bypass it. Fstack-protector-all option adds a canary to all func-tions. However, it can incur a substantial use of stack space and run-time overhead in complex programs. The -fstack-protector-strong option provides a bet-ter trade-off between function coverage, run-time perfor-mance, and memory cost of stack canaries. It adds a canary. Fstack-protector: enables stack protection for vulnerable functions that contain buffers larger than 8 bytes. This includes functions that call “alloca”.-fstack-protector-all adds stack protection to all functions.-fstack-protector-strong: like -fstack-protector. But it includes additional functions that have local array definitions,. Stack canaries can greatly increase the difficulty of exploiting a stack buffer overflow because it forces the attacker to gain control of the instruction pointer by some non-traditional means such as corrupting other important variables on the stack. Built with option -fstack-protector'.

Step 0. Revisiting 'crackme0x00'

This is the original source code of the crackme0x00 challengethat we are quite familiar with:

We are going to compile this source code into four different binarieswith the following options:

There are a few interesting compilation options that we used:

1. -fno-stack-protector: do not use a stack smashing protector
2. -z execstack: make its stack 'executable'

So we name each binary with the following convention:

Step 1. Let's crash the 'crackme0x00' binary

crackme0x00-nossp-exec behaves exactly same as crackme0x00. Notsurprisingly, it crashes with a long input:

What about crackme0x00-ssp-exec compiled with a stack smashing protector?

The 'stack smashing' is detected so the binary simply prevents itselffrom an exploitation; resulting in a crash instead of being hijacked.

You might want to run gdb to figure out what's going on with this binary:

Step 2. Let's analyze!

To help you figure out how two binaries are different,we (so kind!) provide you with a script, ./diff.shthat compares two binaries and shows the differences.

Two notable differences are at the function prologue and the epilogue.In the ssp-enabled binary, there is an extra value (%gs:0x14)placed right after the frame pointer on the stack:

And the binary validates if the inserted value remains the sameright before the function returns to its caller:

__stack_chk_fail_local() is the function you observed in the gdb's backtrace.

Step 3. Stack Canary

This extra value is called, 'canary' (a bird, umm why?). Moreprecisely, what are these values?

Did you notice the canary value changes whenever you run the binary?This is great because attackers have to guess the canary valuebefore each exploitation attempt in order to bypass the stack protectionmechanism.

Use Stack Protector All (stack Canaries For Macbook Pro

Step 4. Bypassing Stack Canary

However, what if the stack canary implementation is not 'perfect',meaning that an attacker might be able to guess the value(i.e., %gs:0x14)?

Use Stack Protector All (stack Canaries For Mac Os

Let's check out target-ssp binary:

A stronger (better) canary implementation would usea randomly generated (gs:0x14) value as a canary like the following:

However, the target binary's implementation usesa known value (i.e., 0xdeadbeef) as a stack canary:

Use Stack Protector All (stack Canaries For Macular Degeneration

So, the stack should be like:

[Task] How could we exploit this program, like the last week's tutorial,and get the flag?

Use Stack Protector All (stack Canaries For Macs

Reference