SoHoaToanDien

Modern gcc compiler (v9.2.0) protects the stack by default and you will notice it because instead of SIGSEGV on stack overflow you will get a SIGABRT, but it also generates coredumps.

In this case the compiler adds the variable local_10. This variable helds a canary value that is checked at the end of the function.
The memset overflows the four bytes stack variable and modifies the canary value.



The 64bits canary 0x5429851ebaf95800 can't be predicted, but in specific situations is not re-generated and can be bruteforced or in other situations can be leaked from memory for example using a format string vulnerability or an arbitrary read wihout overflowing the stack.

If the canary doesn't match, the libc function __stack_chck_fail is called and terminates the prorgam with a SIGABORT which generates a coredump, in the case of archlinux managed by systemd and are stored on "/var/lib/systemd/coredump/"


❯❯❯ ./test 
*** stack smashing detected ***: terminated
fish: './test' terminated by signal SIGABRT (Abort)
❯❯❯ sudo lz4 -d core.test.1000.c611b7caa58a4fa3bcf403e6eac95bb0.1121.1574354610000000.lz4
[sudo] password for xxxx: 
Decoding file core.test.1000.c611b7caa58a4fa3bcf403e6eac95bb0.1121.1574354610000000 
core.test.1000.c611b : decoded 249856 bytes 

 ❯❯❯ sudo gdb /home/xxxx/test core.test.1000.c611b7caa58a4fa3bcf403e6eac95bb0.1121.1574354610000000 -q 

We specify the binary and the core file as a gdb parameters. We can see only one LWP (light weight process) or linux thread, so in this case is quicker to check. First of all lets see the back trace, because in this case the execution don't terminate in the segfaulted return.




We can see on frame 5 the address were it would had returned to main if it wouldn't aborted.



Happy Idea: we can use this stack canary aborts to detect stack overflows. In Debian with prevous versions it will be exploitable depending on the compilation flags used.
And note that the canary is located as the last variable in the stack so the previous variables can be overwritten without problems.

Related links

1. Hack Tool Apk
2. Pentest Tools Online
3. Hackers Toolbox
4. Pentest Tools Website
5. Termux Hacking Tools 2019
6. Blackhat Hacker Tools
7. Pentest Tools Tcp Port Scanner
8. Hacking Tools Hardware
9. Nsa Hacker Tools
10. Pentest Tools Website
11. Kik Hack Tools
12. Hacking Tools And Software
13. Termux Hacking Tools 2019
14. Pentest Tools Tcp Port Scanner
15. Hacking Tools Windows 10
16. Hacking Tools Github
17. Pentest Tools Bluekeep
18. Hacker Tools Hardware
19. Beginner Hacker Tools
20. Pentest Recon Tools
21. Hacking Apps
22. Hack Apps
23. Hacking Tools Online
24. Hacking Tools For Pc
25. Black Hat Hacker Tools
26. Physical Pentest Tools
27. Nsa Hack Tools
28. Hacking Tools 2019
29. Hacking Tools Windows
30. Hacking Tools 2020
31. How To Hack
32. Hacking Tools For Kali Linux
33. Hacking Tools Github
34. Hacker Tools Mac
35. Hacking Apps
36. Hacker Tools Free
37. Hacker Tools List
38. World No 1 Hacker Software
39. Hackrf Tools
40. Pentest Tools Nmap
41. Hacker Tools For Mac
42. Hack Tools 2019
43. Hacking Tools Usb
44. Best Pentesting Tools 2018
45. Hacking Tools And Software
46. Hacker Tools For Windows
47. Pentest Tools Github
48. Hacker Tools Mac
49. Hacking Tools Mac
50. Underground Hacker Sites
51. Hack Tools For Pc
52. How To Make Hacking Tools
53. Hacking Tools For Games
54. Hacking Tools Software
55. Hacking Tools For Pc
56. Hacker Security Tools
57. Top Pentest Tools
58. Pentest Tools
59. Pentest Tools
60. Hack Website Online Tool
61. Pentest Tools Online
62. Free Pentest Tools For Windows
63. Github Hacking Tools
64. Hacking Tools For Mac
65. Tools Used For Hacking
66. Pentest Tools For Windows
67. Pentest Recon Tools
68. Pentest Tools Online
69. Hacker Tools
70. Hacker Hardware Tools
71. Hack Tools For Mac
72. Hacker Tools For Windows
73. Hack Tools Download
74. Hack Tools Download
75. Hack Tools Download
76. Hacking Tools For Windows Free Download
77. Hacking Tools Kit
78. Hacker
79. Hacking Tools For Kali Linux
80. Pentest Tools Online
81. Hack Tools For Mac
82. Hacker Tools Free Download
83. Hack Tools For Ubuntu
84. What Are Hacking Tools
85. Underground Hacker Sites
86. Hacker Search Tools
87. Hacking Tools For Kali Linux
88. Hacking Tools
89. Hacking Tools For Kali Linux
90. Best Pentesting Tools 2018
91. Pentest Recon Tools
92. Hacker Tools Linux
93. Hacking Tools Windows 10
94. Hacking Tools Pc
95. Hacker Tools Linux
96. Hacker Tools Apk
97. Hacking Tools For Kali Linux
98. Best Hacking Tools 2019
99. Best Hacking Tools 2019
100. Hacking Tools Mac
101. Pentest Tools For Android
102. Hackrf Tools
103. Hacking Tools Pc
104. Pentest Tools Kali Linux
105. Hacker Tool Kit
106. Top Pentest Tools
107. Hak5 Tools
108. Pentest Tools Open Source
109. Hacking Tools For Kali Linux
110. Hacker Tools
111. Hacker Security Tools
112. Hacking Tools Name
113. Pentest Tools Find Subdomains
114. Hack Tools Github
115. Hacking Tools For Games
116. What Is Hacking Tools
117. Hack Tool Apk
118. Hacking Tools Name
119. Bluetooth Hacking Tools Kali
120. Hacking Tools Free Download
121. Hacker Tools Free Download
122. Hackrf Tools
123. Hacker Tools Free
124. Pentest Box Tools Download
125. Pentest Reporting Tools
126. Pentest Tools For Android
127. Pentest Tools Bluekeep
128. Hacker Tools For Pc
129. Hacker Tools List
130. Hacking Tools Name
131. Hacker Tools For Ios
132. Hack Rom Tools