Buffer overflow protection in Debian 64-bit kernel?

Question

I hid some shellcode in an environment variable and in the process of trying to overflow the program.

./notesearch $(python -c 'print "\x01\x01\x01\x01\x01\x01\x01\x01" * 15 + "\x9e\xe7\xff\xff\xff\x7f"') 

The hit is that overflow works fine when it starts in GDB, as it throws off my shell. However, outside of GDB, things do not work so smoothly. I disabled ASLR, which initially caused problems until I finally resolved this problem, and now I use the getenv () function to get the exact variable with which I overwhelm the program. I am sure that I completely fill the saved frame, because when I delete the last 6 bytes from the code that I overflow with the program, it does not make any errors,

 ./notesearch $(python -c 'print "\x01\x01\x95\xe6\xff\xff\xff\x7f" * 15') #no seg fault 

however, when I add one byte to the string after this, it means that I have to click on the saved frame pointer with this last byte, as confirmed by GDB.

 ./notesearch $(python -c 'print "\x01\x01\x95\xe6\xff\xff\xff\x7f" * 15 + "\x9e"') # does seg fault 

In any case, I also compiled with gcc notesearch.c -o notesearch -ggdb -fno-stack-protector -z execstack , and as I said, it works in GDB anyway, so I assume it protects the kernel more . Any ideas?

Answer 1

In my experience, that developing an exploit while observing something with gdb, memory biases can suddenly change between a debugged environment and the "real world."

As an assumption, if you just want to choose brute force, try setting offsets between 1 and 8 bytes in either direction. Better yet, try the following:

• Enabling core dumps ( ulimit -c nolimit )
• Create a template from Metasploit using the tools / pattern _create.rb, the size of which you expect what you need or more
• Examine the coredump after it explodes and find out which registers contain template elements.

Armed with this, get precise offsets from the tools / pattern_offset.rb!