Identifying another exploit mitigation and find bypass. stack0: part 2 - bin 0x22

In part 2 we have a closer look at stack0 on a modern system. We are trying to plan an exploit that works in case we can guess the stack cookie. We have to be a bit creative here.

-=[ 🔴 Stuff I use ]=-

-=[ ❤️ Support ]=-

-=[ 🐕 Social ]=-

-=[ 📄 P.S. ]=-

All links with "*" are affiliate links.
LiveOverflow / Security Flag GmbH is part of the Amazon Affiliate Partner Programm.

#BinaryExploitation #BufferOverflow

[TonelessR]

Ah some serious topics now I see, it does inspire some sense of dread because it seems you would need to dedicate quite a lot of time and be serious about security to get any further than toy examples and games, and even then it seems like just a slow start.
Great episode, thanks. :)

[scarlas]

I love this! The bug is as simple as can be and yet the system really resists exploitation. There is no guarantee that it is even possible, which makes it feel much more real. I can't wait to see what hurdles await in the heap and format string challenges.

[adi]

Hi at 03:11 you mention that this is probably a mitigiation technique.

I mean in the end it makes exploitation harder whether it was intended to be a mitigation or not :) . It was just driving me crazy, trying to find the name of this mitigation technique for over an hour until i found out that it actually has no name.


Just thought you or anyone else might appreciate this :) .

[nirshaashua]

great video, really appreciate your work!
i have a question:
if we replace in our script the "RRRR" with b32(0x80484cf) and we accidentally get
esp point to this address will it work as well?

[MarkPentler]

Does the volatile keyword change the order of the variables on the stack? Is that why the simple overflow won't work?

Loving your videos, learning a ton. Thanks!

[WhoAmI-uksr]

Dude, your awsome, I like so so so so so much your content <3 a hug

[maplicant]

Is there something special about stack cookies because brute forcing it requires a seperate episode? A while loop that keeps generating 4 random bytes must be too straightforward. Awesome series by the way!

[MaxPicAxe]

4:55 "We have to get creative" But green is not a creative color

[cyancoyote]

Can't wait for the next episode :)

[nguyenvana]

Hi LiveOverflow,
I have change the eip to correct address (7:12 in your video) of shellcode but shellcode do not execute

[Rhirrim]

Which value is overwritten by The RRRR part? Is it ebp ? I don't really understand the activation record layout

[NikiforGeorgiev]

Would be interesting if you could re-attempt this on even more-modern systems. It seems that in the past 2 years and a half there have been more protection mechanisms added to compilers, so this exploit doesn't really work anymore. Nevertheless still an excellent video! If it makes my brain move I likez

[hackerish]

how da heck did changing esp to R's ensure that esp might land on the stack

[yuvalweber]

on 6:59 you said that ESP don't point to our buffer
why does this happen?.
we didn't overwrite or something like that.

[chonchjohnch]

If the stack cookie’s position is consistent, why not use biteise operators?

[jaime]

I don't understand anything where should I start, other than your first few videos? (I've already watched them numerous times and still understand null)

[gmgurukula]

At 6:28 why is your stack not smashing? you didn't set any break point, also didn't manipulate eip. is the aslr off?

[agnusxendis]

5:26 Maybe you could just always overwrite the last cookie byte with 0 and leave ESP untouched? (eventually after enough tries it will be 0)

[vincenttang]

Do you think it is completely impossible to perform a buffer overflow exploit on a 64 bit system with a stack cookie?

[muhaahaloa]

Love exploit development must have wrote over 30 exploits in my day's..But now
its having the time to put into coding again and reading which i don't have at the
moment...It's a shame there aren't many jobs out there for pentesting unless
you have loads of qualifications..I know people with bachelor's degree and such
in computer tech and still have no idea what a buffer overflow is or any other
vulnerabilities..Why all the down thumbs ??..Oh and if you are going to do exploit
development and find a decent vulnerability don't forget to notify the developers
are you could be looking at some time in jail, Or even a court case against you
for loss of revenue..And one more things that p!ss me off is the arrogance of
some of the developers of applications..Make sure you follow responsible
exploit disclosure guidelines..