BYPASSING STACKGUARD AND STACKSHIELD - tutorial RACL

RACL −> tutorial −> esterni −> BYPASSING STACKGUARD AND STACKSHIELDBYPASSING STACKGUARD AND STACKSHIELD − − P H R A C K M A G A Z I N E − Volume 0xa Issue 0x38Pubblicato da Bulba and Kil3r il 05/01/2000Livello avanzatoIntroduzione−−−−| Preface"When a buffer overwrites a pointer... The story of a restless mind."This article is an attempt to demonstrate that it is possible to exploit stack overflow vulnerabilities on systems secured byStackGuard or StackShield even in hostile environments (such as when the stack is non−executable).Iniziamo−−−−| StackGuard OverviewAccording to its authors, StackGuard is a "simple compiler technique that virtually eliminates buffer overflow vulnerabilities withonly modest performance penalties." [1]We assume that the reader know how buffer overflow attacks work and how to write exploit code . If this is foreign to you, pleasesee P49−14.In a nutshell, we can change a function's return address by writing past the end of local variable buffer. The side effect of alteringa function's return address is that we destroy/modify all stack data contained beyond end of the overflowed buffer.What does StackGuard do? It places a "canary" word next to the return address on the stack. If the canary word has been alteredwhen the function returns, then a stack smashing attack has been attempted, and the program responds by emitting an intruderalert into syslog, and then halts.Consider the following figure:... .. ...