I'd like to try some shell codes and I want to disable linux protections.
I know I could compile using flags but I know another way exists to disable these protections in general I just can't remember. Can you help me?
Stack protection is done by the compiler (add some extra data to the stack and stash some away on call, check sanity on return). Can't disable that without recompiling. It's part of the point, really...
To expand on what vonbrand has (correctly, +1) said, there are two parts to Linux's stack protection.
Stack canaries are the compiler-enforced feature vonbrand refers to. These can't be disabled without a recompile.
To prove this to yourself and see how they work take the following code:
Now compile that (
As you can guess, that's taking a stack cookie from
There are ways to work around this in terms of writing exploits, but the easy way in terms of building a shellcode test case is to compile your program with
There are some other considerations on modern linux systems. If you take the usual shellcode testing stub:
modern GCC/Linux will map the
If you are going to test a traditional exploit scenario, i.e. my bad code above, with your shellcode then you also need to ensure the stack is executable for the simple casse. The PE file format contains a field for determining whether the stack is executable - you can query and control this with execstack. To enable an executable stack, run
This can be done on arbitrary programs without needing a recompile, but won't automatically disable stack canaries as these are baked in on compile.
Added bonus: aslr:
To turn that off,
Did you just tell someone how to exploit my precious penguin?
No. Any exploit must work around stack canaries (very much non trivial) and either find a program with