Buffer Overflow Works in GDB but not in Terminal

Question

I am using Mac OSX. I have created a buffer overflow vulnerable program:

#include<stdio.h>
#include<string.h>

int neverCalled() {
    puts("You got me to be called");
    return 0;
}

int main() {
    puts("Name: ");
    char name[64];
    gets(name);
    return 0;
}

I also have created an input file containing 88 "A"s (0x414141...) and 0x700E000001000000

When run in gdb:

(gdb) run < input

I get the output: You got me to be called and then a EXC_BAD_ACCESS error. Meaning that I exploited the program successfully.

When run it in terminal:

$ ./vulnerable < input

I get the output: Segmentation fault: 11 and nothing more.

Why does my buffer overflow work in gdb but fail in normal terminal.

matt · Accepted Answer · 2013-02-18 15:36:26Z

1

gdb on mac os X appears to disable address space layout randomization

http://reverse.put.as/2011/08/11/how-gdb-disables-aslr-in-mac-os-x-lion/

edited Feb 18, 2013 at 15:36

answered Feb 18, 2013 at 15:27

matt

5,7041 gold badge27 silver badges25 bronze badges

Sign up to request clarification or add additional context in comments.

4 Comments

0xC0000022L Over a year ago

Is this a guess or the answer? Sounds logical that this could be the answer of course, but ...

matt Over a year ago

educated guess, no mac here

0xC0000022L Over a year ago

Still +1 for sharing. No Mac here either :)

carloabelli Over a year ago

Any way to disable address space layout randomization on compilation so that this works every time.

fons · Accepted Answer · 2013-02-18 15:33:42Z

0

Why 0x700E000001000000? Your exploit seems to be layout-specific, probably out of what gdb prints when typing "p neverCalled".

This is not guaranteed in all executions. As cabellicar123 correctly pointed out, the layout where libraries and executable are mapped in a process are randomized and not guaranteed to be the same between executions.

For some reason it seems that gdb always gets the same layout. As an exercise include "printf("%p"\n", neverCalled)" somewhere in your program and see how the value changes.

answered Feb 18, 2013 at 15:33

fons

5,1964 gold badges32 silver badges49 bronze badges

Collectives™ on Stack Overflow

Buffer Overflow Works in GDB but not in Terminal

2 Answers 2

4 Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

4 Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related