Userspace : Non executable stack protection

by : ev1lut10n

The non executable stack is a linux patch that makes the stack non 
executable on every
userspace application with stack operation.

check this out :
buggy.c
================
#include <stdio.h>
#include <string.h>
int main(int argc, char **argv) 
{
char buffer[5];
if(argc > 1)
 {
 sprintf(buffer, argv[1]);
 printf(buffer);
 }
printf("\n");
return 0;
}
==================

test it and check:

=========================
$ gcc -o buggy buggy.c
$ readelf -l buggy | grep STACK
  GNU_STACK      0x000000 0x00000000 0x00000000 0x00000 0x00000 RW  0x4
=========================

as we may see the stack is only RW (non executable)

let's  compare to a non executable stack protection elf:
==========
$ gcc -z execstack -o buggy buggy.c
$ readelf -l buggy | grep STACK
  GNU_STACK      0x000000 0x00000000 0x00000000 0x00000 0x00000 RWE 0x4
===========

as u now see if we compile using  -z execstack  it will have an executable 
stack.

so how this non executable stack become barrier on ur userspace 
exploitation ?

recompile using an executable stack protection:
========
$ gcc -o buggy buggy.c
$ readelf -l buggy | grep STACK
  GNU_STACK      0x000000 0x00000000 0x00000000 0x00000 0x00000 RW  0x4
==========

check using gdb
================
(gdb) run AAAAAAAAAAAAAAAAAAAA
The program being debugged has been started already.
Start it from the beginning? (y or n) y

Starting program: /home/mywisdom/c/exploit/buggy AAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAA

Program received signal SIGSEGV, Segmentation fault.
0x00414141 in ?? ()

(gdb) run AAAAAAAAAAAAAAAAAAAAA
The program being debugged has been started already.
Start it from the beginning? (y or n) y

Starting program: /home/mywisdom/c/exploit/buggy AAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAA

Program received signal SIGSEGV, Segmentation fault.
0x08048469 in main () ---------------> eip 

======================
exactly most windows exploiter will use encoding technic, but the problem 
in linux is 
different this is because of the non executable stack protection

how to bypass it ? use return to libc

here's the basic of ret 2 libc
gopher://sdf.org/0/users/wisdomc0/article_exploitation/Eksploitasi_dengan_ret2libc