Breaking And Entering Post-ASLR Linux

If an attempt to overflow a buffer or smash the stack fails under Linux; if you have discovered that your expliot variables' addresses are random each time you try to access them, the version of the particular distribution that you are using will, most likely, have a number of protection mechanisms enabled, that are, in turn, hindering your endeavours.


This simple HOW-TO shows how to disable the most vital protections in Linux, in order to allow buffer overflowing, and stack smashing.  The relative protections are listed below, along with how to disable them:

ADDRESS SPACE LAYOUT RANDOMIZATION (ASLR):
Disable:
sudo echo 0 > /proc/sys/kernel/randomize_va_space

Re-Enable:
sudo echo 2 > /proc/sys/kernel/randomize_va_space


EXECUTABLE STACK PROTECTION:
Compile your programs (using gcc) with the '-z execstack' option.  (Without the quotes.)

Example:
gcc -o exploit -z execstack exploit.c


STACK SMASHING PROTECTION:
Compile your programs (using gcc) with the '-fno-stack-protector' option.  (Without the quotes.)

Example:
gcc -o exploit -fno-stack-protector exploit.c


A typical exploitable program would be compiled as:
gcc -o <program> -fno-stack-protector -z execstack <source_file>