Stack protection mechanisms in 4.0+/4.1.2?

[Andrew Haley]

IceDane writes:
 > Hey there.
 > 
 > A course in my school involves exploitation of various vulnerabilities, 
 > such as buffer overflows and format string vulnerabilities and so on.
 > 
 > I'm currently running kbuntu, latest version, which comes with gcc 4.1.2 
 > stock. If I compile a vulnerable program(A simple strcpy of argv[1] to a 
 > small buffer) and then attempt to execute an exploit, no matter what  i 
 > do, it fails.
 > 
 > I realize that the ubuntu gcc 4.1.2 compiles with the -fstack-protector 
 > as default, however, even if I use -fno-stack-protector, the problem 
 > still prevails.
 > 
 > All kernels since 2.6 also come with virtual address space randomization 
 > as default, and I've disabled that.
 > 
 > Anyway, I found something that said if you installed gcc 3.3, you'd be 
 > fine. I try that, and voila, exploit executes accordingly.
 > 
 > Now, I ask - What is it, other than the -fstack-protector flag, which 
 > can disable buffer overflow exploits like that in gcc?

I suspect that the stack layout has changed, and so your exploit no
longer works.  What happened whan you single-stepped through the
exploint injection in gdb?

Andrew.