c - PaX 和缓冲区溢出

Question

在内核中有 PaX 的 linux 中是否可能溢出缓冲区。我想通过使用正确的输入更改返回地址来利用可执行文件。我使用的是 Ubuntu 10.04，我使用 paxtest 对其进行了测试，但我不知道结果是什么意思。这是我系统上 paxtest 的结果:

Executable anonymous mapping             : KilledExecutable bss                           : KilledExecutable data                          : KilledExecutable heap                          : KilledExecutable stack                         : KilledExecutable anonymous mapping (mprotect)  : VulnerableExecutable bss (mprotect)                : VulnerableExecutable data (mprotect)               : VulnerableExecutable heap (mprotect)               : VulnerableExecutable shared library bss (mprotect) : VulnerableExecutable shared library data (mprotect): VulnerableExecutable stack (mprotect)              : VulnerableAnonymous mapping randomisation test     : 12 bits (guessed)Heap randomisation test (ET_EXEC)        : 13 bits (guessed)Heap randomisation test (ET_DYN)         : 14 bits (guessed)Main executable randomisation (ET_EXEC)  : 12 bits (guessed)Main executable randomisation (ET_DYN)   : 12 bits (guessed)Shared library randomisation test        : 12 bits (guessed)Stack randomisation test (SEGMEXEC)      : 19 bits (guessed)Stack randomisation test (PAGEEXEC)      : 19 bits (guessed)Return to function (strcpy)              : VulnerableReturn to function (strcpy, RANDEXEC)    : VulnerableReturn to function (memcpy)              : VulnerableReturn to function (memcpy, RANDEXEC)    : VulnerableExecutable shared library bss            : VulnerableExecutable shared library data           : KilledWritable text segments                   : Vulnerable

Answer 1

是的，你可以。查看行:

    Return to function (strcpy)              : Vulnerable
    Return to function (strcpy, RANDEXEC)    : Vulnerable

唉，我的学校项目是使用 grsecurity 来防止这样的攻击。 PaX 没有阻止我覆盖返回地址。