Basic¶
Check file¶
$ file stack-five
stack-five: setuid, setgid ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /opt/phoenix/x86_64-linux-musl/lib/ld-musl-x86_64.so.1, not stripped
contoh informasi yang dapat diperoleh
- file ELF 64-bit
- dynamically linked
- interpreter
- not stripped
Checksec¶
$ checksec --file=stack-five
RELRO STACK CANARY NX PIE RPATH RUNPATH Symbols FORTIFY Fortified Fortifiable FILE
No RELRO No canary found NX disabled No PIE RW-RPATH No RUNPATH 56 Symbols No 0 1 stack-five
- Position Independent Executable (PIE): a binary and all of its dependencies are loaded into random locations within virtual memory each time the application is executed, randomize location
- Partial RELRO — some sections of the binary are read-only, preventing them from being modified
- Stack Canary — a value written on the stack which is later checked to ensure it has not been overwritten; used to detect buffer overflows
- Non-Executable Stack (NX) — a memory protection mechanism used to prevent shell code located within the stack from being executed, preventing shell code execution
Shellcode¶
https://shell-storm.org/shellcode/