Executable stack: flags

Question

I am doing a return2libc attack on my Ubuntu 18.04, X86_64 machine.

For this, i compiled a simple C program with -z execstack to disable the executable stack flag.

Now looking at the flags of the GNU_STACK region (via readelf -a) i get the RWE flags enabled.

The E flag is the exclude flag (says readelf).

I was expecting the X for execute flag. What is the exclude flag, what is it used for and why is there no execute flag? I was browsing a little but couldn't find anything about this topic so thanks in advance for any help.

Edit updated version with readelf -a:

Key to Flags:
  W (write), A (alloc), X (execute), M (merge), S (strings), I (info),
  L (link order), O (extra OS processing required), G (group), T (TLS),
  C (compressed), x (unknown), o (OS specific), E (exclude),
  l (large), p (processor specific)

Es gibt keine Sektionsgruppen in dieser Datei.

Programm-Header:
  Typ            Offset             VirtAdr            PhysAdr
                 DateiGr            SpeiGr              Flags  Ausr.
  PHDR           0x0000000000000040 0x0000000000400040 0x0000000000400040
                 0x00000000000001f8 0x00000000000001f8  R      0x8
  INTERP         0x0000000000000238 0x0000000000400238 0x0000000000400238
                 0x000000000000001c 0x000000000000001c  R      0x1
      [Requesting program interpreter: /lib64/ld-linux-x86-64.so.2]
  LOAD           0x0000000000000000 0x0000000000400000 0x0000000000400000
                 0x00000000000007b0 0x00000000000007b0  R E    0x200000
  LOAD           0x0000000000000e10 0x0000000000600e10 0x0000000000600e10
                 0x0000000000000228 0x0000000000000230  RW     0x200000
  DYNAMIC        0x0000000000000e20 0x0000000000600e20 0x0000000000600e20
                 0x00000000000001d0 0x00000000000001d0  RW     0x8
  NOTE           0x0000000000000254 0x0000000000400254 0x0000000000400254
                 0x0000000000000044 0x0000000000000044  R      0x4
  GNU_EH_FRAME   0x0000000000000620 0x0000000000400620 0x0000000000400620
                 0x000000000000004c 0x000000000000004c  R      0x4
  GNU_STACK      0x0000000000000000 0x0000000000000000 0x0000000000000000
                 0x0000000000000000 0x0000000000000000  RWE    0x10
  GNU_RELRO      0x0000000000000e10 0x0000000000600e10 0x0000000000600e10
                 0x00000000000001f0 0x00000000000001f0  R      0x1

score 0 · Answer 1 · answered Dec 31 '19 at 15:52

The E flag is the exclude flag (says readelf).

There is no such thing as "exclude" flag in ELF, and E stands for "executable".

says readelf

It doesn't say that.

While X is often used for eXecute (e.g. in the output of ls), that isn't a universal convention.

Executable stack: flags

1 Answers1