Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

In many of the exploits I see nowadays, brute forcing is a common method of bypassing ASLR on 32 bit machines. However, many of these exploits crash the current process, for example, PHP. Isn't the process re-randomized as soon as it crashes and wouldn't this prevent brute force attacks?

share|improve this question
add comment

2 Answers

up vote 0 down vote accepted

Schacham et al. have shown that bypassing ASLR by means of brute force is nothing but a "small slowdown" (see abstract). Even the exploitation of applications running on remote machines is said to be feasible, as long as the service is restarted on crashes.

This attack comes closer to the force part of the term brute force rather than the notion of an exhaustive search, in which would look through the whole address space and determine the correct position. This exhaustive search is, as you correctly said, impossible due to re-randomization.

According to Symantec's Analysis of Windows ASLR, re-randomization might, over time, suffer from low entropy though.

In addition, I'd recommend you exploiting a very simple stack overflow on your local machine. Just write a simple wrapper (script languages come handy in here) and re-run like this:

./stackoverflow (nopslide)(shellcode)(ptr)

..changing the ptr for each run. There are several youtube videos and tutorials available, once you search for 'ASLR brute force', which might give some more hands-on advise.

share|improve this answer
1  
Yeah in Schacham's paper he states that when an Apache process crashes and the parent process fork()s a new child in its place, the child has the same randomization data as before so brute forcing does become more realistic even w/ the 8190 byte request cap Apache imposes. –  Bhubhu Hbuhdbus Jun 26 '12 at 18:28
add comment

I am not aware of a single exploit that using "brute forcing", the chances of this working on a 64 bit linux system is about 1 in 16^8th, which would never happen.

The most common forms of ASLR bypass are Heap Spraying and ROP chains (and there are others). ROP chains being by far the most popular method for exploits found in the wild (which basically means found in metasploit).

share|improve this answer
    
You are completely correct. I should have mentioned the most common forms of ASLR bypasses. Your remark about 64 bit is also important. +1. –  freddyb Jul 6 '12 at 9:54
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.