Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I was reading about return-to-libc attacks at Wikipedia.

According to what I read and understood from the article, ASCII armoring means that binary data is converted into ASCII values by grouping them into 8-bit chunks.

The article quotes:

Indeed, with ASCII-Armoring, all the system libraries (e.g. libc) addresses contain a NULL byte. Nevertheless, this same concept can be used in a similar and more advanced attack known as return-to-plt, where instead of returning to libc, the attacker uses the PLT functions loaded in the binary (e.g. system@plt, execve@plt, sprintf@plt, strcpy@plt, etc...).

Can someone please explain, how exactly does ASCII armoring prevent buffer overflow? I didn't get the part where it says, that system library addresses contain a NULL byte. And how does return-to-plt prevent buffer overflow? I searched, but didn't find much explanation regarding return-to-plt attacks.

share|improve this question
1  
This is a great article by David Wheeler that should answers all your questions: Secure programmer: Countering buffer overflows. Use of ASCII armor region is explained in the "Non-executing stack defenses" chapter. ;) –  TildalWave May 25 '13 at 15:19
add comment

1 Answer

If the address is getting treated as a null terminated character string at some point, inclusion of this "ASCII-Armored" address would cause functions that work with null terminated character strings such as, strcpy, strlen, sprintf to stop processing at the end of the libc address.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.