2

Let's say there is a C program that simply takes a string argv[1] and uses sprintf to copy it in a finite buffer. Classic stack buffer overflow. Let's even say the program is more complicated, allowing for techniques like ROP.

But then it's compiled with a stack canary/security cookie, and run on an OS using ASLR and DEP.

Does not the chance to then execute arbitrary shellcode approach 0?

Improve this question
1
  • It gets harder, but not impossible This question discusses getting past a canary. ROP, which you mention is a way to get past DEP. ASLR is another difficulty, but can be brute-forced on a 32-bit system, and there are other weaknesses.
    – paj28
    Commented Sep 7, 2014 at 20:45

1 Answer 1

Reset to default
1

It depends.

DEP blocks you from just doing a jump to esp and executing code there. ASLR is your major important thing to bypass here.

There are a number of ways that you might be able to do this:

  • Modules loaded into the process which don't have ASLR enabled. There are a bunch of ways this might happen:
    • DLLs that are a part of your application which were compiled without the ASLR flag.
    • Injected as part of the AppInit DLLs.
    • Injected by 3rd party applications, e.g. anti-virus or something like xfire / Fraps.
    • Shell handlers loaded alongside shdoclc.dll when you use the standard file dialogs.
  • Fixed-address allocations (e.g. VirtualAlloc with the lpAddress parameter set)
  • Secondary vulnerabilities that allow for memory disclosure or pointer disclosure may be useful in building up an idea of where things are in memory.
  • Corrupting the stack in some way that triggers a secondary issue, e.g. heap corruption. This could then open up other exploitation avenues, using tricks such as heap spraying, heap feng-shui, JIT spraying, etc.
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .