2

I know that ROP works by using functions in memory. I know that an ROP chain uses "gadgets" that execute tiny snippets of code and returns back to the stack, executing the next gadget. So my question is, how is the stack modified to do this? Do people simply put memory addresses into the stack (probably not)? Does it use functions such as call <mem addr> or ret <mem addr>? Why doesn't DEP prevent the calling of functions from a non-executable stack?

4

Do people simply put memory addresses into the stack (probably not)?

Yes they do put on stack memory addresses to call (invoked by the ret instructions) and empty space (to be consumed by the pop instructions on the way) and variables needed as arguments for functions called via ret.

let's say you have got vulnerable application, which allows attacker to overwrite the stack. Something like:

int function2(arg1,arg2){
      char *buffer[10];
      printf("Crash me now:\n");
      return gets(buffer); 
} 

int main(int argv,char **args){
      function2(arg1,args[0]);   
}
  • and you have DEP enabled which prevents attacker to putting the shellcode directly to stack and execute it from there
  • you are inside some vulnerable function like gets

This is your stack from ESP onwards as when you are in gets function:

    local_var1_of_gets
    local_var2_of_gets
    saved_EBP_of_function2
    saved_return_to_function2

    arg1_to_function2
    arg2_tofunction2
    local_buffer_of_function2
    local_var2_of_function2
    saved_EBP_of_main
    saved_return_to_main

    local_var1_of_main
    local_var2_of_main
    saved_EBP_of_entry0
    saved_return_to_entry0
    argv_to_function_main
    args[0]_to_function_main

So you:

  • write more chars then allocated in the buffer in function2
  • overwrite the "saved_return_to_main" address with the address to first gadget
  • as gets function will call "leave" (to pop the stored EBP - which you will have to guess when overwriting) and ret (to pop the address to first gadget and jump to it)
  • from there you are on your own, what gadgets you put together

Actually the exploits usually target to SEH pointer (as it is easier to hit that one rather than guessing EBP) and go ROP from there.

Why doesn't DEP prevent the calling of functions from a non-executable stack?

Because what you put on stack are just data. The actual code to execute is in the text segment, referenced only as adress to return to from the stack structure when calling the "ret" instruction.

Excellent demonstration from Stephen Sims / SANS SEC660 https://www.youtube.com/watch?v=gDVKdpinhm8

Your Answer

By clicking "Post Your Answer", you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.