0

I have read some articles about bypassing DEP and ASLR , but it seems that they bypass ASLR and DEP by using the instructions in the modules not applying ASLR.But how to bypass ASLR and DEP in the modules applying both this two protection?

1

1 Answer 1

0

Like you said, first ASLR will have to be defeated before any DEP circumvention can be applied. This is usually done by leaking pointers with a separate memory disclosure vulnerability. Then when the location of the code pages is known, the usual technique of a return to libc can be applied.

6
  • How can a leadking pointer with a separate memory disclosure vulnerability used to bypass ASLR?I have seen this question,but I do not understand quite well
    – freedom2
    Feb 23, 2017 at 2:23
  • ASLR is randomization. If you knew the place beforehand, or you could know the layout while performing the exploit, you can adjust your offsets and gain control. The main point is that ASLR does not prevent control of EIP, but tries to make it useless
    – J.A.K.
    Feb 23, 2017 at 7:54
  • 1
    @freedom2 : aslr bypass is only for programs that uses networking : by leaking data to your server or you local program you guess the memory layout and generate an exploit that will cause a jump to the correct address for a rop chain by corrupting allocated size info. If your program doesn’t even perform a dns request, then I think aslr isn’t only a mitigation : it completely prevent remote code execution in the case of buffer overflows security.stackexchange.com/q/154310/36301 (you have to find other kinds of vulnerabilities for code execution). Mar 19, 2017 at 22:55
  • This is incorrect @user2284570. In fact the opposite is true. ASLR is most useful over the network, because infoleaks of that type over the network are rare. For a local attacker, ASLR is actually easy to bypass, e.g. by using timing attacks.
    – forest
    Nov 29, 2017 at 3:53
  • @Baal-zebub : I was talking about remote attacks that can’t use networking. things like buffer ovverun inside a .rar archiver. Nov 29, 2017 at 4:26

Not the answer you're looking for? Browse other questions tagged .