4

Mallory has access to a server on the internet. She figures out she can crash it with overly long input. She guesses there is an exploitable buffer overflow. The server software is proprietary and she has no access to the executable. Can she figure out an exploit "blind", without running the server locally in a debugger?

1
  • 6
    Absolutely! There is lots of material on the internet. For example, see this paper. – Arminius Mar 8 '17 at 19:54
2

Yes it's possible against services that restart after a crash as shown in the BROP attack described by Bittau et al (http://www.scs.stanford.edu/brop/). In this attack technique a special ROP Chain is used to write the binary from memory to the socket to simplify the construction of the shellcode.

But if this attack type is possible depends on the type of the vulnerability, the availability of gadgets and if they will be re-randomize after a crash (http://calhoun.nps.edu/bitstream/handle/10945/47979/15Dec_Keener_Lawrence.pdf?sequence=1, Chapter 6).

All together with known techniques it is sometimes possible.

1

It's possible, but extremely unlikely. Under normal circumstances; you'd need to be able to debug the software to properly exploit it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.