5

I'm reading about stack overflow protection mechanism like DEP, and it's written that Ret2plt and system() can be used to bypass it.

What is Ret2plt and how does it work? I cannot find a single explanation of this term on google.

Improve this question
2
  • Presumably PLT is procedure linkage table. So I guess the idea is to use the PLT to run pieces of existing code, similar to how return to libc attacks work. The system call should be very nice for this, since you only need to call a single piece of code with a user defined string to achieve very flexible effects.
    – CodesInChaos
    Commented Mar 30, 2017 at 9:07
  • yes libc was also menioned, so I suppose it's about what you said. But I don't understand what is meant with "existing code". I mean, you want to execute your own code right, so it's basically not existing yet.
    – palerna
    Commented Mar 30, 2017 at 9:14

1 Answer 1

Reset to default
3

In short, jump to the address of the PLT entry for the function = call the function.

Ret2plt is a similar concept to Ret2libc regarding DEP. DEP/Data Execution Protection works by making some memory non-executable (heap, stack..). This works to prevent code execution if the malicious code is smuggled into those non-executable areas. But if we could call code that has to be executable, like libc code, then it will be executable. At the assembly level we could even pass it our own parameters.

Described here: Rafal Wojtczuk, 1998, return to PLT uses the procedure linkage table to indirectly call libc functions.

The PLT is necessary because library code is not loaded into memory at fixed addresses, usually it is position-independent code (PIC). So procedure calls into shared libraries are made through the PLT. If we return into the PLT, then we are effectively calling those shared libraries linked by the PLT.

The main limitation is that you can only call functions that are already being used by the program, or else they won't have a link in the PLT.

Improve this answer
3
  • Wouldn't the PLT have some function to link additional functions into the PLT?
    – David
    Commented Jul 19, 2017 at 19:01
  • The PLT doesn't exactly use a function to resolve function addresses in the way you might think it would. The reason linking additional functions is not a simple matter is in the way the dynamic linker arranges the function to perform lazy linking the first time that the function is called. Here's a very brief overview PLT and GOT
    – flerb
    Commented Jul 19, 2017 at 19:12
  • I'm not saying it's impossible. But .plt is AX and .got is WX, so I think any additions to plt would have to happen prior to run-time linking
    – flerb
    Commented Jul 19, 2017 at 19:20

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .