I'm reading about stack overflow protection mechanism like DEP, and it's written that Ret2plt and system() can be used to bypass it.

What is Ret2plt and how does it work? I cannot find a single explanation of this term on google.

  • Presumably PLT is procedure linkage table. So I guess the idea is to use the PLT to run pieces of existing code, similar to how return to libc attacks work. The system call should be very nice for this, since you only need to call a single piece of code with a user defined string to achieve very flexible effects. – CodesInChaos Mar 30 '17 at 9:07
  • yes libc was also menioned, so I suppose it's about what you said. But I don't understand what is meant with "existing code". I mean, you want to execute your own code right, so it's basically not existing yet. – palerna Mar 30 '17 at 9:14

In short, jump to the address of the PLT entry for the function = call the function.

Ret2plt is a similar concept to Ret2libc regarding DEP. DEP/Data Execution Protection works by making some memory non-executable (heap, stack..). This works to prevent code execution if the malicious code is smuggled into those non-executable areas. But if we could call code that has to be executable, like libc code, then it will be executable. At the assembly level we could even pass it our own parameters.

Described here: Rafal Wojtczuk, 1998, return to PLT uses the procedure linkage table to indirectly call libc functions.

The PLT is necessary because library code is not loaded into memory at fixed addresses, usually it is position-independent code (PIC). So procedure calls into shared libraries are made through the PLT. If we return into the PLT, then we are effectively calling those shared libraries linked by the PLT.

The main limitation is that you can only call functions that are already being used by the program, or else they won't have a link in the PLT.

  • Wouldn't the PLT have some function to link additional functions into the PLT? – David Jul 19 '17 at 19:01
  • The PLT doesn't exactly use a function to resolve function addresses in the way you might think it would. The reason linking additional functions is not a simple matter is in the way the dynamic linker arranges the function to perform lazy linking the first time that the function is called. Here's a very brief overview PLT and GOT – trogdor Jul 19 '17 at 19:12
  • I'm not saying it's impossible. But .plt is AX and .got is WX, so I think any additions to plt would have to happen prior to run-time linking – trogdor Jul 19 '17 at 19:20

Your Answer

 
discard

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.