In many of the exploits I see nowadays, brute forcing is a common method of bypassing ASLR on 32 bit machines. However, many of these exploits crash the current process, for example, PHP. Isn't the process re-randomized as soon as it crashes and wouldn't this prevent brute force attacks?

2 Answers 2


Schacham et al. have shown that bypassing ASLR by means of brute force is nothing but a "small slowdown" (see abstract). Even the exploitation of applications running on remote machines is said to be feasible, as long as the service is restarted on crashes.

This attack comes closer to the force part of the term brute force rather than the notion of an exhaustive search, in which would look through the whole address space and determine the correct position. This exhaustive search is, as you correctly said, impossible due to re-randomization.

According to Symantec's Analysis of Windows ASLR, re-randomization might, over time, suffer from low entropy though.

In addition, I'd recommend you exploiting a very simple stack overflow on your local machine. Just write a simple wrapper (script languages come handy in here) and re-run like this:

./stackoverflow (nopslide)(shellcode)(ptr)

..changing the ptr for each run. There are several youtube videos and tutorials available, once you search for 'ASLR brute force', which might give some more hands-on advise.

  • 1
    Yeah in Schacham's paper he states that when an Apache process crashes and the parent process fork()s a new child in its place, the child has the same randomization data as before so brute forcing does become more realistic even w/ the 8190 byte request cap Apache imposes. Jun 26, 2012 at 18:28

I am not aware of a single exploit that using "brute forcing", the chances of this working on a 64 bit linux system is about 1 in 16^8th, which would never happen.

The most common forms of ASLR bypass are Heap Spraying and ROP chains (and there are others). ROP chains being by far the most popular method for exploits found in the wild (which basically means found in metasploit).

  • You are completely correct. I should have mentioned the most common forms of ASLR bypasses. Your remark about 64 bit is also important. +1.
    – freddyb
    Jul 6, 2012 at 9:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.