How exactly do the exploit pieces connect when bypassing ASLR and DEP using ROP?
It seems like there could be a number of ways. E.g. a full ROP based payload or a ROP payload that modifies a memory location to be executable and writable, which then transfers to the rest of the payload.
I don't get how the stack pivot is setup, as there can be different stack states. How is this done inside the payload?
After the stack pivot is successful, if the process has no non-ASLR modules, how does the payload dynamically build the ROP chain?
I'm missing the connection between
I might be mixing up a few techniques here. Is the information leak needed as part of dynamically building the ROP chain or would that be retrieved first, the ROP offsets in the payload adjusted and then the vulnerability triggered?
If that's the case, would this then have to be a running program in e.g. C that spawns and opens a socket to the vulnerable process, triggers information leak, pipes the output back, adjusts the offsets and then sends the payload? That would work when the attacking program is spawning the vulnerable one, but how would that work against a non child process?