11

I was reading about return-to-libc attacks at Wikipedia.

According to what I read and understood from the article, ASCII armoring means that binary data is converted into ASCII values by grouping them into 8-bit chunks.

The article quotes:

Indeed, with ASCII-Armoring, all the system libraries (e.g. libc) addresses contain a NULL byte. Nevertheless, this same concept can be used in a similar and more advanced attack known as return-to-plt, where instead of returning to libc, the attacker uses the PLT functions loaded in the binary (e.g. system@plt, execve@plt, sprintf@plt, strcpy@plt, etc...).

Can someone please explain, how exactly does ASCII armoring prevent buffer overflow? I didn't get the part where it says, that system library addresses contain a NULL byte. And how does return-to-plt prevent buffer overflow? I searched, but didn't find much explanation regarding return-to-plt attacks.

Improve this question
2

3 Answers 3

Reset to default
7

If the address is getting treated as a null terminated character string at some point, inclusion of this "ASCII-Armored" address would cause functions that work with null terminated character strings such as, strcpy, strlen, sprintf to stop processing at the end of the libc address.

Improve this answer
1

Many buffer overflows in C are the result of carelessly reading a string into a fixed size array without bounds checking.

Strings in C are simply arrays of char, with a 0 or NULL character at the end. Standard library string functions like strcpy simply copy values from one array to another until the NULL character is encountered.

By forcing an attack to include a NULL or 0 byte as the syscall address in the payload, bad string reads are stopped because they think that the string has finally ended.

Remember that the address 0xFFFF00FF is actually four bytes (or chars), one of which is 0x00.

When designing a buffer overflow attack payload with machine bytecode, hackers often need to be clever to avoid having any 0 bytes.

Improve this answer
-1

Most of the time buffer overflows occur when we have strcpy(dest, src) in the source code.
Now, when you give input having null bytes, which you can't avoid because of ascii armor (shown in below input example), the input data after null bytes will be omitted from getting copied to stack area rendering the overflow unsuccessful. Note that target program may still crash.
./a.out $(python -c 'print "A"*20 + "\x08\x40\x12\x00" + "\x08\x40\x12\x12" ')
The values in the above code are only for example.

Improve this answer
4
  • This does not answer the question, which is more than 6 years old and already has answers.
    – A. Hersean
    Jun 11, 2019 at 9:23
  • Yes, the question is 6 years old & I still attempted to answer it as it did't have accepted answer. But how the answer is incorrect. Can you please elaborate?
    – SandeepR
    Jun 11, 2019 at 11:46
  • The question is "how exactly does ASCII armoring prevent buffer overflow? I didn't get the part where it says that system library addresses contain a NULL byte". You do not explain why system library addresses contain a NULL byte when ASCII armored. Moreover, your answer is a rephrasing of the most voted answer, but in less clear terms. An answer to a question of 6 years old is unlikely to get accepted because the original poster is not around anymore.
    – A. Hersean
    Jun 11, 2019 at 12:31
  • You do not explain why system library addresses contain a NULL byte when ASCII armored. I cant see this being asked in the original question. - This is how the ASCII armoring is designed. And it is designed so to make the job of the attacker more difficult. With it, the libraries are mapped in the lower region of RAM where addresses start with 0x00 i.e. NULL bytes. It may look like its rephrasing of the most voted answer but sometimes putting the things in different perspective helps.
    – SandeepR
    Jun 13, 2019 at 4:03

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .