Let's say there is a C program that simply takes a string argv[1] and uses sprintf to copy it in a finite buffer. Classic stack buffer overflow. Let's even say the program is more complicated, allowing for techniques like ROP.

But then it's compiled with a stack canary/security cookie, and run on an OS using ASLR and DEP.

Does not the chance to then execute arbitrary shellcode approach 0?

  • It gets harder, but not impossible This question discusses getting past a canary. ROP, which you mention is a way to get past DEP. ASLR is another difficulty, but can be brute-forced on a 32-bit system, and there are other weaknesses. – paj28 Sep 7 '14 at 20:45

It depends.

DEP blocks you from just doing a jump to esp and executing code there. ASLR is your major important thing to bypass here.

There are a number of ways that you might be able to do this:

  • Modules loaded into the process which don't have ASLR enabled. There are a bunch of ways this might happen:
    • DLLs that are a part of your application which were compiled without the ASLR flag.
    • Injected as part of the AppInit DLLs.
    • Injected by 3rd party applications, e.g. anti-virus or something like xfire / Fraps.
    • Shell handlers loaded alongside shdoclc.dll when you use the standard file dialogs.
  • Fixed-address allocations (e.g. VirtualAlloc with the lpAddress parameter set)
  • Secondary vulnerabilities that allow for memory disclosure or pointer disclosure may be useful in building up an idea of where things are in memory.
  • Corrupting the stack in some way that triggers a secondary issue, e.g. heap corruption. This could then open up other exploitation avenues, using tricks such as heap spraying, heap feng-shui, JIT spraying, etc.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.