Questions tagged [aslr]

Address Space Layout Randomisation (ASLR) is a technology used to help prevent shellcode from being successful. It does this by randomly offsetting the location of modules and certain in-memory structures.

Filter by
Sorted by
Tagged with
2
votes
1answer
101 views

How do packers/crypters deal with ASLR?

If a packer or crypter is used to obfuscate a piece of executable code, it seems that calls and references made in that code will not be updated at load-time and will be incorrect when the code is ...
5
votes
1answer
228 views

How to hide Kernel Symbols in Linux Kernel Image? Recompliation?

Why hide kernel symbols? Quote Anyone with basic knowledge of kernel exploitation knows how important information gathering is to reliable exploitation. This protection hides the kernel symbols ...
1
vote
1answer
57 views

Security in memory and between local windows processes over localhost

I have a windows application that runs in 2 processes and communicates over localhost network port. This application can hold secrets, such as a web cookie. I'm trying to think through the security ...
4
votes
2answers
586 views

Disable ASLR inside Docker container

I am looking to disable ASLR (address space layout randomization) inside a Docker container. Not sure if it is possible. The container is running on Alpine, but from what I understand, ASLR is a ...
1
vote
1answer
117 views

Backdooring PE binary compiled with ASLR

I'm practicing backdooring PE binary compiled with ASLR in a WOW64 environment. The approach is pretty straightforward and basically is something like this: Find code cave and a hijacking point. In ...
1
vote
1answer
104 views

Does every modern buffer overflow require multiple exploits in end user devices to be utilized?

On modern user oriented devices, such as Android phones, iPhones, PCs(Windows, MacOS, Linux), if there is a remote buffer overflow 0 day, are they only exploitable with the aid of multiple ...
1
vote
1answer
111 views

Why is Address Space Layout Randomization not effective against the Open SSL Heartbleed Vulnerability?

My understanding is that ASLR randomly arranges the key data areas of a process, and so reading contiguously above a buffer as is done in heartbleed would not be enough to achieve the exploit.
1
vote
1answer
275 views

Simple buffer overflow trying to leak address of system()

Code: #include <string.h> void vuln(char *arg) { char buffer[10]; strcpy(buffer, arg); } int main( int argc, char** argv ) { vuln(argv[1]); return 0; } I've determined I ...
2
votes
1answer
90 views

How to exploit buffer overflow without space after return address?

I'm working on a binary exploitation challenge where the target (ELF/x86_64) has stack canaries, NX and PIE enabled. It implements a simple forking TCP server. After a connection is established, it ...
2
votes
0answers
295 views

Buffer overflow return address with null byte, workaround

I'm practicing Buffer Overflows using Free Float FTP Server 1.0 on Windows 7 SP 1. I have done simple jmp esp examples on Windows XP, where system DLLs are without rebase or Address Space Layout ...
3
votes
2answers
134 views

Is it safe to deploy software without memory protections such as DEP/ASLR?

Several software packages on our SOE Windows machines come with DEP and ASLR memory protections off by default. More troubling is that these applications run as SYSTEM and load their own drivers. ...
3
votes
1answer
78 views

Why is ASLR not performed at less than page granularity?

What technical reasons are preventing ASLR from being randomized to a byte offset? On Linux it's to a 4kb page and on Windows to a 64kb region.
2
votes
1answer
754 views

Bypassing ASLR using information leaks

Most of my questions were answered in this post ASLR bypass with info leak However, I just want to know the process of getting the memory address from the information leak to then using it in the ...
3
votes
0answers
75 views

Do programs run in Linux in Wine benefit from DEP and ASLR?

Do programs run in Linux in Wine benefit from mitigation techniques DEP and ASLR?
1
vote
2answers
146 views

How is executable shellcode inserted?

How is shellcode (the payload) added to an executable file? Assume it is close source. How does the hacker then get the address of where it is? They need this for when they overwrite the return ...
1
vote
1answer
152 views

Why would modern OS allocate static addresses or why is ASLR still needed?

I have a question about ASLR which allocates randomized addresses for things. Based on my understanding (which might be wrong), a modern OS has pretty complicated memory management mechanisms and it ...
2
votes
1answer
292 views

the state of ASLR, PIE, SSP on Debian in 2018?

As far as I remember, most Debian Wheezy packages were not compiled with those useful security flags (ASLR, PIE, SSP, and more). Did the situation improve with Debian Squeeze or the upcoming Debian ...
1
vote
1answer
621 views

BOF - How to determine adress of system() using a leak memory?

I am training myself for BOF and ASLR in 32Bits. I wrote a program that seems like this : int main(int argc, char **argv) { char buffer[32]; printf(argv[1]); gets(buffer); return 0; }...
3
votes
0answers
458 views

Full ASLR and ROP

How exactly do the exploit pieces connect when bypassing ASLR and DEP using ROP? It seems like there could be a number of ways. E.g. a full ROP based payload or a ROP payload that modifies a memory ...
3
votes
0answers
137 views

Is the difference between a loaded elf and libc a constant value?

While doing binary exploitation and studying the case when ASLR is enabled, I noticed I could make a reliable exploit by leaking an address of a function in the binary and finding the address of ...
2
votes
1answer
615 views

how did the meltdown attack break KASLR in 128 steps for a target machine with 8GB RAM with 40bit randomization on a 64bit machine?

In the meltdown official paper released the authors broke the KASLR with 128 steps at worse. Unable to understand how did they come down to that number Paper for reference
0
votes
1answer
5k views

How to leak libc base address using format string exploit

I've been trying for some time to write an exploit to a very simple program which has a format string and a buffer overflow vulnerability. This program has NX, SSP and ASLR. #include <stdio.h> ...
3
votes
2answers
855 views

How does ASLR protect libc entry points?

ASLR randomizes the addresses of the process executable code, stack, heap and libraries. This is to make the life of an attacker difficult as they cannot hardcode addresses in the code across multiple ...
2
votes
0answers
366 views

Detect kASLR/ASLR within a Linux firmware image without running it

I'm currently looking into exploit mitigation techniques and I've come across a question I can't find an answer to just now. To detect the presence of let's says PIE or Canaries within a binary there ...
1
vote
0answers
76 views

Fedora 3 Disable Address Randomization

I want to disable address space layout randomization on my Fedora 3 virtual machine. I tried to go to /proc/sys/kernel/randomize_va_space. Unlike normal Linux machine, such a file doesn't exist on ...
2
votes
2answers
124 views

Software overflow exploitation lab

Working through a binary exploitation course posted by RPI a few years ago. Currently on the ASLR lab and having some trouble with it (although not with the parts related to ASLR). I can't figure out ...
8
votes
1answer
2k views

ASLR bypass with info leak

Working through the Modern Binary Exploitation course from RPI here. I'm having trouble with an example on exploiting ASLR which is supposed to use a memory leak to gain information about the stack to ...
8
votes
2answers
922 views

Trouble building a ROP chain

I am trying to exploit a small program. The program looks somewhat like this: int func(void) { char text[100]; scanf("%s", text); return 0; } int foo(unsigned short rand) { char ...
3
votes
3answers
767 views

EternalBlue exploit and ASLR

Why is the EternalBlue exploit so successful when ASLR is likely enabled on modern machines? I may be wrong as i'm not familiar with windows internals. I can't find any explanation on this including ...
0
votes
1answer
661 views

Why are stack address the same all the time when not using ASLR? [closed]

In an answer to How do ASLR and DEP work? Polynomial says: In a non-ASLR and non-DEP process, the stack address is the same every time we run the process. We know exactly where it is in memory. I ...
2
votes
0answers
202 views

Disabling Android mediaserver (/system/bin/mediaserver) ASLR

I was able to successfully disable ASLR in Kernel on my Android mobile (Cyanogenmod). root@s3ve3g:/system # echo 0 > /proc/sys/kernel/randomize_va_space root@s3ve3g:/system # cat /proc/sys/kernel/...
1
vote
0answers
199 views

Does aslr definitely end the possibility of code execution in the case of filesystems heap overflows?

Local only Filesystems (like ntfs or btrfs) consists of many data structures that require very complex code for parsing them. So, such filesystems if implemented in user space can suffer of buffer ...
4
votes
2answers
4k views

Is ASLR useless in preventing attacks such as return-to-libc in linux?

If i'm correct, due ASLR we load libc into some random address. And then in order to make that happen without allowing write permissions of text pages within memory we use plt/got. Now I can simply ...
0
votes
1answer
3k views

How to bypass DEP and ASLR at the same time? [duplicate]

I have read some articles about bypassing DEP and ASLR , but it seems that they bypass ASLR and DEP by using the instructions in the modules not applying ASLR.But how to bypass ASLR and DEP in the ...
3
votes
1answer
61 views

Why code memory pages should be readable?

I understand that each instruction should be read into CPU for execution, which probably is the reason why code pages should be "r-x". But my observation is that the behavior of reading code into ...
6
votes
1answer
578 views

ASLR in Linux does not randomize libraries separately

I was trying out how ASLR works in Centos 7.2.1115 x86_64 specifically. Here are my /proc/$pid/maps dumps from two runs of Firefox (on Pastebin): #1 #2 Basically, ASLR works. It randomizes .data and ...
2
votes
1answer
470 views

Would it be sufficient to perform ASLR by randomizing only the base address of the executable?

According to Wiki, ASLR randomly arranges the address space positions of key data areas of a process, including the base of the executable and the positions of the stack, heap and libraries. ...
1
vote
1answer
384 views

Trying to understand ASLR in Ubuntu 16.04

Has something changed here? No matter whether I set randomize_va_space, the stack will always have an offset of 0. Afaik it should be a random number, right? .... f7fd8000-...
1
vote
0answers
64 views

Researchers Bypass ASLR Protection on Intel Haswell CPUs [closed]

See Softpedia and research paper. Could we somehow prevent this attack on various OS?
3
votes
3answers
246 views

Cost-benefit analysis of ASLR

I want to evaluate whether it's worth it to add ASLR to a proprietary operating system. This OS runs multiple applications that don't trust each other and exchanges data over the network, so the ...
4
votes
1answer
652 views

Why is Linux ASLR weak?

Wikipedia says Linux kernel has a weak form of ASLR by default and only adding PaX or Exec Shield patches enables complete ASLR. What is the weakness of default ASLR in Linux kernel? Has it been ...
1
vote
1answer
1k views

How to turn off ASLR under Windows? [closed]

I'm experimenting a bit with formatstring attacks with a little program (all vulnerabilities intended): #include <stdio.h> int main(int argc, char *argv[]) { char string[100]; gets(...
1
vote
1answer
339 views

Is the FIPS module of openSSL with fixed base address a security risk?

The latest openSSL library has a FIPS module which needs to be built with a fixed base address to be called FIPS compliant. The rationale behind this is that having a fixed base address enables them ...
7
votes
1answer
1k views

Are Heap addresses randomized by ASLR?

I have been reading this article about an Internet Explorer exploit and I am a little confused about why the memory addresses effected by the heap-spray "work". The paper states that the attack uses ...
5
votes
1answer
2k views

How can I partially overwrite the EIP in order to bypass ASLR?

As far as I know, it is possible to overwrite the unchanged part of the EIP to bypass ASLR protection. Unfortunately, I do not understand how this can help me in order to jump to the location of my ...
5
votes
3answers
893 views

Did CVE-2016-2324 allowed remote code execution?

Let’s say I have this kind of code : // In revision.c char *path_name(const struct name_path *path, const char *name) // by design, name_path->len is a 32 bits int, but this doesn’t concern name { ...
1
vote
1answer
718 views

how to circumvent ASLR without pointer leaks

is there way to circumvent ASLR without pointer leaks, I mean i read many exploit development course Syllabus and many of them talk about bypass ASLR without pointer leaks, Does anyone can explain to ...
12
votes
2answers
2k views

Compiling a buffer overflow example in modern Linux?

I'm trying to compile a simple buffer overflow example on a Debian i386 VM. The executable builds ok, but EIP does not get overwritten correctly despite being supplied a sufficiently large input to ...
1
vote
0answers
349 views

NX + ASLR bypass - troubles with return address of .bss

I have one problem, while doing NX + ASLR bypass. I'm going through this tutorial step-by-step. Everything is going well, I have prepared my exploit, just with another address and some small ...
8
votes
0answers
932 views

Limited Buffer Size for shellcode on 64 bits machine

I have a code snippet which has the classic strcpy vulnerability int main(int argc, char argv[][]){ char buffer[8]; strcpy(buffer, argv[1]); } By disassembling the binary file, we can see ...