Questions tagged [aslr]

Address Space Layout Randomisation (ASLR) is a technology used to help prevent shellcode from being successful. It does this by randomly offsetting the location of modules and certain in-memory structures.

Filter by
Sorted by
Tagged with
0 votes
0 answers
44 views

How does ASLR work [duplicate]

I have read about ASLR and understand that it randomizes the location in memory where an executable is loaded every time it is run. But I have a doubt, take an example of an elf executable. It tells ...
user avatar
  • 1
1 vote
0 answers
72 views

OpenSSL 1.0.2, for 32 bit FIPS, is doing a base-address verification. Where and how is that implemented?

We build OpenSSL in FIPS mode, to be used as a DLL. According to the OpenSSL FIPS module (https://www.openssl.org/docs/fips/UserGuide-1.2.pdf), we supply a parameter to the compiler --with-baseaddr=...
user avatar
  • 11
4 votes
2 answers
440 views

Are buffer overflow and similar attacks still possible?

The majority of my cyber security background comes in the form of web application vulnerability testing, and whilst I do have a degree of prior experience in studying and performing application ...
user avatar
1 vote
1 answer
293 views

How to exploit with Control over return address and knowing the address of printf

I have this program that uses ASLR and it leaks information when i overflow a buffer, namely the address of printf. Furthermore i can overwrite the return address. How can i use this to spawn a shell? ...
user avatar
0 votes
1 answer
164 views

Fixed offset in linux ASLR?

I just printed function addresses and offset between two functions, but the offset is fixed whenever the program is executed (base address is only changed). Code (test.c) #include <stdio.h> #...
user avatar
2 votes
1 answer
134 views

Does recompiling a binary from source code make it more secure/obscure?

Using standard hardening options like PIC, Stack Protection ... does a mere recompilation make a program more secure against attacks? You have the source code of a program, compile it two times with ...
user avatar
2 votes
1 answer
283 views

Buffer overflow outside gdb

I'm trying to exploit a basic C program (below) which I've written: #include <stdio.h> #include <string.h> void main() { char ch[10]; scanf("%s", ch); if(strcmp(&...
user avatar
1 vote
1 answer
173 views

Is a single infoleak enough to break ASLR if you don't have access to the binary?

With a single infoleak and access to the binary you can calculate the other addresses. Is this still possible when you don't have access to the binary?
user avatar
  • 11
1 vote
1 answer
125 views

ROP on MIPS Doesn't Land Where Calculated

I am working on exploiting an application on MIPS to further my knowledge of ROP chaining. The library I am trying to build a ROP chain is libuClibc-0.9.30.3.so. I found a gadget that I want to use ...
user avatar
  • 121
1 vote
2 answers
371 views

How does ASLR work if in the assembly code the addresses are the same

Let's say I have this piece of code that changes the 10 address to the value 20 and the following one to 30 mov ebx,10 mov [ebx],20 add ebx,1 mov ebx,30 How can the address change each time it is ...
user avatar
  • 13
0 votes
3 answers
639 views

Is it safe to use non-ASLR DLL in an enabled ASLR EXE

Is it safe to use non-ASLR DLL in an enabled ASLR EXE? Would the DLL be loaded to and will use random addressed, or should all the dependencies enable ASLR? In addition, what about other security ...
user avatar
0 votes
1 answer
252 views

ASLR doesn't work?

I have following code: #include <stdio.h> #include <stdlib.h> int main() { int *ptr1 = malloc(16); int val1 = 0x12345678; printf("stack: %p\nheap: %p\n", &...
user avatar
10 votes
1 answer
274 views

Importance of ASLR Mode 2

From what I understand, ASLR has 3 Modes: 0 - turned off 1 - randomizes stack, heap, shared libraries, vDSO, mmap memory area and text area (if built with -fPIE -pie) 2 - additionally randomizes brk()...
user avatar
  • 103
2 votes
1 answer
199 views

How do packers/crypters deal with ASLR?

If a packer or crypter is used to obfuscate a piece of executable code, it seems that calls and references made in that code will not be updated at load-time and will be incorrect when the code is ...
user avatar
5 votes
1 answer
927 views

How to hide Kernel Symbols in Linux Kernel Image? Recompliation?

Why hide kernel symbols? Quote Anyone with basic knowledge of kernel exploitation knows how important information gathering is to reliable exploitation. This protection hides the kernel symbols ...
user avatar
  • 670
1 vote
1 answer
219 views

Security in memory and between local windows processes over localhost

I have a windows application that runs in 2 processes and communicates over localhost network port. This application can hold secrets, such as a web cookie. I'm trying to think through the security ...
user avatar
  • 113
7 votes
4 answers
3k views

Disable ASLR inside Docker container

I am looking to disable ASLR (address space layout randomization) inside a Docker container. Not sure if it is possible. The container is running on Alpine, but from what I understand, ASLR is a ...
user avatar
  • 219
1 vote
1 answer
235 views

Backdooring PE binary compiled with ASLR

I'm practicing backdooring PE binary compiled with ASLR in a WOW64 environment. The approach is pretty straightforward and basically is something like this: Find code cave and a hijacking point. In ...
user avatar
  • 171
1 vote
1 answer
217 views

Does every modern buffer overflow require multiple exploits in end user devices to be utilized?

On modern user oriented devices, such as Android phones, iPhones, PCs(Windows, MacOS, Linux), if there is a remote buffer overflow 0 day, are they only exploitable with the aid of multiple ...
user avatar
  • 638
1 vote
1 answer
249 views

Why is Address Space Layout Randomization not effective against the Open SSL Heartbleed Vulnerability?

My understanding is that ASLR randomly arranges the key data areas of a process, and so reading contiguously above a buffer as is done in heartbleed would not be enough to achieve the exploit.
user avatar
  • 140
1 vote
1 answer
867 views

Simple buffer overflow trying to leak address of system()

Code: #include <string.h> void vuln(char *arg) { char buffer[10]; strcpy(buffer, arg); } int main( int argc, char** argv ) { vuln(argv[1]); return 0; } I've determined I ...
user avatar
2 votes
1 answer
193 views

How to exploit buffer overflow without space after return address?

I'm working on a binary exploitation challenge where the target (ELF/x86_64) has stack canaries, NX and PIE enabled. It implements a simple forking TCP server. After a connection is established, it ...
user avatar
  • 121
2 votes
0 answers
500 views

Buffer overflow return address with null byte, workaround

I'm practicing Buffer Overflows using Free Float FTP Server 1.0 on Windows 7 SP 1. I have done simple jmp esp examples on Windows XP, where system DLLs are without rebase or Address Space Layout ...
user avatar
  • 29
3 votes
2 answers
219 views

Is it safe to deploy software without memory protections such as DEP/ASLR?

Several software packages on our SOE Windows machines come with DEP and ASLR memory protections off by default. More troubling is that these applications run as SYSTEM and load their own drivers. ...
user avatar
  • 11.4k
3 votes
1 answer
198 views

Why is ASLR not performed at less than page granularity?

What technical reasons are preventing ASLR from being randomized to a byte offset? On Linux it's to a 4kb page and on Windows to a 64kb region.
user avatar
2 votes
1 answer
2k views

Bypassing ASLR using information leaks

Most of my questions were answered in this post ASLR bypass with info leak However, I just want to know the process of getting the memory address from the information leak to then using it in the ...
user avatar
  • 177
3 votes
0 answers
180 views

Do programs run in Linux in Wine benefit from DEP and ASLR?

Do programs run in Linux in Wine benefit from mitigation techniques DEP and ASLR?
user avatar
  • 882
1 vote
2 answers
287 views

How is executable shellcode inserted?

How is shellcode (the payload) added to an executable file? Assume it is close source. How does the hacker then get the address of where it is? They need this for when they overwrite the return ...
user avatar
1 vote
1 answer
383 views

Why would modern OS allocate static addresses or why is ASLR still needed?

I have a question about ASLR which allocates randomized addresses for things. Based on my understanding (which might be wrong), a modern OS has pretty complicated memory management mechanisms and it ...
user avatar
2 votes
1 answer
466 views

the state of ASLR, PIE, SSP on Debian in 2018?

As far as I remember, most Debian Wheezy packages were not compiled with those useful security flags (ASLR, PIE, SSP, and more). Did the situation improve with Debian Squeeze or the upcoming Debian ...
user avatar
  • 61
1 vote
1 answer
2k views

BOF - How to determine adress of system() using a leak memory?

I am training myself for BOF and ASLR in 32Bits. I wrote a program that seems like this : int main(int argc, char **argv) { char buffer[32]; printf(argv[1]); gets(buffer); return 0; }...
user avatar
  • 11
3 votes
0 answers
224 views

Is the difference between a loaded elf and libc a constant value?

While doing binary exploitation and studying the case when ASLR is enabled, I noticed I could make a reliable exploit by leaking an address of a function in the binary and finding the address of ...
user avatar
2 votes
1 answer
941 views

how did the meltdown attack break KASLR in 128 steps for a target machine with 8GB RAM with 40bit randomization on a 64bit machine?

In the meltdown official paper released the authors broke the KASLR with 128 steps at worse. Unable to understand how did they come down to that number Paper for reference
user avatar
  • 123
4 votes
1 answer
9k views

How to leak libc base address using format string exploit

I've been trying for some time to write an exploit to a very simple program which has a format string and a buffer overflow vulnerability. This program has NX, SSP and ASLR. #include <stdio.h> ...
user avatar
  • 157
3 votes
2 answers
1k views

How does ASLR protect libc entry points?

ASLR randomizes the addresses of the process executable code, stack, heap and libraries. This is to make the life of an attacker difficult as they cannot hardcode addresses in the code across multiple ...
user avatar
  • 95
1 vote
0 answers
148 views

Fedora 3 Disable Address Randomization

I want to disable address space layout randomization on my Fedora 3 virtual machine. I tried to go to /proc/sys/kernel/randomize_va_space. Unlike normal Linux machine, such a file doesn't exist on ...
user avatar
  • 19
2 votes
2 answers
192 views

Software overflow exploitation lab

Working through a binary exploitation course posted by RPI a few years ago. Currently on the ASLR lab and having some trouble with it (although not with the parts related to ASLR). I can't figure out ...
user avatar
  • 101
8 votes
1 answer
4k views

ASLR bypass with info leak

Working through the Modern Binary Exploitation course from RPI here. I'm having trouble with an example on exploiting ASLR which is supposed to use a memory leak to gain information about the stack to ...
user avatar
  • 101
8 votes
2 answers
1k views

Trouble building a ROP chain

I am trying to exploit a small program. The program looks somewhat like this: int func(void) { char text[100]; scanf("%s", text); return 0; } int foo(unsigned short rand) { char ...
user avatar
3 votes
3 answers
978 views

EternalBlue exploit and ASLR

Why is the EternalBlue exploit so successful when ASLR is likely enabled on modern machines? I may be wrong as i'm not familiar with windows internals. I can't find any explanation on this including ...
user avatar
  • 153
0 votes
1 answer
1k views

Why are stack address the same all the time when not using ASLR? [closed]

In an answer to How do ASLR and DEP work? Polynomial says: In a non-ASLR and non-DEP process, the stack address is the same every time we run the process. We know exactly where it is in memory. I ...
user avatar
  • 221
2 votes
0 answers
279 views

Disabling Android mediaserver (/system/bin/mediaserver) ASLR

I was able to successfully disable ASLR in Kernel on my Android mobile (Cyanogenmod). root@s3ve3g:/system # echo 0 > /proc/sys/kernel/randomize_va_space root@s3ve3g:/system # cat /proc/sys/kernel/...
user avatar
  • 937
1 vote
0 answers
296 views

Does aslr definitely end the possibility of code execution in the case of filesystems heap overflows?

Local only Filesystems (like ntfs or btrfs) consists of many data structures that require very complex code for parsing them. So, such filesystems if implemented in user space can suffer of buffer ...
user avatar
  • 1,402
7 votes
2 answers
7k views

Is ASLR useless in preventing attacks such as return-to-libc in linux?

If i'm correct, due ASLR we load libc into some random address. And then in order to make that happen without allowing write permissions of text pages within memory we use plt/got. Now I can simply ...
user avatar
  • 179
0 votes
1 answer
4k views

How to bypass DEP and ASLR at the same time? [duplicate]

I have read some articles about bypassing DEP and ASLR , but it seems that they bypass ASLR and DEP by using the instructions in the modules not applying ASLR.But how to bypass ASLR and DEP in the ...
user avatar
3 votes
1 answer
100 views

Why code memory pages should be readable?

I understand that each instruction should be read into CPU for execution, which probably is the reason why code pages should be "r-x". But my observation is that the behavior of reading code into ...
user avatar
  • 320
6 votes
1 answer
947 views

ASLR in Linux does not randomize libraries separately

I was trying out how ASLR works in Centos 7.2.1115 x86_64 specifically. Here are my /proc/$pid/maps dumps from two runs of Firefox (on Pastebin): #1 #2 Basically, ASLR works. It randomizes .data and ...
user avatar
  • 161
2 votes
1 answer
589 views

Would it be sufficient to perform ASLR by randomizing only the base address of the executable?

According to Wiki, ASLR randomly arranges the address space positions of key data areas of a process, including the base of the executable and the positions of the stack, heap and libraries. ...
user avatar
1 vote
1 answer
447 views

Trying to understand ASLR in Ubuntu 16.04

Has something changed here? No matter whether I set randomize_va_space, the stack will always have an offset of 0. Afaik it should be a random number, right? .... f7fd8000-...
user avatar
  • 3,006
1 vote
0 answers
101 views

Researchers Bypass ASLR Protection on Intel Haswell CPUs [closed]

See Softpedia and research paper. Could we somehow prevent this attack on various OS?
user avatar