Questions tagged [aslr]

Address Space Layout Randomisation (ASLR) is a technology used to help prevent shellcode from being successful. It does this by randomly offsetting the location of modules and certain in-memory structures.

Filter by
Sorted by
Tagged with
0 votes
0 answers
107 views

Downsides of increased ASLR entropy

ASLR allows to randomize the base address of userspace applications. In Linux, the length of the randomized part of the mmap address can be specified via the kernel build config. It is bound by the ...
user5626466's user avatar
0 votes
0 answers
96 views

Where do stack pointer differences to stack base originate from on Linux?

Let's assume we have this simple program: void main() { int x; printf("%p", &x); } Assuming the stack is mapped something like this: 0x007ffffffdd000 0x007ffffffff000 ...
milck's user avatar
  • 101
0 votes
0 answers
50 views

How does ASLR work [duplicate]

I have read about ASLR and understand that it randomizes the location in memory where an executable is loaded every time it is run. But I have a doubt, take an example of an elf executable. It tells ...
OSdev's user avatar
  • 1
4 votes
2 answers
2k views

Are buffer overflow and similar attacks still possible?

The majority of my cyber security background comes in the form of web application vulnerability testing, and whilst I do have a degree of prior experience in studying and performing application ...
questioner's user avatar
1 vote
1 answer
763 views

How to exploit with Control over return address and knowing the address of printf

I have this program that uses ASLR and it leaks information when i overflow a buffer, namely the address of printf. Furthermore i can overwrite the return address. How can i use this to spawn a shell? ...
Fluctuation10111's user avatar
0 votes
1 answer
547 views

Fixed offset in linux ASLR?

I just printed function addresses and offset between two functions, but the offset is fixed whenever the program is executed (base address is only changed). Code (test.c) #include <stdio.h> #...
user257164's user avatar
2 votes
1 answer
320 views

Does recompiling a binary from source code make it more secure/obscure?

Using standard hardening options like PIC, Stack Protection ... does a mere recompilation make a program more secure against attacks? You have the source code of a program, compile it two times with ...
plsrespond's user avatar
2 votes
1 answer
546 views

Buffer overflow outside gdb

I'm trying to exploit a basic C program (below) which I've written: #include <stdio.h> #include <string.h> void main() { char ch[10]; scanf("%s", ch); if(strcmp(&...
Abhirup Bakshi's user avatar
1 vote
1 answer
387 views

Is a single infoleak enough to break ASLR if you don't have access to the binary?

With a single infoleak and access to the binary you can calculate the other addresses. Is this still possible when you don't have access to the binary?
aslr's user avatar
  • 11
1 vote
1 answer
299 views

ROP on MIPS Doesn't Land Where Calculated

I am working on exploiting an application on MIPS to further my knowledge of ROP chaining. The library I am trying to build a ROP chain is libuClibc-0.9.30.3.so. I found a gadget that I want to use ...
joshu's user avatar
  • 121
1 vote
2 answers
827 views

How does ASLR work if in the assembly code the addresses are the same

Let's say I have this piece of code that changes the 10 address to the value 20 and the following one to 30 mov ebx,10 mov [ebx],20 add ebx,1 mov ebx,30 How can the address change each time it is ...
for the's user avatar
  • 13
1 vote
3 answers
943 views

Is it safe to use non-ASLR DLL in an enabled ASLR EXE

Is it safe to use non-ASLR DLL in an enabled ASLR EXE? Would the DLL be loaded to and will use random addressed, or should all the dependencies enable ASLR? In addition, what about other security ...
whiteberryapps's user avatar
2 votes
1 answer
813 views

ASLR doesn't work?

I have following code: #include <stdio.h> #include <stdlib.h> int main() { int *ptr1 = malloc(16); int val1 = 0x12345678; printf("stack: %p\nheap: %p\n", &...
qwertyuiqwertyui's user avatar
9 votes
1 answer
602 views

Importance of ASLR Mode 2

From what I understand, ASLR has 3 Modes: 0 - turned off 1 - randomizes stack, heap, shared libraries, vDSO, mmap memory area and text area (if built with -fPIE -pie) 2 - additionally randomizes brk()...
Mr_Mango's user avatar
2 votes
1 answer
273 views

How do packers/crypters deal with ASLR?

If a packer or crypter is used to obfuscate a piece of executable code, it seems that calls and references made in that code will not be updated at load-time and will be incorrect when the code is ...
chillsauce's user avatar
6 votes
1 answer
1k views

How to hide Kernel Symbols in Linux Kernel Image? Recompliation?

Why hide kernel symbols? Quote Anyone with basic knowledge of kernel exploitation knows how important information gathering is to reliable exploitation. This protection hides the kernel symbols ...
adrelanos's user avatar
  • 754
2 votes
1 answer
527 views

Security in memory and between local windows processes over localhost

I have a windows application that runs in 2 processes and communicates over localhost network port. This application can hold secrets, such as a web cookie. I'm trying to think through the security ...
Basil's user avatar
  • 123
8 votes
4 answers
5k views

Disable ASLR inside Docker container

I am looking to disable ASLR (address space layout randomization) inside a Docker container. Not sure if it is possible. The container is running on Alpine, but from what I understand, ASLR is a ...
Ra'Jiska's user avatar
  • 229
1 vote
1 answer
304 views

Backdooring PE binary compiled with ASLR

I'm practicing backdooring PE binary compiled with ASLR in a WOW64 environment. The approach is pretty straightforward and basically is something like this: Find code cave and a hijacking point. In ...
Kartone's user avatar
  • 171
1 vote
1 answer
266 views

Does every modern buffer overflow require multiple exploits in end user devices to be utilized?

On modern user oriented devices, such as Android phones, iPhones, PCs(Windows, MacOS, Linux), if there is a remote buffer overflow 0 day, are they only exploitable with the aid of multiple ...
john doe's user avatar
  • 708
1 vote
1 answer
318 views

Why is Address Space Layout Randomization not effective against the Open SSL Heartbleed Vulnerability?

My understanding is that ASLR randomly arranges the key data areas of a process, and so reading contiguously above a buffer as is done in heartbleed would not be enough to achieve the exploit.
Anthony O's user avatar
  • 120
1 vote
1 answer
1k views

Simple buffer overflow trying to leak address of system()

Code: #include <string.h> void vuln(char *arg) { char buffer[10]; strcpy(buffer, arg); } int main( int argc, char** argv ) { vuln(argv[1]); return 0; } I've determined I ...
Bobby Bushay's user avatar
2 votes
1 answer
316 views

How to exploit buffer overflow without space after return address?

I'm working on a binary exploitation challenge where the target (ELF/x86_64) has stack canaries, NX and PIE enabled. It implements a simple forking TCP server. After a connection is established, it ...
hackedd's user avatar
  • 121
2 votes
0 answers
632 views

Buffer overflow return address with null byte, workaround

I'm practicing Buffer Overflows using Free Float FTP Server 1.0 on Windows 7 SP 1. I have done simple jmp esp examples on Windows XP, where system DLLs are without rebase or Address Space Layout ...
mirek's user avatar
  • 29
3 votes
2 answers
295 views

Is it safe to deploy software without memory protections such as DEP/ASLR?

Several software packages on our SOE Windows machines come with DEP and ASLR memory protections off by default. More troubling is that these applications run as SYSTEM and load their own drivers. ...
NULLZ's user avatar
  • 11.5k
3 votes
1 answer
285 views

Why is ASLR not performed at less than page granularity?

What technical reasons are preventing ASLR from being randomized to a byte offset? On Linux it's to a 4kb page and on Windows to a 64kb region.
Ffffffff's user avatar
2 votes
1 answer
3k views

Bypassing ASLR using information leaks

Most of my questions were answered in this post ASLR bypass with info leak However, I just want to know the process of getting the memory address from the information leak to then using it in the ...
localacct's user avatar
  • 177
4 votes
0 answers
307 views

Do programs run in Linux in Wine benefit from DEP and ASLR?

Do programs run in Linux in Wine benefit from mitigation techniques DEP and ASLR?
KOLANICH's user avatar
  • 912
1 vote
2 answers
390 views

How is executable shellcode inserted?

How is shellcode (the payload) added to an executable file? Assume it is close source. How does the hacker then get the address of where it is? They need this for when they overwrite the return ...
user5623335's user avatar
1 vote
1 answer
583 views

Why would modern OS allocate static addresses or why is ASLR still needed?

I have a question about ASLR which allocates randomized addresses for things. Based on my understanding (which might be wrong), a modern OS has pretty complicated memory management mechanisms and it ...
ios learner's user avatar
3 votes
1 answer
539 views

the state of ASLR, PIE, SSP on Debian in 2018?

As far as I remember, most Debian Wheezy packages were not compiled with those useful security flags (ASLR, PIE, SSP, and more). Did the situation improve with Debian Squeeze or the upcoming Debian ...
puzzle's user avatar
  • 81
1 vote
1 answer
2k views

BOF - How to determine adress of system() using a leak memory?

I am training myself for BOF and ASLR in 32Bits. I wrote a program that seems like this : int main(int argc, char **argv) { char buffer[32]; printf(argv[1]); gets(buffer); return 0; }...
wammder's user avatar
  • 11
3 votes
0 answers
287 views

Is the difference between a loaded elf and libc a constant value?

While doing binary exploitation and studying the case when ASLR is enabled, I noticed I could make a reliable exploit by leaking an address of a function in the binary and finding the address of ...
Benoit Sevens's user avatar
2 votes
1 answer
1k views

how did the meltdown attack break KASLR in 128 steps for a target machine with 8GB RAM with 40bit randomization on a 64bit machine?

In the meltdown official paper released the authors broke the KASLR with 128 steps at worse. Unable to understand how did they come down to that number Paper for reference
yolob 21's user avatar
  • 123
4 votes
1 answer
12k views

How to leak libc base address using format string exploit

I've been trying for some time to write an exploit to a very simple program which has a format string and a buffer overflow vulnerability. This program has NX, SSP and ASLR. #include <stdio.h> ...
L00P3R's user avatar
  • 167
3 votes
2 answers
1k views

How does ASLR protect libc entry points?

ASLR randomizes the addresses of the process executable code, stack, heap and libraries. This is to make the life of an attacker difficult as they cannot hardcode addresses in the code across multiple ...
stflow's user avatar
  • 95
1 vote
0 answers
214 views

Fedora 3 Disable Address Randomization

I want to disable address space layout randomization on my Fedora 3 virtual machine. I tried to go to /proc/sys/kernel/randomize_va_space. Unlike normal Linux machine, such a file doesn't exist on ...
Jonah's user avatar
  • 19
2 votes
2 answers
258 views

Software overflow exploitation lab

Working through a binary exploitation course posted by RPI a few years ago. Currently on the ASLR lab and having some trouble with it (although not with the parts related to ASLR). I can't figure out ...
Praet's user avatar
  • 101
8 votes
1 answer
4k views

ASLR bypass with info leak

Working through the Modern Binary Exploitation course from RPI here. I'm having trouble with an example on exploiting ASLR which is supposed to use a memory leak to gain information about the stack to ...
Praet's user avatar
  • 101
9 votes
2 answers
1k views

Trouble building a ROP chain

I am trying to exploit a small program. The program looks somewhat like this: int func(void) { char text[100]; scanf("%s", text); return 0; } int foo(unsigned short rand) { char ...
alive-and-well's user avatar
3 votes
3 answers
1k views

EternalBlue exploit and ASLR

Why is the EternalBlue exploit so successful when ASLR is likely enabled on modern machines? I may be wrong as i'm not familiar with windows internals. I can't find any explanation on this including ...
gigasai's user avatar
  • 153
0 votes
1 answer
2k views

Why are stack address the same all the time when not using ASLR? [closed]

In an answer to How do ASLR and DEP work? Polynomial says: In a non-ASLR and non-DEP process, the stack address is the same every time we run the process. We know exactly where it is in memory. I ...
james6125's user avatar
  • 219
2 votes
0 answers
348 views

Disabling Android mediaserver (/system/bin/mediaserver) ASLR

I was able to successfully disable ASLR in Kernel on my Android mobile (Cyanogenmod). root@s3ve3g:/system # echo 0 > /proc/sys/kernel/randomize_va_space root@s3ve3g:/system # cat /proc/sys/kernel/...
dev's user avatar
  • 997
1 vote
0 answers
361 views

Does aslr definitely end the possibility of code execution in the case of filesystems heap overflows?

Local only Filesystems (like ntfs or btrfs) consists of many data structures that require very complex code for parsing them. So, such filesystems if implemented in user space can suffer of buffer ...
user2284570's user avatar
  • 1,472
7 votes
2 answers
8k views

Is ASLR useless in preventing attacks such as return-to-libc in linux?

If i'm correct, due ASLR we load libc into some random address. And then in order to make that happen without allowing write permissions of text pages within memory we use plt/got. Now I can simply ...
DrPrItay's user avatar
  • 179
0 votes
1 answer
4k views

How to bypass DEP and ASLR at the same time? [duplicate]

I have read some articles about bypassing DEP and ASLR , but it seems that they bypass ASLR and DEP by using the instructions in the modules not applying ASLR.But how to bypass ASLR and DEP in the ...
freedom2's user avatar
3 votes
1 answer
119 views

Why code memory pages should be readable?

I understand that each instruction should be read into CPU for execution, which probably is the reason why code pages should be "r-x". But my observation is that the behavior of reading code into ...
Infinite's user avatar
  • 330
6 votes
1 answer
1k views

ASLR in Linux does not randomize libraries separately

I was trying out how ASLR works in Centos 7.2.1115 x86_64 specifically. Here are my /proc/$pid/maps dumps from two runs of Firefox (on Pastebin): #1 #2 Basically, ASLR works. It randomizes .data and ...
EvgEnZh's user avatar
  • 161
2 votes
1 answer
765 views

Would it be sufficient to perform ASLR by randomizing only the base address of the executable?

According to Wiki, ASLR randomly arranges the address space positions of key data areas of a process, including the base of the executable and the positions of the stack, heap and libraries. ...
user1118764's user avatar
1 vote
1 answer
481 views

Trying to understand ASLR in Ubuntu 16.04

Has something changed here? No matter whether I set randomize_va_space, the stack will always have an offset of 0. Afaik it should be a random number, right? .... f7fd8000-...
AdHominem's user avatar
  • 3,036