Questions tagged [aslr]

Address Space Layout Randomisation (ASLR) is a technology used to help prevent shellcode from being successful. It does this by randomly offsetting the location of modules and certain in-memory structures.

Filter by
Sorted by
Tagged with
1
vote
0answers
57 views

Disable ASLR inside Docker container

I am looking to disable ASLR inside a Docker container. Not sure if it is possible. The container is running on Alpine, but from what I understand, ASLR is a Kernel feature and Docker uses the host ...
1
vote
1answer
53 views

Backdooring PE binary compiled with ASLR

I'm practicing backdooring PE binary compiled with ASLR in a WOW64 environment. The approach is pretty straightforward and basically is something like this: Find code cave and a hijacking point. In ...
1
vote
1answer
76 views

Does every modern buffer overflow require multiple exploits in end user devices to be utilized?

On modern user oriented devices, such as Android phones, iPhones, PCs(Windows, MacOS, Linux), if there is a remote buffer overflow 0 day, are they only exploitable with the aid of multiple ...
1
vote
1answer
60 views

Why is Address Space Layout Randomization not effective against the Open SSL Heartbleed Vulnerability?

My understanding is that ASLR randomly arranges the key data areas of a process, and so reading contiguously above a buffer as is done in heartbleed would not be enough to achieve the exploit.
1
vote
1answer
83 views

Simple buffer overflow trying to leak address of system()

Code: #include <string.h> void vuln(char *arg) { char buffer[10]; strcpy(buffer, arg); } int main( int argc, char** argv ) { vuln(argv[1]); return 0; } I've determined I ...
1
vote
1answer
57 views

How to exploit buffer overflow without space after return address?

I'm working on a binary exploitation challenge where the target (ELF/x86_64) has stack canaries, NX and PIE enabled. It implements a simple forking TCP server. After a connection is established, it ...
2
votes
0answers
197 views

Buffer overflow return address with null byte, workaround

I'm practicing Buffer Overflows using Free Float FTP Server 1.0 on Windows 7 SP 1. I have done simple jmp esp examples on Windows XP, where system DLLs are without rebase or Address Space Layout ...
1
vote
1answer
69 views

Is it safe to deploy software without memory protections such as DEP/ASLR?

Several software packages on our SOE Windows machines come with DEP and ASLR memory protections off by default. More troubling is that these applications run as SYSTEM and load their own drivers. ...
2
votes
1answer
44 views

Why is ASLR not performed at less than page granularity?

What technical reasons are preventing ASLR from being randomized to a byte offset? On Linux it's to a 4kb page and on Windows to a 64kb region.
2
votes
1answer
301 views

Bypassing ASLR using information leaks

Most of my questions were answered in this post ASLR bypass with info leak However, I just want to know the process of getting the memory address from the information leak to then using it in the ...
3
votes
0answers
57 views

Do programs run in Linux in Wine benefit from DEP and ASLR?

Do programs run in Linux in Wine benefit from mitigation techniques DEP and ASLR?
1
vote
2answers
93 views

How is executable shellcode inserted?

How is shellcode (the payload) added to an executable file? Assume it is close source. How does the hacker then get the address of where it is? They need this for when they overwrite the return ...
1
vote
1answer
91 views

Why would modern OS allocate static addresses or why is ASLR still needed?

I have a question about ASLR which allocates randomized addresses for things. Based on my understanding (which might be wrong), a modern OS has pretty complicated memory management mechanisms and it ...
2
votes
1answer
219 views

the state of ASLR, PIE, SSP on Debian in 2018?

As far as I remember, most Debian Wheezy packages were not compiled with those useful security flags (ASLR, PIE, SSP, and more). Did the situation improve with Debian Squeeze or the upcoming Debian ...
1
vote
1answer
417 views

BOF - How to determine adress of system() using a leak memory?

I am training myself for BOF and ASLR in 32Bits. I wrote a program that seems like this : int main(int argc, char **argv) { char buffer[32]; printf(argv[1]); gets(buffer); return 0; }...
3
votes
0answers
390 views

Full ASLR and ROP

How exactly do the exploit pieces connect when bypassing ASLR and DEP using ROP? It seems like there could be a number of ways. E.g. a full ROP based payload or a ROP payload that modifies a memory ...
3
votes
0answers
129 views

Is the difference between a loaded elf and libc a constant value?

While doing binary exploitation and studying the case when ASLR is enabled, I noticed I could make a reliable exploit by leaking an address of a function in the binary and finding the address of ...
2
votes
1answer
489 views

how did the meltdown attack break KASLR in 128 steps for a target machine with 8GB RAM with 40bit randomization on a 64bit machine?

In the meltdown official paper released the authors broke the KASLR with 128 steps at worse. Unable to understand how did they come down to that number Paper for reference
0
votes
1answer
3k views

How to leak libc base address using format string exploit

I've been trying for some time to write an exploit to a very simple program which has a format string and a buffer overflow vulnerability. This program has NX, SSP and ASLR. #include <stdio.h> ...
3
votes
2answers
746 views

How does ASLR protect libc entry points?

ASLR randomizes the addresses of the process executable code, stack, heap and libraries. This is to make the life of an attacker difficult as they cannot hardcode addresses in the code across multiple ...
2
votes
0answers
329 views

Detect kASLR/ASLR within a Linux firmware image without running it

I'm currently looking into exploit mitigation techniques and I've come across a question I can't find an answer to just now. To detect the presence of let's says PIE or Canaries within a binary there ...
1
vote
0answers
65 views

Fedora 3 Disable Address Randomization

I want to disable address space layout randomization on my Fedora 3 virtual machine. I tried to go to /proc/sys/kernel/randomize_va_space. Unlike normal Linux machine, such a file doesn't exist on ...
2
votes
2answers
117 views

Software overflow exploitation lab

Working through a binary exploitation course posted by RPI a few years ago. Currently on the ASLR lab and having some trouble with it (although not with the parts related to ASLR). I can't figure out ...
8
votes
1answer
2k views

ASLR bypass with info leak

Working through the Modern Binary Exploitation course from RPI here. I'm having trouble with an example on exploiting ASLR which is supposed to use a memory leak to gain information about the stack to ...
8
votes
2answers
798 views

Trouble building a ROP chain

I am trying to exploit a small program. The program looks somewhat like this: int func(void) { char text[100]; scanf("%s", text); return 0; } int foo(unsigned short rand) { char ...
2
votes
3answers
666 views

EternalBlue exploit and ASLR

Why is the EternalBlue exploit so successful when ASLR is likely enabled on modern machines? I may be wrong as i'm not familiar with windows internals. I can't find any explanation on this including ...
0
votes
1answer
470 views

Why are stack address the same all the time when not using ASLR? [closed]

In an answer to How do ASLR and DEP work? Polynomial says: In a non-ASLR and non-DEP process, the stack address is the same every time we run the process. We know exactly where it is in memory. I ...
2
votes
0answers
178 views

Disabling Android mediaserver (/system/bin/mediaserver) ASLR

I was able to successfully disable ASLR in Kernel on my Android mobile (Cyanogenmod). root@s3ve3g:/system # echo 0 > /proc/sys/kernel/randomize_va_space root@s3ve3g:/system # cat /proc/sys/kernel/...
1
vote
0answers
188 views

Does aslr definitely end the possibility of code execution in the case of filesystems heap overflows?

Local only Filesystems (like ntfs or btrfs) consists of many data structures that require very complex code for parsing them. So, such filesystems if implemented in user space can suffer of buffer ...
4
votes
2answers
3k views

Is ASLR useless in preventing attacks such as return-to-libc in linux?

If i'm correct, due ASLR we load libc into some random address. And then in order to make that happen without allowing write permissions of text pages within memory we use plt/got. Now I can simply ...
0
votes
1answer
3k views

How to bypass DEP and ASLR at the same time? [duplicate]

I have read some articles about bypassing DEP and ASLR , but it seems that they bypass ASLR and DEP by using the instructions in the modules not applying ASLR.But how to bypass ASLR and DEP in the ...
3
votes
1answer
59 views

Why code memory pages should be readable?

I understand that each instruction should be read into CPU for execution, which probably is the reason why code pages should be "r-x". But my observation is that the behavior of reading code into ...
5
votes
1answer
458 views

ASLR in Linux does not randomize libraries separately

I was trying out how ASLR works in Centos 7.2.1115 x86_64 specifically. Here are my /proc/$pid/maps dumps from two runs of Firefox (on Pastebin): #1 #2 Basically, ASLR works. It randomizes .data and ...
2
votes
1answer
442 views

Would it be sufficient to perform ASLR by randomizing only the base address of the executable?

According to Wiki, ASLR randomly arranges the address space positions of key data areas of a process, including the base of the executable and the positions of the stack, heap and libraries. ...
1
vote
1answer
374 views

Trying to understand ASLR in Ubuntu 16.04

Has something changed here? No matter whether I set randomize_va_space, the stack will always have an offset of 0. Afaik it should be a random number, right? .... f7fd8000-...
1
vote
0answers
64 views

Researchers Bypass ASLR Protection on Intel Haswell CPUs [closed]

See Softpedia and research paper. Could we somehow prevent this attack on various OS?
3
votes
3answers
222 views

Cost-benefit analysis of ASLR

I want to evaluate whether it's worth it to add ASLR to a proprietary operating system. This OS runs multiple applications that don't trust each other and exchanges data over the network, so the ...
4
votes
1answer
589 views

Why is Linux ASLR weak?

Wikipedia says Linux kernel has a weak form of ASLR by default and only adding PaX or Exec Shield patches enables complete ASLR. What is the weakness of default ASLR in Linux kernel? Has it been ...
1
vote
1answer
1k views

How to turn off ASLR under Windows? [closed]

I'm experimenting a bit with formatstring attacks with a little program (all vulnerabilities intended): #include <stdio.h> int main(int argc, char *argv[]) { char string[100]; gets(...
1
vote
1answer
296 views

Is the FIPS module of openSSL with fixed base address a security risk?

The latest openSSL library has a FIPS module which needs to be built with a fixed base address to be called FIPS compliant. The rationale behind this is that having a fixed base address enables them ...
7
votes
1answer
1k views

Are Heap addresses randomized by ASLR?

I have been reading this article about an Internet Explorer exploit and I am a little confused about why the memory addresses effected by the heap-spray "work". The paper states that the attack uses ...
5
votes
1answer
2k views

How can I partially overwrite the EIP in order to bypass ASLR?

As far as I know, it is possible to overwrite the unchanged part of the EIP to bypass ASLR protection. Unfortunately, I do not understand how this can help me in order to jump to the location of my ...
5
votes
3answers
889 views

Did CVE-2016-2324 allowed remote code execution?

Let’s say I have this kind of code : // In revision.c char *path_name(const struct name_path *path, const char *name) // by design, name_path->len is a 32 bits int, but this doesn’t concern name { ...
1
vote
1answer
641 views

how to circumvent ASLR without pointer leaks

is there way to circumvent ASLR without pointer leaks, I mean i read many exploit development course Syllabus and many of them talk about bypass ASLR without pointer leaks, Does anyone can explain to ...
12
votes
2answers
2k views

Compiling a buffer overflow example in modern Linux?

I'm trying to compile a simple buffer overflow example on a Debian i386 VM. The executable builds ok, but EIP does not get overwritten correctly despite being supplied a sufficiently large input to ...
1
vote
0answers
328 views

NX + ASLR bypass - troubles with return address of .bss

I have one problem, while doing NX + ASLR bypass. I'm going through this tutorial step-by-step. Everything is going well, I have prepared my exploit, just with another address and some small ...
6
votes
0answers
741 views

Limited Buffer Size for shellcode on 64 bits machine

I have a code snippet which has the classic strcpy vulnerability int main(int argc, char argv[][]){ char buffer[8]; strcpy(buffer, argv[1]); } By disassembling the binary file, we can see ...
3
votes
2answers
2k views

For maximum security is it best to link OpenSSL libraries statically or dynamically?

When linking to OpenSSL (or other cryptographic libraries) would it be more secure to use a shared library and have address space layout randomization, or to use a static library and not have ASLR?
1
vote
0answers
238 views

Buffer overflow and register contents?

I am doing an exam practice question, suppose I have a function like; void func(char* arg) { char buf[32]; strcpy(buf, arg); } command break func: -buf begins at 0xbffebfb0 -(gdb) x/2wx $...
3
votes
1answer
2k views

how does ASLR prevent return to libc / ROP and similar attacks?

I am trying to understand ASLR and how it is implemented. I understand it does not actually "prevent" buffer overflow etc from happening, it will only make it more difficult. But i am not able to ...