Questions tagged [dep]

Data Execution Prevention, any technique to protect data from being executed as code, thus preventing some exploits.

Filter by
Sorted by
Tagged with
128 votes
2 answers
104k views

How do ASLR and DEP work?

How do Address Space Layout Randomisation (ASLR) and Data Execution Prevention (DEP) work, in terms of preventing vulnerabilities from being exploited? Can they be bypassed?
Polynomial's user avatar
  • 135k
19 votes
2 answers
25k views

How "leaking pointers" to bypass DEP/ASLR works

I was wondering if anyone could give me some clues on how "leaking pointers" to bypass DEP/ASLR work. I read here: The only way to reliably bypass DEP and ASLR is through an pointer leak. This is ...
John Smith's user avatar
15 votes
3 answers
3k views

Compiling a buffer overflow example in modern Linux?

I'm trying to compile a simple buffer overflow example on a Debian i386 VM. The executable builds ok, but EIP does not get overwritten correctly despite being supplied a sufficiently large input to ...
B-MO's user avatar
  • 313
13 votes
2 answers
21k views

How is the stack protection enforced in a binary?

On a linux box with an Intel CPU, lets say I compiled by binary with -fstack-protect-all. How is this encoded into the binary? (Can I see this info using readelf? ). Is it encoded into every page/...
SFlow's user avatar
  • 283
10 votes
1 answer
9k views

What attacks does a W^X policy prevent against?

Write xor Execute (W^X) is a policy that a block (page) of memory cannot be marked as both writeable and executable at the same time. What attacks does W^X prevent, with and without the following: ...
Polynomial's user avatar
  • 135k
6 votes
1 answer
1k views

Hardware enforced DEP on different CPUs

Are there any differences how hardware DEP is implemented on CPUs from different manufacturers (Intel, AMD, nVidia, Texas,...)? Are there any significant differences how hardware DEP works on x86 ...
StupidOne's user avatar
  • 2,812
6 votes
1 answer
7k views

How can I check if a Mac application has NX or ASLR enabled?

According to Wikipedia, the NX bit is set for all x64 binaries: OS X for Intel supports the NX bit on all CPUs supported by Apple (from 10.4.4 – the first Intel release – onwards). Mac OS X 10.4 ...
Guest's user avatar
  • 63
5 votes
3 answers
985 views

Did CVE-2016-2324 allowed remote code execution?

Let’s say I have this kind of code : // In revision.c char *path_name(const struct name_path *path, const char *name) // by design, name_path->len is a 32 bits int, but this doesn’t concern name { ...
user2284570's user avatar
  • 1,472
5 votes
2 answers
426 views

Why did it take so long to enforce memory permissions?

From the Wikipedia page on DEP. DEP was introduced on Linux in 2004 (kernel 2.6.8[2]), on Windows in 2004 with Windows XP Service Pack 2,[3] while Apple introduced DEP when they moved to x86 in ...
user avatar
4 votes
2 answers
2k views

Are buffer overflow and similar attacks still possible?

The majority of my cyber security background comes in the form of web application vulnerability testing, and whilst I do have a degree of prior experience in studying and performing application ...
questioner's user avatar
4 votes
1 answer
523 views

several questions about linux kernel debugging - memory examination

I've read this Does Linux kernel use DEP for kernel memory? but I'm debugging linux kernel (x86_64) on Vmware using vmware stub. I've attached gdb to my linux kernel. the kernel version is 3.x and I ...
tigger's user avatar
  • 41
4 votes
2 answers
3k views

How does SEH based exploit bypass DEP and ASLR?

I am new to structured exception handling based exploits. Why don't we put our return address directly in SE handler to jump to our shellcode? (with no safe SEH) Can anybody explain the reason of ...
Sani's user avatar
  • 41
4 votes
0 answers
324 views

Do programs run in Linux in Wine benefit from DEP and ASLR?

Do programs run in Linux in Wine benefit from mitigation techniques DEP and ASLR?
KOLANICH's user avatar
  • 900
3 votes
2 answers
306 views

Is it safe to deploy software without memory protections such as DEP/ASLR?

Several software packages on our SOE Windows machines come with DEP and ASLR memory protections off by default. More troubling is that these applications run as SYSTEM and load their own drivers. ...
NULLZ's user avatar
  • 11.5k
3 votes
1 answer
2k views

Bypass Full ASLR+DEP exploit mitigation

Let's assume that a vulnerabled process is set up with an ASLR and DEP against all the imported modules used in this process and there is no way to find a module that is aslr free.. More over, the ...
JDeff's user avatar
  • 31
3 votes
1 answer
3k views

Why ret2libc is not working in the below code on x86_64?

I am trying to bypass DEP in x86_64 (64 bit - ASLR OFF). I have my own vulnerable code and I have also written an exploit code with a basic ROP to jump into system() with parameter "/bin/sh",...
bsdboy's user avatar
  • 51
3 votes
2 answers
1k views

How does ASLR protect libc entry points?

ASLR randomizes the addresses of the process executable code, stack, heap and libraries. This is to make the life of an attacker difficult as they cannot hardcode addresses in the code across multiple ...
stflow's user avatar
  • 95
3 votes
0 answers
798 views

Bypass DEP using NtSetInformationProcess on last Windows XP SP3 Pro update

Following the example of corelan team ROP version 2 (I was able to perform version 1): https://www.corelan.be/index.php/2010/06/16/exploit-writing-tutorial-part-10-chaining-dep-with-rop-the-rubikstm-...
Lucian Nitescu's user avatar
2 votes
2 answers
914 views

ROP Gadgets from executables?

I noticed that exploits which use Return Oriented Programming always find the gadgets in libraries. I wonder if it is possible to use gadgets from the executable (.exe) itself?
Fee's user avatar
  • 23
2 votes
1 answer
2k views

Data Execution Prevention X vs NX

My lecturer posted this in his slides and I have no idea what he is trying to say. I quote from his slide: Windows DEP = Data Execution Prevention Old “X” idea: must allow explicitly, current ...
user5623335's user avatar
2 votes
2 answers
8k views

How safe is it to disable DEP for a program?

I've been playing a game and there is a private server (with around 2k population) that asks us to turn off DEP for their game, I read about what it does but I don't understand what the consequences ...
Kyuuri's user avatar
  • 35
2 votes
1 answer
2k views

Stackpivoting techniques

I'm practicing exploit development and one of the scenario I am haing most difficulties with is stack pivoting besides the "ADD ESP, XXX" or something like that. The question is, during the writing ...
Kartone's user avatar
  • 171
2 votes
1 answer
568 views

Security in memory and between local windows processes over localhost

I have a windows application that runs in 2 processes and communicates over localhost network port. This application can hold secrets, such as a web cookie. I'm trying to think through the security ...
Basil's user avatar
  • 123
2 votes
1 answer
346 views

Are stack buffer overflows even possible in this instance?

Let's say there is a C program that simply takes a string argv[1] and uses sprintf to copy it in a finite buffer. Classic stack buffer overflow. Let's even say the program is more complicated, ...
Jonny's user avatar
  • 21
2 votes
1 answer
878 views

SEH overwrite attack details

If there are canaries on stack, why does not the exception handler check the integrity of canaries? Why does it continue executing a manipulated exception handler? Will corrupting a canary trigger an ...
Infinite's user avatar
  • 330
1 vote
3 answers
970 views

Is it safe to use non-ASLR DLL in an enabled ASLR EXE

Is it safe to use non-ASLR DLL in an enabled ASLR EXE? Would the DLL be loaded to and will use random addressed, or should all the dependencies enable ASLR? In addition, what about other security ...
whiteberryapps's user avatar
1 vote
1 answer
827 views

ROP - pop eax, ret gadget doesn't work

I am building a ROP chain for a security challenge. I have a problem in my ROP chain. I found some interesting gadgets with ropshell.com, and they seem to work pretty well except one. Indeed I follow ...
cc315's user avatar
  • 53
1 vote
1 answer
12k views

How to find address of system() in an executable - ROP exploit

I'm trying to find the address of system() in a code repo that I'm trying to exploit using Return Oriented Programming (for a course project). The code has included stdlib.h but it has not used system(...
Nikhil's user avatar
  • 13
1 vote
1 answer
3k views

ROP: finding a useful stack pivot

I'm trying to write a rop chain to bypass dep on Windows 7 x64 SP1. I'm working on a SEH overwrite exploit and so, in the first place, i need to return back to my buffer after exception is triggered ...
Kartone's user avatar
  • 171
1 vote
1 answer
392 views

Getting a DEP exception when trying to call SetProcessDEPException(false)

I'm demonstrating an exploit for an old app. On Windows XP SP3 32bit (EN), the address of SetProcessDEPPolicy() is usually 0x7C8622A4. I have that version of Windows (in English as well) and I've ...
Juicy's user avatar
  • 1,447
1 vote
3 answers
202 views

How does Windows know which part of memory is "intended to hold data only"?

I'm learning about DEP implementations, now I'm trying to figure out how does the OS know which part of memory is intended to hold data only?
daisy's user avatar
  • 2,057
1 vote
0 answers
472 views

Using .data segment for Code Execution with DEP Enable

Sorry if this seems like a silly question. I am working on practicing backdooring applications for a cert I am working on, and one of the methods is to use existing code caves. The issue is, these ...
NetSec's user avatar
  • 11
1 vote
0 answers
327 views

Buffer overflow and register contents?

I am doing an exam practice question, suppose I have a function like; void func(char* arg) { char buf[32]; strcpy(buf, arg); } command break func: -buf begins at 0xbffebfb0 -(gdb) x/2wx $...
user124627's user avatar
0 votes
2 answers
1k views

Is arbitrary code execution possible using GOT overwrite with W^X enabled?

Is it possible to reliably execute arbitrary code from a single overwrite of the Global Offset Table when W^X is enabled? By "reliably" I mean assuming I control only the location pointed to by the ...
camercu's user avatar
  • 103
0 votes
1 answer
135 views

Is It possible to bypass DEP if one of the linked dll or the exe itself is DEP disabled?

i have a program named x. The program x have one modules which is dep disabled and all other modules linked with dep enabled. What will be the state of the program x , when developing an exploit , do ...
Tinu Tom's user avatar
0 votes
1 answer
1k views

Different types of segmentation faults in Linux [closed]

In Linux, when the NX-bit triggers the segmentation fault seems to be "error 15", whereas a more typical error, such as attempting to read from invalid memory, results in "error 7", (seen from dmesg ...
ioctlvoid's user avatar
  • 425
0 votes
1 answer
4k views

How to bypass DEP and ASLR at the same time? [duplicate]

I have read some articles about bypassing DEP and ASLR , but it seems that they bypass ASLR and DEP by using the instructions in the modules not applying ASLR.But how to bypass ASLR and DEP in the ...
freedom2's user avatar
0 votes
1 answer
185 views

How can data execution prevention be implemented on websites and web applications to prevent privilege escalation?

I have a basic understanding on what data execution and prevention is and how it works in Windows, but I saw an article online (which I cannot seem to find anymore) mention that it can also be used on ...
Osiris93's user avatar
  • 123
-1 votes
1 answer
494 views

Why should I use ROP for exploit dev? [closed]

Return Oriented Programming is a technique for bypassing DEP which based on ret2libc.. ROP is used for formatting the API function parameters in order to make a reliable shellcode.. I dont get ...
Hakuna Matata's user avatar