Hot answers tagged

15 votes

Compiling a buffer overflow example in modern Linux?

While the accepted answer is correct in suggesting moving everything to a different function does not explain why. As you can see in this question and answer main() functions often perform a stack ...
user avatar
  • 12.3k
12 votes

Is ASLR useless in preventing attacks such as return-to-libc in linux?

Yes, if PIE is disabled. It is often said that ASLR's effectiveness is significantly reduced for applications which are not compiled with PIE (Position Independent Code) support. When PIE is not used, ...
user avatar
  • 64.2k
10 votes
Accepted

For maximum security is it best to link OpenSSL libraries statically or dynamically?

ASLR and such things are ways to try to cope with consequences of a buffer overflow -- they are an hide&seek game so that attackers find it harder to turn a buffer overflow into remote code ...
user avatar
  • 169k
7 votes
Accepted

Does KASLR really provide more security against exploits?

KASLR has gotten under heavy critic on the day it was released for Linux, and it has also been defeated on that very day. Spender at grsecurity has written a post about it (along with LWN comments) ...
user avatar
7 votes

Did CVE-2016-2324 allowed remote code execution?

A buffer overflow (of the "write" kind) gives any advantage to an attacker only if the attacker can arrange for the overflow to spill over other bytes that are used for something else. At any time, ...
user avatar
6 votes
Accepted

Are Heap addresses randomized by ASLR?

According to the Windows Internals 5th Edition book, the 5-bit ASLR bias for heaps is "multiplied by 64KB to generate the final base address, starting at 0, giving a possible range of 0x00000000 to ...
user avatar
  • 132k
5 votes
Accepted

Compiling a buffer overflow example in modern Linux?

Your example does segfault here (or cause the program termination if the stack protector is active). Maybe you should try to move the buffer overflow into another function. Perhaps your gcc version ...
user avatar
  • 17.4k
5 votes
Accepted

How to leak libc base address using format string exploit

Thanks to Andrea, who helped me in the comments, I've been finally able to write a reliable exploit. The clue for achieving it, was to look carefully at the stack. There, I could find the address of a ...
user avatar
  • 157
4 votes

ASLR in Linux does not randomize libraries separately

However, it packs all libraries and executable in the same order and without gaps. So, as soon as single address gets compromised, this whole part of ASLR goes out of the window. Not quite. ASLR ...
user avatar
  • 38.1k
4 votes

EternalBlue exploit and ASLR

RoRaZ and 40F4 made some real good points. Another thing is, that especially in the health sector or finance sector, respectively in any enterprise that needs to use software specially crafted for ...
user avatar
  • 422
4 votes

Is ASLR useless in preventing attacks such as return-to-libc in linux?

return to plt and return to libc are slightly different attacks. Return to libc One of the ways to prevent buffer overflow is to use a non executable stack. To make non executable stack, from CPU &...
user avatar
  • 3,841
4 votes
Accepted

how did the meltdown attack break KASLR in 128 steps for a target machine with 8GB RAM with 40bit randomization on a 64bit machine?

KASLR (Kernel Address Space Layout Randomization) is a technique for making it harder for an attacker to exploit a vulnerability that they've found. Instead of placing kernel data structures in ...
user avatar
  • 34.4k
4 votes

Bypassing ASLR using information leaks

Yes, it is indeed a two step process. That means the target process must indeed provide some means for you to interact with it in multiple steps. Basic exploitation exercises are often limited in that ...
user avatar
  • 143
4 votes

Disable ASLR inside Docker container

You can use the personality(2) syscall to set the ADDR_NO_RANDOMIZE flag for a process. That process, and any of its children, will not be using ASLR. Do this in whatever process starts Docker. ...
user avatar
  • 64.2k
3 votes

Why code memory pages should be readable?

We're dealing with the consequences of Von Neumann architecture - the shared memory space for data and code. It has advantages, but as you point out, it has security problems as well, including that ...
user avatar
  • 6,311
3 votes
Accepted

EternalBlue exploit and ASLR

From RiskSense P.19: The ASLR bypass of the original EternalBlue exploit exploits the weakness that the HAL Heap (used by the Hardware Abstraction Layer) was static located at 0xffffffffffd00000 ...
user avatar
  • 932
3 votes

EternalBlue exploit and ASLR

From the Risk Sense PDF (opens a PDF): 3.6.2 DEP Bypass Starting sometime in Microsoft Windows 8/8.1 (Server 2012), the HAL Heap became non-executable. A virtual memory Page Table Entry (PTE) ...
user avatar
  • 12.3k
3 votes
Accepted

Is the FIPS module of openSSL with fixed base address a security risk?

Having a known address is not a big risk. The only security measure that it defeats is ASLR, and ASLR is merely a technique to make exploits more difficult, it rarely makes them impossible. The best ...
user avatar
3 votes

how does ASLR prevent return to libc / ROP and similar attacks?

brute force a vulnerable program with all possible addresses Trying to brute-force the address space (there are 2^64 possible addresses in a modern 64-bit system) is supposed to be impossible in ...
user avatar
3 votes

Why is ASLR not performed at less than page granularity?

ASLR relies on features of the memory management unit of the CPU to map a physical page (i.e. at the hardware level) to an address in the virtual address space (which is the memory layout as seen by ...
user avatar
3 votes

Disable ASLR inside Docker container

I was trying to make this work for a CTF environment. What didn't work: using personality with ADDR_NO_RANDOMIZE will make any SUID app ignore the flag. giving the docker extra privileges with --...
user avatar
  • 56
3 votes
Accepted

How do packers/crypters deal with ASLR?

Modern packers will handle this in the same way as the Windows PE loader: by implementing relocations. The .reloc section in a PE file (documentation here) holds details about which addresses need ...
user avatar
  • 714
3 votes
Accepted

Are buffer overflow and similar attacks still possible?

Unfortunately, yes, buffer overflow and similar attacks are still possible. Microsoft has found approximately 70% of security vulnerabilities are various forms of memory unsafety, including buffer ...
user avatar
  • 7,125
3 votes

Are buffer overflow and similar attacks still possible?

Yes, memory corruption vulns (buffer overflows, null pointers with large offsets, double-frees, arithmetic overflows used with a pointer, format string vulnerabilities, etc.) are still a thing, and ...
user avatar
  • 39.6k
2 votes

When is memory allocation/layout deterministic?

Part of the problem has to do with what the memory layout looks like at program initialisation and what the memory layout looks like after it has been running for a while and you manage to get your ...
user avatar
2 votes

Cost-benefit analysis of ASLR

Test the apps you have running on this custom OS for input vulnerabilities, especially buffer overruns and stack overflows. If you find any, it's a sign that defense in depth is a more necessary ...
user avatar
  • 33.6k
2 votes

Cost-benefit analysis of ASLR

One way to get some data on this is to weigh the success/fail rate of ASLR for this particular OS by implementing it in a testing environment, and then running attacks against the non-ASLR version, ...
user avatar
2 votes
Accepted

Why is Linux ASLR weak?

The Wikipedia article continues: This places the stack base in an area 8 MB wide containing 524,288 possible positions; and the mmap base in an area 1 MB wide containing 256 possible positions. ...
user avatar

Only top scored, non community-wiki answers of a minimum length are eligible