12
votes
Is ASLR useless in preventing attacks such as return-to-libc in linux?
Yes, if PIE is disabled. It is often said that ASLR's effectiveness is significantly reduced for applications which are not compiled with PIE (Position Independent Code) support. When PIE is not used, ...
- 66.5k
7
votes
Did CVE-2016-2324 allowed remote code execution?
A buffer overflow (of the "write" kind) gives any advantage to an attacker only if the attacker can arrange for the overflow to spill over other bytes that are used for something else. At any time, ...
- 325k
6
votes
Accepted
Are Heap addresses randomized by ASLR?
According to the Windows Internals 5th Edition book, the 5-bit ASLR bias for heaps is "multiplied by 64KB to generate the final base address, starting at 0, giving a possible range of 0x00000000 to ...
- 135k
5
votes
Accepted
How to leak libc base address using format string exploit
Thanks to Andrea, who helped me in the comments, I've been finally able to write a reliable exploit.
The clue for achieving it, was to look carefully at the stack. There, I could find the address of a ...
- 167
4
votes
ASLR in Linux does not randomize libraries separately
However, it packs all libraries and executable in the same order and without gaps. So, as soon as single address gets compromised, this whole part of ASLR goes out of the window.
Not quite. ASLR ...
- 38.3k
4
votes
Is ASLR useless in preventing attacks such as return-to-libc in linux?
return to plt and return to libc are slightly different attacks.
Return to libc
One of the ways to prevent buffer overflow is to use a non executable stack. To make non executable stack, from CPU &...
- 3,901
4
votes
EternalBlue exploit and ASLR
RoRaZ and 40F4 made some real good points.
Another thing is, that especially in the health sector or finance sector, respectively in any enterprise that needs to use software specially crafted for ...
- 442
4
votes
Accepted
how did the meltdown attack break KASLR in 128 steps for a target machine with 8GB RAM with 40bit randomization on a 64bit machine?
KASLR (Kernel Address Space Layout Randomization) is a technique for making it harder for an attacker to exploit a vulnerability that they've found. Instead of placing kernel data structures in ...
- 34.6k
4
votes
Bypassing ASLR using information leaks
Yes, it is indeed a two step process. That means the target process must indeed provide some means for you to interact with it in multiple steps. Basic exploitation exercises are often limited in that ...
- 153
4
votes
Disable ASLR inside Docker container
You can use the personality(2) syscall to set the ADDR_NO_RANDOMIZE flag for a process. That process, and any of its children, will not be using ASLR. Do this in whatever process starts Docker.
...
- 66.5k
3
votes
Accepted
Is the FIPS module of openSSL with fixed base address a security risk?
Having a known address is not a big risk. The only security measure that it defeats is ASLR, and ASLR is merely a technique to make exploits more difficult, it rarely makes them impossible.
The best ...
3
votes
Accepted
EternalBlue exploit and ASLR
From RiskSense P.19:
The ASLR bypass of the original EternalBlue exploit exploits the weakness that the HAL Heap (used by the Hardware Abstraction Layer) was static located at 0xffffffffffd00000 ...
- 932
3
votes
EternalBlue exploit and ASLR
From the Risk Sense PDF (opens a PDF):
3.6.2 DEP Bypass
Starting sometime in Microsoft Windows 8/8.1 (Server 2012), the HAL Heap became non-executable. A virtual memory Page Table
Entry (PTE) ...
- 12.4k
3
votes
Why code memory pages should be readable?
We're dealing with the consequences of Von Neumann architecture - the shared memory space for data and code. It has advantages, but as you point out, it has security problems as well, including that ...
- 6,371
3
votes
how does ASLR prevent return to libc / ROP and similar attacks?
brute force a vulnerable program with all possible addresses
Trying to brute-force the address space (there are 2^64 possible addresses in a modern 64-bit system) is supposed to be impossible in ...
- 131
3
votes
Why is ASLR not performed at less than page granularity?
ASLR relies on features of the memory management unit of the CPU to map a physical page (i.e. at the hardware level) to an address in the virtual address space (which is the memory layout as seen by ...
- 198k
3
votes
Accepted
Does every modern buffer overflow require multiple exploits in end user devices to be utilized?
It depends on your definition of "exploit", what piece of software you're targeting, and where the bug is.
For example, if I found a bug in Chrome's renderer (i.e. the thing that draws webpages on ...
- 135k
3
votes
Disable ASLR inside Docker container
I was trying to make this work for a CTF environment.
What didn't work:
using personality with ADDR_NO_RANDOMIZE will make any SUID app ignore the flag.
giving the docker extra privileges with --...
- 56
3
votes
Accepted
How to hide Kernel Symbols in Linux Kernel Image? Recompliation?
The layout of a distribution precompiled kernel is public. KASLR attempts to change the base offset of the kernel, changing all the addresses by a secret offset. Unfortunately, leaking even a single ...
- 66.5k
3
votes
Accepted
How do packers/crypters deal with ASLR?
Modern packers will handle this in the same way as the Windows PE loader: by implementing relocations.
The .reloc section in a PE file (documentation here) holds details about which addresses need ...
- 734
3
votes
ASLR doesn't work?
To make debugging easier, GDB turns off ASLR by default. To turn it back on, do set disable-randomization off before you start running the program being debugged. See https://sourceware.org/gdb/...
3
votes
Accepted
Is it safe to use non-ASLR DLL in an enabled ASLR EXE
On Windows, an executable that is ASLR aware (compiled with /DYNAMICBASE) can load a library (DLL) that is not compatible with ASLR.
In this situation the DLL will not typically use ASLR, though newer ...
- 734
3
votes
Accepted
Are buffer overflow and similar attacks still possible?
Unfortunately, yes, buffer overflow and similar attacks are still possible. Microsoft has found approximately 70% of security vulnerabilities are various forms of memory unsafety, including buffer ...
- 9,284
3
votes
Are buffer overflow and similar attacks still possible?
Yes, memory corruption vulns (buffer overflows, null pointers with large offsets, double-frees, arithmetic overflows used with a pointer, format string vulnerabilities, etc.) are still a thing, and ...
- 46.3k
2
votes
When is memory allocation/layout deterministic?
Part of the problem has to do with what the memory layout looks like at program initialisation and what the memory layout looks like after it has been running for a while and you manage to get your ...
- 1,890
2
votes
how to circumvent ASLR without pointer leaks
There are ways, but they depend on the context of exploitation. No one size fits all I'm afraid. Some example techniques of bypassing ASLR;
- Partial address overwrite
- Brute force
- Using non-ASLR ...
- 3,857
2
votes
Cost-benefit analysis of ASLR
Test the apps you have running on this custom OS for input vulnerabilities, especially buffer overruns and stack overflows. If you find any, it's a sign that defense in depth is a more necessary ...
- 34.1k
2
votes
Cost-benefit analysis of ASLR
One way to get some data on this is to weigh the success/fail rate of ASLR for this particular OS by implementing it in a testing environment, and then running attacks against the non-ASLR version, ...
- 31
2
votes
Accepted
Why is Linux ASLR weak?
The Wikipedia article continues:
This places the stack base in an area 8 MB wide containing 524,288
possible positions; and the mmap base in an area 1 MB wide containing
256 possible positions.
...
- 3,378
2
votes
Accepted
Would it be sufficient to perform ASLR by randomizing only the base address of the executable?
No. Many attacks rely on the address of a library routine, and don't care where the executable is loaded. Pretty much any fixed address can be exploited.
- 34.1k
Only top scored, non community-wiki answers of a minimum length are eligible