17
votes
Accepted
How is the stack protection enforced in a binary?
On a linux box with an Intel CPU, lets say I compiled by binary with -fstack-protect-all.
Since it is not explicitly stated, it will be assumed that this refers to ELF binaries compiled using GCC ...
- 1,289
7
votes
Did CVE-2016-2324 allowed remote code execution?
A buffer overflow (of the "write" kind) gives any advantage to an attacker only if the attacker can arrange for the overflow to spill over other bytes that are used for something else. At any time, ...
- 325k
4
votes
Data Execution Prevention X vs NX
I'm not 100% sure what point your lecturer is trying to get at, particularly because "DEP" is a vague term from a historical perspective.
I know that you asked us not to provide technical details, ...
- 135k
3
votes
Are buffer overflow and similar attacks still possible?
Yes, memory corruption vulns (buffer overflows, null pointers with large offsets, double-frees, arithmetic overflows used with a pointer, format string vulnerabilities, etc.) are still a thing, and ...
- 46.3k
3
votes
Accepted
Are buffer overflow and similar attacks still possible?
Unfortunately, yes, buffer overflow and similar attacks are still possible. Microsoft has found approximately 70% of security vulnerabilities are various forms of memory unsafety, including buffer ...
- 9,284
3
votes
Accepted
Is it safe to use non-ASLR DLL in an enabled ASLR EXE
On Windows, an executable that is ASLR aware (compiled with /DYNAMICBASE) can load a library (DLL) that is not compatible with ASLR.
In this situation the DLL will not typically use ASLR, though newer ...
- 734
3
votes
ROP - pop eax, ret gadget doesn't work
Actually, I found the problem. This is about the fact that the address of this gadget contains 0a which corresponds to a \n
- 53
3
votes
several questions about linux kernel debugging - memory examination
I have never debugged the kernel, so I may be wrong, but I believe that what you are seeing makes complete sense. Let's go through it:
add BYTE PTR [rax],al
why is that? is this because I'...
- 5,857
2
votes
How is the stack protection enforced in a binary?
GCC's stack protection is software-based, and isn't related to DEP's hardware-based protection. When an OS enables DEP, all programs running on it (or some subset defined by the user) are ...
- 5,734
2
votes
Stackpivoting techniques
Assuming you're building a ROP chain that needs to manipulate the stack, you can always go for semantically equivalent gadgets, e.g. PUSH/POP, MOV ESP XXX, (SUB,ADD) ESP instructions to build the ...
- 610
2
votes
Accepted
How to find address of system() in an executable - ROP exploit
Using print 'system@plt' is only valid if the program already has an existing function (called or not) that directly references system(). In your example that's not the case.
First, disable library ...
- 5,100
2
votes
Why ret2libc is not working in the below code on x86_64?
There are a few points to note:
1. The strcpy function stops copying stuff into the destination buffer as soon as it encounters a NULL byte. A NULL byte is 0x00 or \x00. In 64-bit machines, the ...
- 51
2
votes
Accepted
How does ASLR protect libc entry points?
Update:
see https://stackoverflow.com/questions/24984955/why-arent-glibcs-function-addresses-randomized-when-aslr-is-enabled
Compile the binary using -fPIE or -fPIC -pie -fPIE:
https://...
- 1,289
2
votes
Is it safe to deploy software without memory protections such as DEP/ASLR?
DEP/ASLR is just layer of security. It doesn't secure you against everything, and against any sophisticated attack in particular. Unlike @ConsideredHarmful thinks, DEP/ASLR being disabled alone isn't ...
- 186
2
votes
Accepted
How safe is it to disable DEP for a program?
You should not turn off DEP.
DEP allows a program to selectively mark areas in a program's memory as executable, and areas in memory not marked as executable cannot be executed. This makes various ...
- 66.5k
1
vote
Is It possible to bypass DEP if one of the linked dll or the exe itself is DEP disabled?
DEP (NX) is a per-process setting. If the EXE opts in, or if the default is to use DEP and it doesn't explicitly opt out, then the process will be protected regardless of any DLLs or other library ...
- 46.3k
1
vote
Is it safe to use non-ASLR DLL in an enabled ASLR EXE
To put it bluntly, if you load a non-/DYNAMICBASE binary (DLL or similar) into any process, and you haven't configured the OS to force ASLR anyhow (this is possible but not enabled for third-party ...
- 46.3k
1
vote
Is it safe to use non-ASLR DLL in an enabled ASLR EXE
You're only as secure as your weakest link. If there is a memory corruption vulnerability in your program, an attacker will look for any way possible to achieve code execution. If any imports are ...
- 12.7k
1
vote
Accepted
Security in memory and between local windows processes over localhost
TL;DR: You almost certainly should switch to more secure IPC. Beyond that, you probably don't have a great threat model.
I'll respond to your numbered points first, then write a general answer below:
...
- 46.3k
1
vote
Is it safe to deploy software without memory protections such as DEP/ASLR?
The risk of such applications being in your environment is trivial escalation of exploitable memory corruption in the application to arbitrary code execution as SYSTEM. This is likely a compile-time ...
1
vote
Accepted
Is arbitrary code execution possible using GOT overwrite with W^X enabled?
It is certainly possible, it just depends on the circumstances. As an example of a ret2libc attack, let's say the program takes input from the user into buffer and after having overwritten a GOT entry,...
- 544
1
vote
Is arbitrary code execution possible using GOT overwrite with W^X enabled?
W^X simply prevents pages from being both executable and writable simultaneously, so an arbitrary write vulnerability cannot modify executable pages. It does not enforce control flow, so any exploit ...
- 88
1
vote
ROP: finding a useful stack pivot
I feel like I had the same issue but managed to get it working in my case. The module with the overflow had DEP enabled so I thought it wasn't going to work.
All I did was point EIP to a JMP ECX in ...
- 11
1
vote
Did CVE-2016-2324 allowed remote code execution?
Not all buffer overflows lead to remote code execution. It depends on how the buffer is allocated, and if the instruction pointer can be controlled by the attacker. There are many factors that go ...
- 12.4k
1
vote
How does SEH based exploit bypass DEP and ASLR?
Assuming that the shellcode is on the stack, we do not place the address of the shellcode in the address of the exception handler (what you called the "return address") because Windows has a some ...
- 148
Only top scored, non community-wiki answers of a minimum length are eligible