1

This is the vulnerable script:

#include <stdio.h>
#include <string.h>
#include <stdlib.h>
int main(int argc, char *argv[])
{
char buffer[30];
strcpy(buffer, argv[1]);
return 0;
}

I'm trying to exploit this script with both ASLR and NX on. I was going to use the return to libc method for ASLR, and I was wondering if the jump to register technique is possible to jump to a library. For example, if the location of the library is stored in EAX, can I have the return address point to an opcode of "jump to EAX"? Or is there any other method to bypassing both ASLR and NX at the same time? Thanks

2
  • The whole point of ASLR and NX is to prevent this kind of thing. What makes you think there's a trivial way to circumvent them? Jul 2, 2011 at 20:08
  • In the above code, do you have any way to get a value into EAX? I don't see it...
    – Zan Lynx
    Jul 2, 2011 at 20:41

2 Answers 2

0

I had thought "return to libc" (or any library or program code) was used to get around NX. So I believe that you have that backwards.

ASLR is used to make a "return to libc" attack much, much harder to pull off. To get around ASLR you need to either have a way to scout the library location such as through a printf format string vulnerability, or you need to run your exploit hundreds of times until you hit the correct random location.

6
  • Actually with current ASLR implementations (which are sadly still quite weak), that's not really true. At least under Vista (and afaik under WIn7 as well) only the beginning of the heap is randomized, so if we can allocate a large enough chunk of memory the protection is trivial to circumvent for example.
    – Voo
    Jul 2, 2011 at 20:43
  • @Voo: Doesn't that only apply if the library is loaded on demand, after the large heap allocations are made? If all libraries are loaded up front, they've all been randomized.
    – Zan Lynx
    Jul 2, 2011 at 20:46
  • The problem is that only the beginning of the heap is randomized (with a maximum offset of 2mb under vista afaik), which means if we're able to allocate more than 2mb some data will be at a predictable offset (eg write 4mb of a repeating data pattern)
    – Voo
    Jul 2, 2011 at 20:51
  • @Voo: I think that you are talking about some different kind of attack. With predictable heap locations you can trick the Windows heap code into writing to addresses for you or you can overwrite other program data in a nearby heap location. But that isn't a return to libc attack.
    – Zan Lynx
    Jul 2, 2011 at 21:08
  • Uh, I thought we were talking about why ASLR is easy to circumvent under some circumstances? (without having to use printf or try hundreds of time until you get lucky, but deterministically)
    – Voo
    Jul 2, 2011 at 22:36
0

Well there is an opcode call (function pointers are implemented that way after all), but that won't help much (and how you'd get the address into eax in the first place is a riddle to me - that's highly unlikely I think)

After all you'd still need the stack to be executeable (otherwise having stored an opcode there won't do much good) and know its address so that you can jump to it. There are ways to circumvent those protections but it's not that easy - though I'm sure you can find enough papers about that topic with a bit googling - but if you have an exploit to circumvent ASLR and NX you don't need the return to libc attack any longer because you have control over the system already.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.