Binary exploitation: techniques and vulnerabilities
Techniques
GOT overwrite
Jump-oriented programming (JOP)
Return-oriented programming (ROP)
Shellcode injection
Sigreturn-oriented programming (SROP)
HEAP metadata corruption
Vulnerabilities
Format strings
Integer over- and underflow
Stack buffer overflow
Use after free
Double free
Race condition
Protections
No-execute bit (NX)
- When enabled it makes data stored on the stack not executable
- Bypass with ROP, SROP, JOP
- Wikipedia
Stack canary
- A randomly generated value on the stack, placed just before the saved instruction pointer. If it is overwritten, it will result in:
*** stack smashing detected ***: terminated Aborted (core dumped) - Bypass by getting a canary leak to know what the specific value is, and overwriting that particular offset with the correct canary value.
- Wikipedia
- jorianwoltjer’s book
Address space layout randomization (ASLR)
Bypass by getting a pointer leak and calculating the base offset by subtracting the offset between the library function and the library start:
# Let's say we leaked the address of `puts()` # This is the memory location of `puts()` relative to the library default_puts_offset = 0x1234 aslr_puts_leak = 0x7fff5234 base_offset = aslr_puts_leak - default_puts_offset # base_offset == 0x7fff4000