2

I am quite new in binary exploitation. I am doing a lot of beginners exercise here. I am confused about ASLR. I tried some binary exploitation thing in Linux. It was recommended that I should stop ASLR in Linux before analyzing the binary. it is the command for that --> echo 0 > /proc/sys/kernel/randomize_va_space Am I right here? am I turning off my ASLR (randomizing stack addresses)?

But When I did the Windows 10 binary exploitation(vulnserver). I had to put my payload into stack address. And I noticed that the stack address (jmp esp) was constant, not changing. Is ASLR works differently in various OS? I don't know If I am asking a write question. please tell me if you know.

2
  • Did you check if the binary has /DYNAMICBASE property set? If it is not set then it means that REBASE was opted out while compiling the program itself i.e. ASLR is not being used.
    – ifexploit
    Aug 17, 2020 at 6:55
  • how do I check it in windows? Aug 17, 2020 at 10:13

2 Answers 2

3

By using this tool from Didier Stevens you've been able to check/set/unset DEP/ASLR characteristics of your file. Check the file like this:

setdllcharacteristics.exe yourfile.exe

If the output said DYNAMIC_BASE = 0 then you can use +d option to enable DYNAMICBASE of your file:

setdllcharacteristics.exe +d yourfile.exe

And you can use -d to unset again.

1
  1. Yes, the command echo 0 > /proc/sys/kernel/randomize_va_space disables ASLR. From here:

The value shown will be one of the following:

0 = Disabled

1 = Conservative Randomization

2 = Full Randomization

  1. There are several differences in the implementation of ASLR between Windows and Linux, you can search for them online, but to your question: In Windows, an EXE or a DLL can be compiled with or without ASLR (same goes for DEP - Data Execution Prevention). For the purpose of exploitation, we search for code without protection (you can find it with WinDBG using mona modules or narly, for example), in order to try to jump to it and run a code of our choice. Therefore, what you have probably seen is a jump to such a code without ASLR, and it's fine that the address is fixed (no ASLR!). If you have control over the stack, the jmp esp command jumps to the stack, and there you can put whatever code you want.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.