2

I have found a stack buffer overflow.

Currently, this is the situation:

  • NX/DEP disabled
  • ASLR enabled
  • Not a PIE

I am able to override the return address and jump to PLT sections.

My problem is that I can only copy data until the return address because of the null byte, therefore I can not jump to my shellcode in the stack. The binary starts in 0x00090000, so it is a problem to perform ROP gadget, since I can copy only one address until the return address.

Also, my binary contains a call to system that I can jump to, but in this case I need to put the address of the string argument in R0, and this is not possible due to the ASLR. I am also able to override 4 registers.

Does anyone have an idea how to bypass the ASLR here without leaking an address? Current architecture: ARM.

9
  • 1
    You mention ASLR but then a fixed load address, so which is it?
    – Igor Skochinsky
    Dec 15 '20 at 22:02
  • 1
    The binary is compiled without PIE
    – alpico
    Dec 16 '20 at 8:23
  • So ASLR does not apply then?
    – Igor Skochinsky
    Dec 16 '20 at 8:24
  • There is ASLR(libraries ,stack ..), but not on the binary itself,
    – alpico
    Dec 16 '20 at 8:25
  • Does someone have an idea ?
    – alpico
    Dec 16 '20 at 14:36
1

Well if you are not able to leak any of the addresses you cannot really use ROP, but because ARM is little-endian, you can actually override the last few bytes of the return-address. You end up with a relative jump in the binary. Unfortunately you can only perform one jump.

Return Address before:                     0x1122334455667788
Return Address overridden:                 0x112233445566????
Return Address overridden (case string):   0x11223344556600??

As you described your problem the bufferoverflow is triggered by a string that is NULL-terminated, so that lowers the possible jump-locations but maybe you are lucky and find a good location. like

call rax   (there surely is an equivalent instruction on ARM, but idk)

Maybe there are references to the shellcode on the stack or in some registers an you can perform a indirect branch to that pointer and execute the shellcode on the stack.

0

I can think of a few possible solutions. All (obviously) depend on specifics you did not mention. I hope you find at least one of these useful.

  1. Place shellcode before the overwritten return address. This depends on the length of the buffer (plus any additional data on the stack) but might be enough (at least to jump or copy another piece of code, located someplace else).
  2. Take the ret2libc approach one step further - jump to a gadget that performs some register manipulation and then calls a useful function (such as system) either by directly calling system or calling/jumping to a register you can control.
  3. Keep in mind you don't necessarily have to overwrite the remainder of the stack. It may be enough to have some limited control over it. You know the stack back-trace and have some control of the code being executed next, make sure there're enough stack pops (a single instruction in ARM) and a branch or some other useful gadget.
  4. use JOP. It is possible (albeit harder) to construct sequences of gadgets that, instead of falling-through using ret instructions are connected using a series of jump/branch instructions. This requires searching for gadgets that end with a call/b/etc instruction (preferably one that uses a register) instead of with a ret instruction.

Note that for a more general answer, certain primitives can be used to gain code execution without bypassing ASLR although that really depends in the scenario (and you usually have to be extremely lucky).

-1

Perhaps my friend's tool can help you, it calculates addresses at runtime.

3
  • Did not understand how that can help me
    – alpico
    Dec 16 '20 at 8:24
  • 2
    Please add a description instead of a bare link
    – Igor Skochinsky
    Dec 16 '20 at 8:25
  • ok i just tried to help
    – mimak
    Dec 16 '20 at 15:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.