1

I have found a stack buffer overflow.

Currently this is the situation:

  • NX/DEP disabled
  • ASLR enabled
  • Not a PIE

I am able to override the return address and jump to PLT sections.

My problem is that I can only copy data until the return address because of the null byte, therefore I can not jump to my shellcode in the stack. The binary starts in 0x00090000 so it is a problem to perform ROP gadget since I can copy only one address until the return address.

Also, my binary contains a call to system that I can jump to, but in this case I need to put the address of the string argument in R0, but this is not possible due to the ASLR. I am also able to override 4 registers.

Does anyone have an idea how to bypass the ASLR here without leaking an address? Current architecture: ARM

9
  • 1
    You mention ASLR but then a fixed load address, so which is it? – Igor Skochinsky Dec 15 '20 at 22:02
  • The binary is compiled without PIE – alpico Dec 16 '20 at 8:23
  • So ASLR does not apply then? – Igor Skochinsky Dec 16 '20 at 8:24
  • There is ASLR(libraries ,stack ..), but not on the binary itself, – alpico Dec 16 '20 at 8:25
  • Does someone have an idea ? – alpico Dec 16 '20 at 14:36
0

Well if you are not able to leak any of the addresses you cannot really use ROP, but because ARM is little-endian, you can actually override the last few bytes of the return-address. You end up with a relative jump in the binary. Unfortunately you can only perform one jump.

Return Address before:                     0x1122334455667788
Return Address overridden:                 0x112233445566????
Return Address overridden (case string):   0x11223344556600??

As you described your problem the bufferoverflow is triggered by a string that is NULL-terminated, so that lowers the possible jump-locations but maybe you are lucky and find a good location. like

call rax   (there surely is an equivalent instruction on ARM, but idk)

Maybe there are references to the shellcode on the stack or in some registers an you can perform a indirect branch to that pointer and execute the shellcode on the stack.

-2

Perhaps my friend's tool can help you, it calculates addresses at runtime.

3
  • Did not understand how that can help me – alpico Dec 16 '20 at 8:24
  • 1
    Please add a description instead of a bare link – Igor Skochinsky Dec 16 '20 at 8:25
  • ok i just tried to help – mimak Dec 16 '20 at 15:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.