Modern exploits use different techniques to bypass ASLR. One of the technique used in some IE exploits is to leak memory using a BSTR overwrite.
How can an attacker leak memory, and how can he use it to effectively bypass ASLR?
this is how a BSTR represented in memory:
Length Data string Terminator
so an attacker will try to get an aligned heapspray and then trigger a vulnerability that will modify the Length part of a BSTR, it can be:
- a heap overflow.
- a use after free that crashes on instructions that can modify a controlled memory address (eg AND 0xFFFFFFFF, edi) where edi is controlled by the attacker and points to the BSTR Length field
- etc.
then the length of the BSTR will be so big that you can read a big block of memory, that simply contain pointers to DLLS, from that you get the base address of those DLLS, AND BOOM!!! ASLR bypassed!
-
Awesome. Thanks. Can you give me an example exploit that uses this technique? If possible, could please provide me a psuedo code that can be used to demonstrate ASLR bypass on windows using this technique? Thanks you very much. – john4tech May 26 '14 at 14:30
Use GetModuleHandle() to get the base address of the module and the offset.
The offset is just current address - base address.
-
But in order to call GetModuleHandle() we need to first bypass DEP. And to bypass DEP we need to first bypass ASLR. Let me know in what context GetModuleHandle() will work? – john4tech May 28 '14 at 6:32
