Re: No-Exec Stack Smashing 101

[woloszyn () IPARTNERS PL (M.C.Mar)]

On Tue, 25 Apr 2000 lamont () icopyright com wrote:

> Okay, lets say that you've got:
>
> 1.  non-exec stack
> 2.  libc remapped to location with 0x00 in it
> 3.  statically linked executable, so no PLT functions
>
> And assume the bug is a simple buffer overflow in a string function which
> terminates on a 0x00 (i.e. ignore for the moment ways around a 0x00
> "canary")
>
> How can you get around that?  Is there a more general way around non-exec
> stacks than return-into-PLT exploits?
Hi!

Yes! If I have staticly linked binary I make one general assumption:
vulnerable program uses strcpy(). If so I need to find strcpy() address in
its text segmend, then find any rwx segment (there is allways one, you can
find it via /proc/PID/maps) and follow the same way as I described before.
All of this applyes to local vulnerabilities, or any vulnerabilities that
allows me to examine vulnerable binary.

--
Mariusz Wo³oszyn
Internet Security Specialist, IT -- Internet Partners
E-mail: Mariusz.Woloszyn () it pl, woloszyn () it pl