Re: Beating memory address randomization (secuirty) features in Unix/Linux

As long as libc is linked in the vulnerable program it can be returned to, and the shellcode generated is often significantly smaller than typical syscall shellcode.

Do you have the gdb output portraying the libc function addresses that begin with nullbytes?

The Jabberwock

Kaveh Razavi wrote:

I saw null byte at the first byte of libc addresses like system execve etc..
I was running 2.6.13 kernel on a x86 32 bit architecture ( slackware 10.2 )
also I saw it when I tried to exploit a tiny application on another 32/x86
running a 2.6.10 kernel ( slackware 10 ) .
I checked again ( after your reply ) on my new 64/x86 running the lastest
version of kernel ( 2.6.16 slackware 10.2 ) and there was no null byte at
the first.
thanks for your reply but no idea if ret-tolibc is always possible .

Kaveh Razavi
Network Security Researcher

Hash: SHA1

Erm, what "distros" are you talking about? I run the latest
Gentoo on sparc64, pa-risc and ppc and none of them
have a nil byte in libc addresses. Besides, that doesn't
always matter.

Think deeper, you're not always working with strings.

Below are some pastes of functionality on different
architectures. Notice the only one that actually shows
nil bytes is sparc64, but you wont have to worry about
that because you're not going to jump to the first 255

Don "north" Bailey

Here's SuSE on x86

givingtree.north % ./showstack
givingtree.north % ./showstack
givingtree.north % ldd ./showstack => (0xffffe000) => /lib/tls/ (0xb7e39000)
/lib/ (0xb7f59000)
givingtree.north % uname -mr
2.6.16-rc6-givingtree i686
givingtree.north %

Here's Gentoo on PA-RISC

visualize.north % ./showstack
visualize.north % ./showstack
visualize.north % ldd showstack => /lib/ (0x406ad000)
/lib/ => /lib/ (0x4037d000)
visualize.north % uname -mr
2.6.16-rc5-visualize parisc
visualize.north %

Here's Gentoo on sparcv9

blueberry.snow % ./showstack
blueberry.snow % ./showstack
blueberry.snow % ldd showstack => /lib/ (0x70030000)
/lib/ (0x70000000)
blueberry.snow % uname -mr sparc64
blueberry.snow %

Version: PGP Desktop 9.0.5 (Build 5050)