Metadata
- Source
- File: return-to-csu by Marco-Gisbert, Ripoll-Ripoll (2018).pdf
- Zotero: View Item
- Type: Journal Article
- Title: return-to-csu: A New Method to Bypass 64-bit Linux ASLR,
- Author: Marco-Gisbert, Hector; Ripoll-Ripoll, Ismael;
- Pages: 24
- Year: 2018
Abstract
In this paper, we will present “return-to-csu” - a new method to bypass the ASLR in 64-bit Linux systems. The method is generic, since it does not use the compiled code from the target application but code that is always “silently attached” to it. This, in practice, means that our attack can be applied to any application. We will present our analysis, which reveals who is attaching this “extra code” to the executable memory (not to the shared libraries memory region) and why this code can not be easily protected/removed by application developers.
Although the idea of incremental compilation to do less work sounds generally good, it could raise some security issues. Having code which is not re-compiled could result in old or less protected code that can be abused by attackers. As a proof of that, we will present an attack abusing this extra code to bypass the ASLR in 64-bit Linux systems.
We will briefly describe the code that is out of the developers control, showing why it is “unsafe” and how it can be abused finding that there are enough assembler instructions that can be used to created what we named “return-to-csu” - a method to bypass the full Linux ASLR in 64-bit systems in a reliable, fast and generic way.
We will disclose the exploit and a live proof of concept using the return-to-csu method to obtain a shell in less than 1 second. The attack works on PIE and non-PIE applications as well as on hardened (PaX) systems. To make it more realistic, in the demonstration we will also bypass the NX, SSP, RELRO and other protections. To illustrate the method we will exploit, we will use a classic stack buffer overflow showing that a stack buffer overflow is synonymous of having a remote shell even in current 64-bit full protected application in most of the cases.
Finally, we will discuss the root cause and provide some recommendations to prevent the return-to-csu attack.
Tags and Collections
- Keywords: 05 Finished; Binary Exploitation; Return Oriented Programming (ROP); Universal ROP; ret2csu
Comments