Advanced Return to libc Exploits

This article can be roughly divided into two parts. First, the
advanced return-into-lib(c) techniques are described. Some of the presented
ideas, or rather similar ones, have already been published by others.
However, the available pieces of information are dispersed, usually
platform-specific, somewhat limited, and the accompanying source code is not
instructive enough (or at all). Therefore I have decided to assemble the
available bits and a few of my thoughts into a single document, which should
be useful as a convenient reference. Judging by the contents of many posts
on security lists, the presented information is by no means the common
knowledge.
The second part is devoted to methods of bypassing PaX in case of
stack buffer overflow (other types of vulnerabilities are discussed at the
end). The recent PaX improvements, namely randomization of addresses the
stack and the libraries are mmapped at, pose an untrivial challenge for an
exploit coder. An original technique of calling directly the dynamic linker's
symbol resolution procedure is presented. This method is very generic and the
conditions required for successful exploitation are usually satisfied.
Because PaX is Intel platform specific, the sample source code has been
prepared for Linux i386 glibc systems. PaX is not considered sufficiently
stable by most people; however, the presented techniques (described for
Linux on i386 case) should be portable to other OSes/architectures and can
be possibly used to evade other non-executability schemes, including ones
implemented by hardware.
The reader is supposed to possess the knowledge on standard exploit
techniques. Articles [1] and [2] should probably be assimilated before
further reading. [12] contains a practical description of ELF internals.
--[ 2 - Classical return-into-libc
The classical return-into-libc technique is well described in [2], so
just a short summary here. This method is most commonly used to evade
protection offered by the non-executable stack. Instead of returning into
code located within the stack, the vulnerable function should return into a
memory area occupied by a dynamic library. It can be achieved by
overflowing a stack buffer with the following payload:
------------------------------------------------------------------
| buffer fill-up(*)| function_in_lib | dummy_int32 | arg_1 | arg_2 | ...
------------------------------------------------------------------
^
|
- this int32 should overwrite saved return address
of a vulnerable function
(*) buffer fill-up should overwrite saved %ebp placeholder as well, if the
latter is used
When the function containing the overflown buffer returns, the
execution will resume at function_in_lib, which should be the address of a
library function. From this function's point of view, dummy_int32 will be the
return address, and arg_1, arg_2 and the following words - the arguments.