Bug Hunter Diary

To check the system-wide configurations of Linux systems as wellas ELF binaries and processes for different exploit mitigation techniques,you can use my checksec.sh 9 script.C.2 RELRORELRO is a generic exploit mitigation technique to harden thedata sections of an ELF 10 binary or process. ELF is a common fileformat for executables and libraries that is used by a variety of UNIXlikesystems, including Linux, Solaris, and BSD. RELRO has twodifferent modes:Partial RELRO• Compiler command line: gcc -Wl,-z,relro.• The ELF sections are reordered so that the ELF internal datasections (.got, .dtors, etc.) precede the program’s data sections(.data and .bss).• Non-PLT GOT is read-only.• PLT-dependent GOT is still writeable.Full RELRO• Compiler command line: gcc -Wl,-z,relro,-z,now.• Supports all the features of Partial RELRO.• Bonus: The entire GOT is (re)mapped as read-only.Both Partial and Full RELRO reorder the ELF internal data sectionsto protect them from being overwritten in the event of a bufferoverflow in the program’s data sections (.data and .bss), but only FullRELRO mitigates the popular technique of modifying a GOT entry toget control over the program execution flow (see Section A.4).To demonstrate the RELRO mitigation technique, I made up twosimple test cases. I used Debian Linux 6.0 as a platform.Test Case 1: Partial RELROThe test program in Listing C-1 takes a memory address (see line 6)and tries to write the value 0x41414141 at that address (see line 8).01 #include 0203 int04 main (int argc, char *argv[])05 {06 size_t *p = (size_t *)strtol (argv[1], NULL, 16);07Mitigation 183