16

I have a program with a heap overflow. It contains some code that is not randomized (is not using ASLR). I want to do a return-oriented programming exploit. Since this is a heap overflow, the first thing I need to do is find a stack pivot, so I can get RSP pointing to a known memory address where my ROP program lives.

What are the state-of-the-art ways to find a stack pivot? What instruction sequences should I look for? Is there a list/database of instruction sequences that can be used as stack pivots?

Also, are there any defenses/mitigations I need to watch out for, or that it would help to be aware of?

For instance, I think I remember that longjmp() calls are a good place to find a stack pivot (e.g., a POP RSP ... RET sequence), assuming I control some value on the stack. However, someone told me that some platforms now incorporate a mitigation to make exploiting longjmp() calls harder: they store setjmp buffers in encrypted form. Is that right, and are there any ways to work around this mitigation, or should I give up on longjmp()s?

Another mitigation is that Windows 8's VirtualProtect function checks that it's being called with RSP set to something reasonable. However, others have documented how to bypass that mitigation, so that's not a barrier -- and anyway, that's not focused on preventing the initial stack pivot. My focus/interest in this question is on the initial stack pivot, not what you do thereafter.

D.W.
  • 98,420
  • 30
  • 267
  • 572
  • 1
    If I am understanding it well, you call a '*stack pivot*' any kind of piece of code that is able to move the stack pointer to a place in memory that you control (the *heap* in your specific case). The point being to execute a ROP there. Am I right ? – perror Nov 12 '13 at 14:48
  • @perror, yes, that's correct. – D.W. Nov 12 '13 at 17:09
  • Well, to start with you'd have to find a POP ESP or MOV ESP somewhere. :) – David Hoelzer Jan 02 '14 at 02:46
  • Unless I am misunderstanding this question, you should be able to just use the Immunity Debugger. – KnightOfNi Jan 28 '14 at 20:49

1 Answers1

3

Have a look at mona by corelan

https://www.corelan.be/index.php/2011/07/14/mona-py-the-manual/

airloom
  • 366
  • 1
  • 5
  • 1
    Thank you for the pointer. Mona looks very interesting. Would you care to expand your answer to explain how it answers the question? For instance, it appears that `mona stackpivot` outputs a file `rop_stackpivot.txt` containing a list of candidate stack pivots, though it's not clear what patterns it looks for or what instruction sequences it looks for. Do you know? – D.W. Feb 04 '14 at 07:09