[null, {"document_url": "https://www.hack4.net/2017/11/aslray-linux-elf-x32-and-x64-aslr.html", "unformatted_src": "https://3.bp.blogspot.com/-cZ7UakRcLS8/WfJqo0-wZnI/AAAAAAAAJP8/cuGsEYviO8wgwmtmH6sBjs_OLmLKfW_pACLcBGAs/s1600/ASLRay.jpg", "src": "https://3.bp.blogspot.com/-cZ7UakRcLS8/WfJqo0-wZnI/AAAAAAAAJP8/cuGsEYviO8wgwmtmH6sBjs_OLmLKfW_pACLcBGAs/s1600/ASLRay.jpg", "formatted_filename": "ASLRay"}, null, null, null, null, null, null]
Home linux bypass exploit pentest tool ASLRay - Linux ELF x32 and x64 ASLR bypass exploit with stack-spraying

November 05, 2017 linux bypass exploit, pentest tool Linux ELF x32 and x64 ASLR bypass exploit with stack-spraying.

You might have heard of Heap Spraying attack? Well, Stack Spraying is similar, however, it was considered unpractical for most cases, especially ASLR on x86-64.
My work will prove the opposite.
For 32-bit, there are 2^32 (4 294 967 296) theoretical addresses, nevertheless, the kernel will allow to control about only half of bits (2^(32/2) = 65 536) for an execution in a virtualized memory, which means that if we control more that 50 000 characters in stack, we are almost sure to point to our shellcode, regardless the address, thanks to kernel redirection and retranslation.
This can be achieved using shell variables, which aren't really limited to a specific length, but practical limit is about one million, otherwise it will saturate the TTY.
So, in order to exploit successfully, we need to put a NOP sled following the shellcode into a shell variable and just exploit the binary with a random address.
In 64-bit system the situation is different, but not so much as of my discovery.
Of course, you wouldn't have to cover all 2^64 possibilities, in fact, the kernel allows only 48 bits, plus a part of them are predictable and static, which left us with about 2^(4x8+5) (137 438 953 472) possibilities.
I have mentioned the shell variables size limit, but there is also a count limit, which appears to be about 10, thus allowing us to stock a 10 000 000 character shellcode, living us with just a tenth of thousand possibilities that can be tested rapidly and automatically.
That said, ASLR on both 32 and 64-bits can be easily bypassed in few minutes and with few lines of shell...
If you have exploited at least one buffer overflow in your life, you can skip, but just in case:
Don't forget to check stack execution and ASLR both set:

Download ASLRay



