This question already has an answer here:

I have read some articles about bypassing DEP and ASLR , but it seems that they bypass ASLR and DEP by using the instructions in the modules not applying ASLR.But how to bypass ASLR and DEP in the modules applying both this two protection?

marked as duplicate by Steve, ISMSDEV, Xiong Chiamiov, schroeder Nov 30 '17 at 8:17



Like you said, first ASLR will have to be defeated before any DEP circumvention can be applied. This is usually done by leaking pointers with a separate memory disclosure vulnerability. Then when the location of the code pages is known, the usual technique of a return to libc can be applied.

  • How can a leadking pointer with a separate memory disclosure vulnerability used to bypass ASLR?I have seen this question,but I do not understand quite well – freedom2 Feb 23 '17 at 2:23
  • ASLR is randomization. If you knew the place beforehand, or you could know the layout while performing the exploit, you can adjust your offsets and gain control. The main point is that ASLR does not prevent control of EIP, but tries to make it useless – J.A.K. Feb 23 '17 at 7:54
  • 1
    @freedom2 : aslr bypass is only for programs that uses networking : by leaking data to your server or you local program you guess the memory layout and generate an exploit that will cause a jump to the correct address for a rop chain by corrupting allocated size info. If your program doesn’t even perform a dns request, then I think aslr isn’t only a mitigation : it completely prevent remote code execution in the case of buffer overflows security.stackexchange.com/q/154310/36301 (you have to find other kinds of vulnerabilities for code execution). – user2284570 Mar 19 '17 at 22:55
  • This is incorrect @user2284570. In fact the opposite is true. ASLR is most useful over the network, because infoleaks of that type over the network are rare. For a local attacker, ASLR is actually easy to bypass, e.g. by using timing attacks. – forest Nov 29 '17 at 3:53
  • @Baal-zebub : I was talking about remote attacks that can’t use networking. things like buffer ovverun inside a .rar archiver. – user2284570 Nov 29 '17 at 4:26
