'return orient programming and stack canaries
Is it possible to utilize ROP when Stack canaries are in place without any other "helpers" to bypass the canary values? If so could you please provide some resources/material that further explains how it'd be done when one is just using ROP without any other techniques?
Solution 1:[1]
It depends. Computers have two memory access types:
- Sequential access: From the start of the buffer you have to completely overwrite all the following bytes up to
buf+len(payload) - Direct access: It's an arbitrary write. You can overwrite the value at the exact address you want
Probably you were considering only the first case and I'm pretty sure that, without any "helper", you can't bypass the canary. The only way would be to bruteforce its value.
In case of an arbitrary write, which can happen with a format string (an old type of vulnerability) or heap vulnerability, you just have to overwrite the stack avoiding the canary address.
N.B.: Arbitrary write is still way harder to achieve
Sources
This article follows the attribution requirements of Stack Overflow and is licensed under CC BY-SA 3.0.
Source: Stack Overflow
| Solution | Source |
|---|---|
| Solution 1 | Marco Balo |