BROP is such a clean ASLR bypass. After brute-forcing the stack canary, the attacker starts overwriting the return address with guesses. Most guessed addresses jump into garbage or non-executable memory. The child process segfaults, and the socket closes. But occasionally, a guessed return address lands in real code that... does something like sleep, pause, or an infinite loop. The process hangs, so the socket stays open. That address becomes a stop gadget. A known "safe landing pad" in the ROP chain. It gives the attacker a reusable signal. From there, they probe for stack-pop gadgets. probe_addr > trap_addr > stop_addr If probe_addr is not a pop reg; ret, execution returns into the trap address and crashes. If probe_addr is a pop reg; ret, it consumes the trap value from the stack and returns into the stop gadget instead. The socket stays open. So the attacker can remotely classify gadgets without seeing the binary. On x86-64, syscall/function args are in registers, not on the stack. So it’s not enough to know "this gadget pops one value." You need to know which register it controls. BROP uses signal syscalls like pause to map the gadgets. find pop rax; ret find pop rdi; ret find pop rsi; ret find pop rdx; ret find syscall Once those gadgets are identified, the attacker can directly assemble a write(2) syscall: rax = SYS_write rdi = socket fd rsi = pointer into .text rdx = length then return into syscall to execute it Once write(2) is reachable, BROP turns the live process into its own ASLR leak, and the server sends its text segment back over the socket. From that dump, the attacker recovers gadgets and offsets offline, then builds the final ROP chain for the same randomized layout the forked server keeps reusing. MIT 6.858.show more

tetsuo

236,499 subscribers

分享 下载