Difference between revisions of "Exploit Methods/Reused code chunks"
Jump to navigation
Jump to search
(Created page with "= Details = This is more generally knows as Return Oriented Programming (ROP) or Jump Oriented Programming (JOP), but ultimately boils down to using the kernel's own executabl...") |
|||
| Line 3: | Line 3: | ||
= Examples = | = Examples = | ||
* [http://vulnfactory.org/research/h2hc-remote.pdf | * [https://github.com/djrbliss/rose-exploit remote execution] ([http://vulnfactory.org/research/h2hc-remote.pdf slides]) | ||
= Mitigations = | = Mitigations = | ||
* compiler instrumentation for Control Flow Integrity (CFI) | * compiler instrumentation for Control Flow Integrity (CFI) | ||
* Return Address Protection, Indirect Control Transfer Protection (e.g. [https://pax.grsecurity.net/docs/PaXTeam-H2HC15-RAP-RIP-ROP.pdf RAP]) | * Return Address Protection, Indirect Control Transfer Protection (e.g. [https://pax.grsecurity.net/docs/PaXTeam-H2HC15-RAP-RIP-ROP.pdf RAP]) | ||
Revision as of 22:34, 12 April 2016
Details
This is more generally knows as Return Oriented Programming (ROP) or Jump Oriented Programming (JOP), but ultimately boils down to using the kernel's own executable memory to build a chain of gadgets in order to perform the attacker's exploit.
Examples
Mitigations
- compiler instrumentation for Control Flow Integrity (CFI)
- Return Address Protection, Indirect Control Transfer Protection (e.g. RAP)