Chrome OS : Ways to Bypass Kernel protections

Chrome OS : Ways to Bypass Kernel protections

*First Protection to Bypass : NX (Never eXecute)*

Programs usually don't need to put their code on stack, so, it's logical to prevent them from doing it and executing content from there. NX is a protection option coming from processor used to control execution rights from some pages and used by Linux kernel. In this way, the operating system can use this facility to define what pages will have code and what others will have data.

So, with this protection, we still can store our shellcode in the stack, but, we can't execute it. How to check it ?

We need to ask for the CPU features of our current machine though 'flags' and founf that >NX< flag is active, it means NX protection is on.

We can bypass this protection using something called ret2libc only if another protection called ASLR (Address Space Layout Randomization) is not used (ASLR works as like sharm on 64bits processors and not so good on 32bits). A more extended and better way is to use ROP (Return Oriented Programming) because it can use any library you got as far as you know it very well and have the conditions required (actually, ret2libc is a basic form of ROP).

Also, just for the records, stack-smashing protection will help to prevent this kind of attacks too.

Comments

Popular posts from this blog

How to Watch 18+ Videos On You-tube Without Signing In?

Basic Of Electric Guitar And Electric Guitar Buying Guide

Cancer :Facts Which are Common And Death Which Are Popular