# An In-Depth Survey of Bypassing Buffer Overflow Mitigation Techniques
## 4 OS-Based Mitigation Techniques
### Exploiting the ASLR Mitigation Technique  
Address Space Layout Randomization is a protection mechanism used to mitigate buffer overflow attacks. It makes it difficult for attackers to know the exact location of the target code. For example, the attacker can't launch return-to-libc attacks because it requires the base address of libc [47]. However, ASLR is not entirely foolproof and can be bypassed using various techniques such as brute force, return-to-plt or information leakage. In the following section, we have discussed an existing methodology based-on information leakage to bypass the ASLR. This method involves information leak as information leakage attacks are more effective than other techniques for bypassing address \begin{table}
\begin{tabular}{c c c} \hline \hline
**Mitigation Technique** & **Operating System (First Implemented)** & **Strategy** \\ \hline Libsafe & Linux & Execute safe version of vulnerable C \\ Proof-Carrying Code DEC Alpha Processor & & library functions \\ (no practical implementation) & Uses safety policy defined by Code & \\ Program Shepherding & Consumer & \\ Address Obfuscation & Linux & Enforce Security Policy \\ Binary Stirring & Windows and Linux & Randomization Strategy \\ Marlin & Linux (customized bash shell) & Self randomizes instruction addresses \\  & & Randomizes block addresses of binaries \\  & & at load time \\ ASLR & Linux, Windows, macOS, iOS & Randomizes addresses of stack, heap, \\  & & libraries and executables \\ \hline \hline \end{tabular}
\end{table} 
Table 5: Summary of Software Mitigation. space randomization [44]. We will be leaking the Procedure Linkage Table (PLT) and Global Offset Table (GOT) addresses of some functions to launch attack. The Procedure Linkage Table (PLT) is a data structure used to call external functions whose address is resolved at run time by dynamic linker because their addresses are not known at link time and contains jump stubs [48]. Global Offset Table (GOT) is an array that includes absolute addresses of global variables and library functions currently used by the process. The ith entry in the PLT contains jump instruction to go to the address saved in the GOT's ith entry. It can be understood with the help of Figure 14, which shows how func@plt in a C code points towards the PLT entry. Inside PLT, an indirect pointer jump is made to jump to an address inside GOT. Eventually, GOT calls the dynamic linker that is supposed to be resolved and executed actual code in libc. By getting knowledge of the absolute address of a single function, the adversary will be able to launch a successful attack. Thus, we are going to exploit PLT and GOT for getting address of a single function residing in libc to launch attack. Step by Step Procedure of Bypassing ASLR Mitigation  
The Figure 15 shows the flow of strategy that we have used to bypass ASLR. **Phase 1:** Figure 16 shows a C vulnerable program that consists of a function getMessage() being called by the main() function. After declaring a character buffer of size 200 bytes, it takes input from the user via scanf() function. Since, we know that scanf() has no check for bounds, it takes input until it encounters a white-space or newline character. Hence, we have a buffer overflow vulnerability here. As observed utilizing this vulnerability ASLR can be bypassed. At first, the vulnerable program is compiled by disabling additional protection mechanisms in addition to ASLR as detailed in Section 3.2.2 (Steps to bypass NX bit mitigation). Address Space Layout Randomization (ASLR) is enabled by placing two (2) in the randomize_va_space file, which shows that process address space is fully randomized. Checksec can be used to identify the mitigation techniques that are enabled and disabled. This is shown in Figure 17.  
**Phase 2:** Following this step is preparation of the exploit payload, which consists of two stages. In the first stage, information will be leaked through GOT. To determine the PLT address of any available function in the program that is used to leak addresses from GOT.