Hacker Hurdles: DEP & ASLR « Null Byte :: WonderHowTo

This is the first installment in a new series that I am calling "Hacker Hurdles." These are things, methods, techniques that make our job as hackers more challenging and difficult. Don't misunderstand me, these items don't make our task impossible, but rather more challenging and, therefore, more gratifying when we are successful.One of the most important new hurdles for hackers is DEP and ASLR. Data Execution Prevention (DEP) and Address Space Layout Randomization (ASLR) are designed to prevent hackers from being able to do "remote code execution." We as hackers know this as "pwning" the box.Buffer OverflowsMost often, to execute remote code or hack a system, we need to overflow a buffer (look for my upcoming series on buffer overflows) in order to insert our own malicious code into the buffer and then get a command shell ormeterpreter prompt. The meterpreter prompt, for instance, is the malicious code we insert into the buffer and then the CPU executes it, rather than the normal or non-malicious code.DEP is designed to use (execute) only code in a particular part of memory that is designated as the executable area. As you know by now, CPUs are presented with both data and commands. Very often, if we can inject commands where the system was expecting data, we can get the CPU to run them. A good example of this is SQL Injection. In SQL Injection, we enter SQL commands into a web form where we should be entering data, and the commands are then sent back to the CPU and executed.How DEP WorksThe idea behind DEP is that legitimate code would be in the executable area of memory and data (and presumably, malicious code entered as data) would be in the non-executable area. In this way, only legitimate code would be executed and run by the system, thereby preventing hackers from executing their own code and owning a system.If executable code were entered by hackers through data inputs, it would land in the non-executable area of memory and thereby rendered ineffective. DEP was first introduced in Linux in 2004, in Windows XP SP2 in 2004, and in Mac OS X in 2006. It is part of the increasing hardening of commercial operating systems we have seen in recent years.DEP can be enforced in either hardware or software. When enforced in the hardware, there is a NX bit set that says that this code in memory should NOT be executed. For those of you who have some experience withMetasploit, you might have noticed that some payloads are designated as NX. This means that they can be used with DEP in place and the NX bit set.Overcoming DEPAlthough this strategy is ingenious and makes the hacker's job more difficult, it is not impossible to overcome. The key is to find a function with a buffer that does execute in the executable area of memory and then use that buffer's address space to execute the remote code.For example, about one year ago, in August 2013,an exploit(CVE-2013-3893 or MS13-080) was found in the wild that worked well on Windows 7 systems with Internet Explorer 6 through 11 and Office 2007 or 2010 installed. This exploit used Microsoft Office's Help Services address space (which is marked as executable) to run its malicious code.DEP and ASLR are ingenious attempts to keep the hacker from executing their code on remote systems, but it also demonstrates that there is no unhackable system. Given enough time, skill, and knowledge, ALL systems are hackable. The key is to learn and train.It is up to you to take the time to learn and practice, andNull Byteis the place to do that, so keep coming back, my novice hackers!Want to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseRelatedHow To:Exploit Development-Stack Base Buffer Overflow/Part 1(VIDEO)How To:5 Lesser Known Jelly Bean Features on Your Samsung Galaxy S IIIHack Like a Pro:How to Hack Windows 7 to See Whether Your Girlfriend Is Cheating or NotNews:How Zero-Day Exploits Are Bought & SoldThe Hacks of Mr. Robot:How Elliot & Fsociety Destroyed Evil Corp's DataHow To:Become a HackerHow To:Enable or disable Data Execution Prevention (DEP) on a Microsoft Windows PCHow To:Calculate payroll deductions given a hurdle in ExcelHow To:Count unique records exceeding a hurdle in MS ExcelHow To:Perform hurdle rebound jumpsHow To:Replace a long IF with a MIN/MAX formula in ExcelMac for Hackers:How to Get Your Mac Ready for HackingHow To:Train using lateral to forward hurdle drillsHow To:Practice plyometric hurdle jump drillsHow To:Count unique values greater than a hurdle in MS ExcelHow To:Strengthen your lower bodyHow To:Do the Grant Green exercise circuitTypoGuy Explaining Anonymity:A Hackers MindsetHow To:Contain your sheep with hurdlesHow To:Display time over or under a hurdle in Microsoft ExcelHow To:Calculate excess over a hurdle in Microsoft ExcelHow To:Disable uac and dep on Windows VistaNews:Airline Offers Frequent Flyer Miles to HackersNews:The Jackass Olympic GamesNews:Electric Dog Collar OlympicsNews:Anonymous Hackers Replace Police Supplier Website With ‘Tribute to Jeremy HammNews:Student Sentenced to 8mo. in Jail for Hacking FacebookHow To:Conceal a USB Flash Drive in Everyday ItemsNews:TOON BUILDSHow To:How Hackers Take Your Encrypted Passwords & Crack ThemGoodnight Byte:HackThisSite, Realistic 3 - Real Hacking SimulationsHow To:How Hackers Use Your IP Address to Hack Your Computer & How to Stop ItNews:Google+ Hosts First Hangout on Air with will.i.amNews:Planning a Scavenger Hunt Based on Age: Part 4News:Danny MacAskill Continues to Amaze in "Industrial Revolutions"News:Indie and Mainstream Online Games Shut Down by LulzSecNews:The Electric raceRIP:ScroogleNews:Symantec Source Code Released by Anon After Failed NegotiationsHow To:Improve hip girdle strength and flexibility