On Wed, Sep 23, 2020 at 05:18:35PM +0200, Pavel Machek wrote: > > It sure does make sense to combine ret2libc/ROP to mprotect() with one's > > own injected shellcode. Compared to doing everything from ROP, this is > > easier and more reliable across versions/builds if the desired > > payload > > Ok, so this starts to be a bit confusing. > > I thought W^X is to protect from attackers that have overflowed buffer > somewhere, but can not to do arbitrary syscalls, yet. > > You are saying that there's important class of attackers that can do > some syscalls but not arbitrary ones. They might be able to do many, most, or all arbitrary syscalls via ret2libc or such. The crucial detail is that each time they do that, they risk incompatibility with the given target system (version, build, maybe ASLR if gadgets from multiple libraries are involved). By using mprotect(), they only take this risk once (need to get the address of an mprotect() gadget and of what to change protections on right), and then they can invoke multiple syscalls from their shellcode more reliably. So for doing a lot of work, mprotect() combined with injected code can be easier and more reliable. It is also an extra option an attacker can use, in addition to doing everything via borrowed code. More flexibility for the attacker means the attacker may choose whichever approach works better in a given case (or try several). I am embarrassed for not thinking/recalling this when I first posted earlier today. It's actually obvious. I'm just getting old and rusty. > I'd like to see definition of that attacker (and perhaps description > of the system the protection is expected to be useful on -- if it is > not close to common Linux distros). There's nothing unusual about that attacker and the system. A couple of other things Brad kindly pointed out: SELinux already has similar protections (execmem, execmod): http://lkml.iu.edu/hypermail/linux/kernel/0508.2/0194.html https://danwalsh.livejournal.com/6117.html PaX MPROTECT is implemented in a way or at a layer that covers ptrace() abuse that I mentioned. (At least that's how I understood Brad.) Alexander P.S. Meanwhile, Twitter locked my account "for security purposes". Fun. I'll just let it be for now.
