![](https://csdnimg.cn/release/download_crawler_static/18830951/bg1.jpg)
A-R Exploit:
An Automatic ROP Exploit Based On Long Sequence
Chao Yang
1
, Tao Zheng
2
, Zhitian Lin
1
Software Institute
1
, State Key Laboratory for Novel Software Technology of Nanjing University
2
Software Institute, Nanjing University, Nanjing, 210093, PR China
magicsupery@gmail.com, zt@software.nju.edu.cn, mg1232007@software.nju.edu.cn
Abstract—More attention has been paid to program security
since ROP had been proposed. An ROP defence scheme based on
detecting frequent ret sequences was designed in 2009 and it was
proved an useful way to defend most ROP attacks. However, this
scheme was bypassed by Lgadget, which makes use of long ret
sequences and was proposed by J Cao in 2013. Based on J Cao’s
work, this paper improves the Lgadgets and designs a frame
work automatically distributing gadgets addresses into the stack
to trigger an ROP exploit. Our work includes turing-complete
gadgets gathering, definition and compilation of upper level
language, and automated linking and chaining of the gadgets in
the stack. We demonstrate the viability and effectiveness of this
kind of automatic exploit.
Keywords—ROP; program security; Turing-complete;
automatic program;
I. INTRODUCTION
With the development of W ⊕ X[20] technology, code
injection attacking is no longer a threat for computer security;
however, with the introduction of Return-Into-Libc[3,4,5], W⊕
X is unable to protect program flow from tampering. Hovav
Shacham[2] introduced Return-oriented Programming based on
return-into-libc attack in 2007. ROP overcomes some
restrictions of classical Return-Into-Libc technique including
executing codes in order and removing defences of libc
function. These features cause new threat for program security.
Ping Chen etc. [6] designed a detection schema based on
lengths of short sequences in ROP, so that it can be used to
detect and defend against most ROP attacks. In addition, J
Cao[1] proposed Lgadget in 2013, which made the sequence
length of ROP attacks greater than 5 to break though defences
of Ping Chen’s detection schema. However, this kind of ROP
attacks needs to be manually constructed through combining
various Lgadgets based on specific attacking requirement. In
order to solve problems in constructing ROP attacks manually,
Ralf Hund[7] automatically constructed ROP attacks under
Windows platform through using driver programs, Win32
kernel libraries and Shacham’s short sequences with 2-length
Trie constructions. Besides, Schwartz[21] etc have proposed
the Q to automatically construct the ROP attack which is
similar with this paper. But their ROP attack is based on the
short sequences that it cannot break through the defence
proposed by Ping Chen.
As Ralf’s ROP attack sequences are ineffective under Ping
Chen’s detection schema, this paper will introduce a new meth
od to construct ROP attacks automatically. It mainly researche
s and implements three objectives:
a) To propose an automatic construction method to create R
OP attacks on the basis of long sequences so that attacker
s can break various defence.
b) To improve Lgadget effectively and construct an availabl
e Turing-
complete instruction set using a number of long sequence
instructions on the basis of glibc library.
c) To design an upper-level language similar with C
1. Background
The essential idea of ROP is to analyze code fragments in
various libraries, collect effective instruction segments, and
use these segments to construct gadgets. A series of operations
are constructed by these gadgets to complete operations and
attacks. The program execution flow firstly uses one of
effective attack methods to overwrite the return address of the
primitive function according to instruction addresses in that
stack. When a ret sequence of that primitive function is called,
eip will load the instruction address pointed by current esp to
control this program flow. In order to modify program
attacking flow, buffer overflows methods [9,10,11] can be
used, as well as format string method[12,13].
Pop edx
Pop ecx
Pop ebx
ret
Add [ebx], ecx
ret
esp
Fig. 1. Example of a gadget in the stack