return-to-csu: A New Method to Bypass 64-bit Linux ASLR
summary
Claim: return-to-csu is a generic 64‑bit Linux ASLR bypass that uses the startup/CSU code always attached to dynamically linked executables, not the target app. It builds a two‑stage exploit: a small ROP microchain that calls write on a GOT entry to leak libc, then a second-stage ret2libc/ROP payload. A modified drooper auto‑generates a Python exploit and the demo breaks a fully protected fork‑server (PIE, ASLR, NX, canary) in about one to one and a half seconds.
AI-written summary · about
chapters (13)
- 0:00Intro
- 3:09Motivation
- 4:45Overview
- 6:54Brief of the Linux ASLR
- 17:27The real battlefield: The Attached code
- 23:282. The real battlefield: Why it is attached to the exec?
- 25:52Return-to-csu: 64-bit ASLR bypass
- 29:123. Return-to-csu: A controlled call
- 31:313. Return-to-csu: looking for a destination
- 36:57black hat 3. Return-to-csu: Building the final attack
- 40:59Making return-to-csu attack profitable
- 51:12Mitigations and solutions
- 54:47Conclusions and Black Hat Sound Bytes
related talks
58mExploiting Linux and Pax ASLR's Weaknesses on 32-Bit and 64-Bit Systems
36mExploiting Buffer Overflows on RISC-V
51mThe Anatomy of an Exploit
57mReturn Oriented Programming, an introduction
53mSilently Breaking ASLR In The Cloud
35mOn Securing Legacy Software Against Code-Reuse Attacks
57mReturn Oriented Programming, an introduction
36mExploiting Buffer Overflows on RISC-V