notes: Hacking Blind

最新推荐文章于 2026-05-28 10:41:13 发布

原创最新推荐文章于 2026-05-28 10:41:13 发布 · 388 阅读

0 ·

本内容遵循CC 4.0 BY-SA版权协议

收录于

readings

当前文章被收录于：

readings

1 篇文章 0 人学习

订阅专栏查看详情

当前文章被以下社区和专栏收录：

本文介绍了一种名为HackingBlind的技术，该技术能够在未知目标二进制代码及源码的情况下发动栈缓冲区溢出攻击。通过利用目标的栈漏洞并观察其是否崩溃来收集信息，进而读取栈内存中的保护机制（如canaries）和返回地址以绕过ASLR保护。最终，通过盲目的ROP技术找到足够的gadget以执行写系统调用，从而实现远程内存转储和shellcode注入。

1. Title

Hacking Blind
Andrea Bittau, Adam Belay, Ali Mashtizadeh, David Mazières, Dan Boneh
Stanford University

2. Skeleton

It illustrates that it is possible to launch stack buffer overflow exploits without knowing the binary and source of targets.

prerequiste:

the target with stack vulnerability
the target will be restarted after a crash

The attacker can probe the information about targets through the stack vulnerability based on whether the targets crash or not. As the targets will be restarted, the bad guy can enforce step-by-step attempts until he finds the right attempt that the targets will not be down. This stack reading can expose canaries and a return address to defeat ASLR(Address Space Layout Randomization).
And blind ROP aims to find enough gadgets to perform the write system call, so that the attacker can dump memory to his socket. After which, he collects abundant gadgets to build a shellcode, and launch the final exploit.