DEF CON 33 - Can't Stop the ROP: Automating Universal ASLR Bypasses - Bramwell Brizendine

Dr. Bramwell Brunszine presents a universal technique to bypass Windows High Entropy ASLR by using Return-Oriented Programming (ROP) to traverse the Process Environment Block (PEB) and locate system DLL base addresses 1:36.

Key Takeaways:
• The attack exploits the predictable structure of the PEB and loader data, allowing an attacker to derive the base address of system DLLs like Kernel32, effectively nullifying ASLR protections 6:58.
• This method requires an existing memory corruption vulnerability to execute ROP gadgets but only needs simple instructions like mov, add, and pop to traverse memory structures 8:20.
• Alternative methods to access the PEB include using system calls such as NtQueryInformationProcess or NtQueryInformationThread if direct register access is unavailable 16:28.
• The speaker released an update to the "ROP Rocket" tool that automates the creation of these exploit chains, generating 36 different bypass variants 30:00.

Microsoft acknowledged the vulnerability but declined to fix it or issue a bug bounty, arguing that it serves only as an enhancer to pre-existing exploits 34:06.

Sources:

• 1:36 Introduction to the ASLR bypass flaw
• 6:58 Using the PEB to find DLL bases
• 8:20 Explanation of the ROP chain approach
• 16:28 Alternative syscall methods
• 30:00 Automation with ROP Rocket
• 34:06 M