Calling a function in C without naming it
9 hours ago
- School grading system restricts function usage to approved symbols, preventing direct execve call.
- ASLR randomizes addresses but relative offsets between functions remain constant.
- System compiles with AddressSanitizer (ASan), replacing some libc functions like printf but not execve or mmap.
- Leak offset between printf and mmap via a separate allowed exercise to compute mmap address.
- Use union type punning to bypass compiler restrictions on function pointer casting.
- Call mmap to allocate writable and executable memory, then write syscall shellcode.
- Execute arbitrary system calls (e.g., execve) via the custom shellcode to achieve shell access.
- Exploit is non-trivial to patch because ASLR and name checks are ineffective, and ASan aids the attack.