Leaking LibC
ASLR bypass
If the ASLR is enable, an address of a libc function will be leak in order to know the address of the others libc functions.
Leaking Libc function address
In order to obtain an address, the ret2plt attack can be used :
Here the process will print the address of the puts
function.
Finding LIBC library
To determine which version of the libc library is being used by the program, it is necessary to find which library version contains the 'puts' function at the given address.
This can be done by searching through the available library versions and comparing the addresses of the 'printf' function. Once the library version that contains the 'printf' function at the given address is found, it can be determined that this is the version of libc being used by the program.
Fortunately, several databases and tools are available to make this process easier such as "Libc database search engine" or "libc database"
Getting libc base address
Note that final libc base address must end in 00. If that's not your case you might have leaked an incorrect library.
Resources
Last updated