Lukas' Notes

Instruction Pointer Hijacking

2 min read

security memory

Definition

Instruction Pointer Hijacking

Instruction pointer hijacking is the subclass of stack corruption in which an attacker overwrites the saved return address on the stack to redirect execution when the function returns. Because ret pops whatever sits in the saved-return-address slot into the instruction pointer, an overflow that reaches that slot hands the attacker direct control of rip — the most powerful of the four subclasses, and the one every mitigation in the cluster eventually has to answer.

Redirect to Existing Code

Point the saved return address at an unreachable function

If the binary already contains a useful but unreachable routine, the attacker simply overwrites the saved rip with its address.

void win(void) { system("/bin/sh"); }
void vuln(void) {
    char input[0x100] = {0};
    gets(input);
    return;     // the overflowed saved rip = &win
}
int main(void) { vuln(); return 0; }
  • the layout — input at 0xf600, saved rbp at 0xf700, saved rip at 0xf708
  • the overflow — 0x110 bytes of 'A' overrun input, the saved rbp, and land in the saved rip as the address of win
  • the result — vuln returns into win and spawns a shell

Whole-program reachability is a high-level fiction: dead code is still code, and the only thing preventing it from running is that no jump points at it.

Redirect to Injected Code

When the binary has nothing useful to jump to

What if there is no convenient function in the binary? The attacker then injects their own code — shellcode — into the buffer and points the saved rip there. The injected-bytes variant is how the technique class started (Aleph One, “Smashing the Stack for Fun and Profit”, Phrack 49, 1996); the jump-into-existing-code variant above is its degenerate, NX-free case.

Each Mitigation Targets a Stage

Closing stages one at a time

Every later mitigation closes a different stage of this same family:

  • Stack canary detects that the saved rip was overwritten en route;
  • NX blocks executing the injected payload even when the saved rip points at it;
  • ASLR and PIE defeat the hardcoded addresses the attacker needs to aim the saved rip;
  • and in answer each technique note — ROP, ret2libc, ret2plt — reopens one of those stages.

Hold the picture: every technique in the cluster is a way to keep the saved-return-address overwrite working under one more layer of defence. The insight at the end of the cluster names that pattern.

Backlinks