Question

Disable ASLR on a linux system by writing the appropriate value to /proc/sys/kernel/randomize_va_space. Now get the netsploit attack to work without having the attacked server print out a stack address. You are allowed beforehand to run a test copy of the server that prints its address. You do not have to complete this live. You can turn in the code that should work to accomplish this goal.

Answer 1

Valid Settings:

• 0 = Disabled
• 1 = Conservative Randomization
• 2 = Full Randomization

To view the current settings for ASLR on your system you can use either cat or more specifically using sysctl:

         $ cat /proc/sys/kernel/randomize_va_space

                  2

Using the command ldd we can view the address space of modules required by applications. The address space used is shown in brackets. We run the ldd command twice against the same command, bash. This allows us to see that the module use a different or random address space each time when ASLR is enabled.:

$ ldd /bin/bash
 linux-vdso.so.1 =>  (0x00007fff6f572000)
 libtinfo.so.5 => /lib/x86_64-linux-gnu/libtinfo.so.5 (0x00007fc1ecf16000)
 libdl.so.2 => /lib/x86_64-linux-gnu/libdl.so.2 (0x00007fc1ecd12000)
 libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007fc1ec948000)
 /lib64/ld-linux-x86-64.so.2 (0x00007fc1ed13f000)

$ ldd /bin/bash
 linux-vdso.so.1 =>  (0x00007ffca6113000)
 libtinfo.so.5 => /lib/x86_64-linux-gnu/libtinfo.so.5 (0x00007f8e8dc3e000)
 libdl.so.2 => /lib/x86_64-linux-gnu/libdl.so.2 (0x00007f8e8da3a000)
 libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007f8e8d670000)
 /lib64/ld-linux-x86-64.so.2 (0x00007f8e8de67000)

Disable ASLR:
         Appropriate valuefr disabling ASLR on Linux is 0.

         $ sudo sysctl -w kernel.randomize_va_space=0

Running the same ldd command we see now the modules use the same address space for each execution :

$ ldd /bin/bash
 linux-vdso.so.1 =>  (0x00007ffff7ffa000)
 libtinfo.so.5 => /lib/x86_64-linux-gnu/libtinfo.so.5 (0x00007ffff7bae000)
 libdl.so.2 => /lib/x86_64-linux-gnu/libdl.so.2 (0x00007ffff79aa000)
 libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007ffff75e0000)
 /lib64/ld-linux-x86-64.so.2 (0x00007ffff7dd7000)

$ ldd /bin/bash
 linux-vdso.so.1 =>  (0x00007ffff7ffa000)
 libtinfo.so.5 => /lib/x86_64-linux-gnu/libtinfo.so.5 (0x00007ffff7bae000)
 libdl.so.2 => /lib/x86_64-linux-gnu/libdl.so.2 (0x00007ffff79aa000)
 libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007ffff75e0000)
 /lib64/ld-linux-x86-64.so.2 (0x00007ffff7dd7000)