PIE

{% hint style="success" %} Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

Support HackTricks

Check the subscription plans!
Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦 @hacktricks_live.
Share hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.

{% endhint %}

Basic Information

A binary compiled as PIE, or Position Independent Executable, means the program can load at different memory locations each time it's executed, preventing hardcoded addresses.

The trick to exploit these binaries lies in exploiting the relative addresses—the offsets between parts of the program remain the same even if the absolute locations change. To bypass PIE, you only need to leak one address, typically from the stack using vulnerabilities like format string attacks. Once you have an address, you can calculate others by their fixed offsets.

A helpful hint in exploiting PIE binaries is that their base address typically ends in 000 due to memory pages being the units of randomization, sized at 0x1000 bytes. This alignment can be a critical check if an exploit isn't working as expected, indicating whether the correct base address has been identified.
Or you can use this for your exploit, if you leak that an address is located at 0x649e1024 you know that the base address is 0x649e1000 and from the you can just calculate offsets of functions and locations.

Bypasses

In order to bypass PIE it's needed to leak some address of the loaded binary, there are some options for this:

Disabled ASLR: If ASLR is disabled a binary compiled with PIE is always going to be loaded in the same address, therefore PIE is going to be useless as the addresses of the objects are always going to be in the same place.
Be given the leak (common in easy CTF challenges, check this example)
Brute-force EBP and EIP values in the stack until you leak the correct ones:

{% content-ref url="bypassing-canary-and-pie.md" %} bypassing-canary-and-pie.md {% endcontent-ref %}

Use an arbitrary read vulnerability such as format string to leak an address of the binary (e.g. from the stack, like in the previous technique) to get the base of the binary and use offsets from there. Find an example here.

References

https://ir0nstone.gitbook.io/notes/types/stack/pie