Mirrors/hacktricks
2
0
Fork 0
mirror of https://github.com/carlospolop/hacktricks synced 2024-11-21 20:23:18 +00:00
Code Issues Projects Releases Packages Wiki Activity
hacktricks/binary-exploitation/common-binary-protections-and-bypasses/relro.md
Carlos Polop 731fca1d57 a
2024-07-18 18:14:56 +02:00

4 KiB
Raw Blame History

Relro

{% hint style="success" %} Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

Support HackTricks
{% endhint %}

Relro

RELRO stands for Relocation Read-Only, and it's a security feature used in binaries to mitigate the risks associated with GOT (Global Offset Table) overwrites. Let's break down the concept into its two distinct types for clarity: Partial RELRO and Full RELRO.

Partial RELRO

Partial RELRO takes a simpler approach to enhance security without significantly impacting the binary's performance. By positioning the GOT above the program's variables in memory, Partial RELRO aims to prevent buffer overflows from reaching and corrupting the GOT.

This doesn't prevent the GOT to be abused from arbitrary write vulnerabilities.

Full RELRO

Full RELRO steps up the protection by making the GOT and .fini_array section completely read-only. Once the binary starts all the function addresses are resolved and loaded in the GOT, then, GOT is marked as read-only, effectively preventing any modifications to it during runtime.

However, the trade-off with Full RELRO is in terms of performance and startup time. Because it needs to resolve all dynamic symbols at startup before marking the GOT as read-only, binaries with Full RELRO enabled may experience longer load times. This additional startup overhead is why Full RELRO is not enabled by default in all binaries.

It's possible to see if Full RELRO is enabled in a binary with:

readelf -l /proc/ID_PROC/exe | grep BIND_NOW

Bypass

If Full RELRO is enabled, the only way to bypass it is to find another way that doesn't need to write in the GOT table to get arbitrary execution.

Note that LIBC's GOT is usually Partial RELRO, so it can be modified with an arbitrary write. More information in Targetting libc GOT entries.

{% hint style="success" %} Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

Support HackTricks
{% endhint %}