Bropper - An Automatic Blind ROP Exploitation Tool

An automatic Blind ROP exploitation python tool

Abstract

BROP (Blind ROP) was a technique found by Andrew Bittau from Stanford in 2014.

• Original paper
• Slides

Most servers like nginx, Apache, MySQL, forks then communicates with the client. This means canary and addresses stay the same even if there is ASLR and PIE. So we can use some educated brute force to leak information and subsequently craft a working exploit.

Flow of exploitation

1. Find buffer overflow offset
2. Find canary
3. Find saved …

addresses apache aslr automatic client exploitation mysql nginx python rop rop exploitation rop gadgets servers slides stanford tool