Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

This is a technique used in "living off the land" in infosec circles. An attacker might not have root privileges, but there might be a bit of code in this program that does one thing with escalated privilege, and a bit of code in that program that does another thing with escalated privilege, and if you have enough of these you can stitch together a "gadget", a series of jumps or calls to these bits of privileged code, to get a shell or do what you want.



This is a bit different. In your case, you're reusing code and data laying around in a running process to do your bidding from within.

Here, I'm actually stealing code and data from one or more executables and turning these back into object files for further use. Think Doctor Frankenstein, but with program parts instead of human parts.

I only operate on dead patients in a manner of speaking, but you could delink stuff from a running process too I suppose. I don't think it would be useful in the context of return-oriented programming, since all the code you can work with is already loaded in memory, there's no need to delink it back to relocatable code first.




Consider applying for YC's Fall 2025 batch! Applications are open till Aug 4

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: