NO LEAK, NO PROBLEM - BYPASSING ASLR WITH A ROP CHAIN TO GAIN RCE

Summary from the TLDR InfoSec newsletter

A showcase on how to exploit a modern ARM-based IoT device, specifically a network camera, by bypassing Address Space Layout Randomization (ASLR) to achieve unauthenticated remote code execution (RCE) using a Return-Oriented Programming (ROP) chain. This approach cleverly bypasses ASLR, a memory protection mechanism designed to block exploit attempts, allowing remote code execution without requiring the leakage of addresses. By manipulating writable memory and leveraging known offsets, the attacker can execute commands on the device, illustrating how gaps in embedded device security can be exploited even with mitigations in place.