Sigreturn oriented programming is a real threat
Rémi Mabon · Repository of Futwangen University of Applied Sciences (Furtwangen University) · 2016
This paper shows that Sigreturn Oriented Programming (SROP), which consists of using calls to sigreturn to execute arbitrary code, is ap owerful method for the development of exploits.This is demonstrated by developing twodifferent kinds of SROP based exploits, one asterisk exploit which wasa lready portrayed in the paper presenting SROP,a nd one novele xploit for ar ecently disclosed bugi nt he DNS address resolution of the default GNU Cl ibrary.T aking advantage of the fact, that these exploits have very fewd ependencies on the program being exploited, al ibrary is implemented to automate wide parts of SROP exploit creation.This highlights the potential of SROP in respect to reusable and portable exploit code which strongly supports the conclusion of the original paper: SROP is areal threat!