최신 익스플로잇 완화 기법과 우회

You can identify binary vulnerabilities, fuzz for bugs, and understand exploit primitives. Modern systems add mitigations that turn an easy bug into a hard one.

Knowing these defenses tells you what a working exploit must overcome.

DEP (a.k.a. the NX bit) marks memory as non-executable. Code injected onto the stack will not run.

This killed classic 'shellcode on the stack' attacks and pushed exploiters toward code reuse.

To bypass DEP, attackers reuse existing executable code. ROP chains together short instruction sequences (gadgets) ending in ret to perform arbitrary actions without injecting code.

ASLR randomizes where modules, stack, and heap load each run, so attackers cannot hardcode addresses.

Without a known address, both shellcode and ROP gadgets are hard to target.

ASLR is bypassed with an information leak: a bug that discloses a real runtime address. From one leaked pointer you compute the module base and locate your gadgets.

Many modern exploits are really 'leak then exploit' two-stage attacks.

A stack canary is a random value placed before the saved return address. A linear stack overflow overwrites it, and the function aborts on mismatch.

Canaries are defeated by:

• Leaking the canary value, then writing it back unchanged
• Overwriting structures that skip the check (e.g. a non-linear write)

This is why info leaks are so valuable.

CFI and Windows' CFG validate indirect calls and returns against a set of legitimate targets, breaking many ROP chains.

Hardware features like Intel CET add a shadow stack to protect return addresses.

Other hardening you will encounter:

• Full RELRO makes the GOT read-only, blocking GOT-overwrite tricks
• FORTIFY_SOURCE adds bounds checks to common functions

Check which are enabled before planning an approach.

Exploit development is an enumerate-then-bypass process: list active mitigations, then find the bug or leak that neutralizes each. Strong defenses do not make exploitation impossible, only more demanding.

PIE (Position Independent Executable) lets ASLR randomize the main binary itself, not just libraries. Without PIE, the executable loads at a fixed base, giving attackers reliable gadget addresses.

checksec reporting 'PIE: No' is a meaningful weakness worth noting.

You now map the modern defensive landscape:

• DEP/NX blocks injected code; ROP reuses existing code
• ASLR randomizes addresses; info leaks defeat it
• Canaries, CFI/CFG, RELRO add further hurdles

Real exploitation means enumerating these and chaining bugs to bypass each.