Exploit › Module 4 › Lesson 1
ASLR NX Canary
ASLR randomizes mappings, NX blocks execute-from-data, canaries detect stack smashes — verify on YOUR $PWN_LAB toys with checksec literacy.
Visual · pwn_aslr_nx_canary
ASLR/NX/canary literacy. $PWN_LAB only. Original Cyberlium.
Opening
Protections raise cost — they do not replace fixing unsafe C; verify them on toys you compile.
ASLR (Address Space Layout Randomization) varies load addresses each run — frustrates fixed-address assumptions. NX/DEP marks pages non-executable — data/stack should not run as code. Stack canaries insert a checked value before return — abort on mismatch. Cyberlium teaches naming and verifying these on YOUR toy binaries at $PWN_LAB via readelf, gcc flags, and checksec — not bypass tutorials. Next: PIE/RELRO.
1. ASLR (named)
PIE executables and shared libraries load at randomized bases when ASLR is enabled in the OS. cat /proc/sys/kernel/randomize_va_space on Linux lab VM — document level for YOUR notes.
Literacy: defenders enable ASLR; attackers historically studied info leaks — your job is verify it is on for shipped builds.
Command guide
Try these commands — ASLR (named)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
NX/DEP literacy — https://man7.org/linux/man-pages/man5/elf.5.html (GNU_STACK segment) Stack canary — https://gcc.gnu.org/onlinedocs/gcc/Instrumentation-Options.html#index-fstack-protector checksec — https://github.com/slimm609/checksec.sh (NX/Canary/PIE summary)
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install build-essential sudo apt install binutils
macOS:
Command — copy this
xcode-select --install # or brew install gcc brew install binutils
Windows: Use WSL or MinGW Use WSL binutils
═══ LINUX / macOS ═══
Optional command
sudo apt install binutils # readelf objdump
Command — copy this
export LAB_PWN=${LAB_PWN:-$HOME/cyberlium-lab/t24-pwn}
gcc -Wall -Wno-deprecated-declarations -O0 -g -o "$LAB_PWN/bin/bof_noprotect" "$LAB_PWN/src/bof_vuln.c"
readelf -l "$LAB_PWN/bin/bof_noprotect" | grep -E 'GNU_STACK|RWE'
readelf -d "$LAB_PWN/bin/bof_noprotect" 2>/dev/null | head -8
echo 'ASLR: kernel randomizes load addresses — observe with checksec/readelf, not bypass chains'Primary tools to practice this lesson: gcc, readelf. Reference sites: NX/DEP literacy (https://man7.org/linux/man-pages/man5/elf.5.html); Stack canary (https://gcc.gnu.org/onlinedocs/gcc/Instrumentation-Options.html#index-fstack-protector); checksec (https://github.com/slimm609/checksec.sh). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. NX / DEP (named)
GNU_STACK with RW absent E in readelf -l indicates NX for stack. Attempting execute from stack faults — observed as crash, not shell.
On $PWN_LAB, compare NX on vs intentional -z execstack toy ONLY inside VM to see warning difference — revert snapshot after.
3. Stack canary (named)
Compiler emits canary check in function epilogue — __stack_chk_fail on mismatch. -fstack-protector-strong is common default on many distros.
Ship: protection trio table — ASLR, NX, canary — definition, verify command, expected ON for secure toy build. Next: PIE/RELRO.
4. What you ship: ASLR/NX/canary table for $PWN_LAB
Three protections with verify commands and ON/OFF for YOUR secure toy build. NO bypass steps. chmod 600.
5. What you record before the next lesson
Date. Protection trio table. $PWN_LAB named. File t24-m04-l01-aslr-nx-canary.txt chmod 600.
6. Wrong vs right: weaponized exploits vs memory-safety literacy
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Tutorial to disable all protections globally on production. Publish NX bypass chain.
Right
Write ASLR/NX/canary table with checksec/readelf proof from YOUR toy. Next: PIE/RELRO.
Mission: verify trio on YOUR toy
1) Define ASLR, NX, canary in one line each. 2) Record verify commands used. 3) Note ON/OFF for secure build. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Secure defaults beat manual hardening you forget.
Knowledge Check
APPLY: ASLR literacy means:
Multiple choice
Knowledge Check
APPLY: True or False: NX aims to prevent executing data pages as code.
True or False
Knowledge Check
APPLY: Stack canary mismatch typically:
Multiple choice