HackTricks Press
Search K

Appearance

Relro ​

Learn AWS hacking from zero to hero with htARTE (HackTricks AWS Red Team Expert)!

Other ways to support HackTricks:

Relro ​

RELRO stands for Relocation Read-Only, and it's a security feature used in binaries to mitigate the risks associated with GOT (Global Offset Table) overwrites. Let's break down the concept into its two distinct types for clarity: Partial RELRO and Full RELRO.

Partial RELRO ​

Partial RELRO takes a simpler approach to enhance security without significantly impacting the binary's performance. By positioning the GOT above the program's variables in memory, Partial RELRO aims to prevent buffer overflows from reaching and corrupting the GOT.

This doesn't prevent the GOT to be abused from arbitrary write vulnerabilities.

Full RELRO ​

Full RELRO steps up the protection by making the GOT and .fini_array section completely read-only. Once the binary starts all the function addresses are resolved and loaded in the GOT, then, GOT is marked as read-only, effectively preventing any modifications to it during runtime.

However, the trade-off with Full RELRO is in terms of performance and startup time. Because it needs to resolve all dynamic symbols at startup before marking the GOT as read-only, binaries with Full RELRO enabled may experience longer load times. This additional startup overhead is why Full RELRO is not enabled by default in all binaries.

It's possible to see if Full RELRO is enabled in a binary with:

bash
readelf -l /proc/ID_PROC/exe | grep BIND_NOW

Bypass ​

If Full RELRO is enabled, the only way to bypass it is to find another way that doesn't need to write in the GOT table to get arbitrary execution.

Note that LIBC's GOT is usually Partial RELRO, so it can be modified with an arbitrary write. More information in Targetting libc GOT entries.

Learn AWS hacking from zero to hero with htARTE (HackTricks AWS Red Team Expert)!

Other ways to support HackTricks: