For a couple of years now, some security professionals have been sounding the death knell of ROP. It's considered old and unreliable, and new technology promises to mitigate even a carefully constructed exploit with shadow registers that track returns during execution flow. Then again, Windows XP has been dead for several years, but anyone spending time in large production environments today is bound to see it still clinging for life running legacy applications.

A significant effort in many organizations today is not replacing XP but rather indirect mitigation via the network or third-party software controlling the execution of code. ROP is still relevant for the time being, even if just to verify that it doesn't work in your client's environment. The unique nature of this attack renders it particularly dangerous, despite its signs of aging at this point in time.

In this chapter, we reviewed DEP and ASLR as theoretical concepts and demonstrated these technologies in action with WinDbg and gcc on Linux. We introduced return-oriented programming and two primary tools of the trade: MSFrop and ROPgadget. We typed up a C program with a critical vulnerability and left default protections intact. The remainder of the chapter was spent covering the fundamentals of ROP, return-to-PLT and return-to-libc, gadget discovery and review. We explored how to bring the pieces together for a functioning exploit.

In the next chapter, we'll wrap up programming fundamentals with a review of fuzzing. You've already played around with fuzzing in this book and may not even be aware of it. We'll review the underlying principles and get hands-on with fuzz testing.