Data only exploitation is the mind-set / understanding that:
- A lot of effort has been put into anti-exploitation techniques in recent years, making existing exploitation strategies more difficult.
- Most of that effort revolves around prevention of code subversion. i.e, where the end goal of the attacker is to control code execution.
Contrary to that, in certain cases, code execution may be merely a means to an end such as extracting personal information from a mobile device, gaining access to a remote server, deleting valued data, or shutting down major infrastructure at just the right moment.
A data only exploitation approach suggests that instead of manipulating the code execution flow directly (by overwriting code with a shellcode, writing code on the stack and overwriting the stack address) or indirectly (creating a ROP chain, bypassing CFI) an attacker may also modify data in order to achieve a desired outcome.
Examples may make this easier to understand:
In the most basic sense, this means that instead of executing a shellcode and spawning a shell an attacker may use a relative-dword-write primitive to add a new user to the linked-list of admin users and then use it to login into the system.
Similarly, a buffer overflow of some sorts may be used to overwrite an SQL query to turn a memory corruption to an SQL injection. Either, again, inserting some sort of desired entry or extracting information from an internal database.
