-q# No show banner-x<file># Auto-execute GDB instructions from here-p<pid># Attach to process
Instructions
run# Executestart# Start and break in mainn/next/ni# Execute next instruction (no inside)s/step/si# Execute next instructionc/continue# Continue until next breakpointpsystem# Find the address of the system functionset $eip =0x12345678# Change value of $eiphelp# Get helpquit# exit# Disassembledisassemblemain# Disassemble the function called maindisassemble0x12345678# Disassemble taht addresssetdisassembly-flavorintel# Use intel syntaxsetfollow-fork-modechild/parent# Follow child/parent process# Breakpointsbrfunc# Add breakpoint to functionbr*func+23br*0x12345678del<NUM># Delete that number of breakpointwatchEXPRESSION# Break if the value changes# infoinfofunctions-->Infoabountfunctionsinfofunctionsfunc-->Infoofthefuntioninforegisters-->Valueoftheregistersbt# Backtrace Stackbtfull# Detailed stackprintvariableprint0x87654321-0x12345678# Caculate# x/examineexamine/<num><o/x/d/u/t/i/s/c><b/h/w/g> dir_mem/reg/puntero # Shows content of <num> in <octal/hexa/decimal/unsigned/bin/instruction/ascii/char> where each entry is a <Byte/half word (2B)/Word (4B)/Giant word (8B)>
x/o0xDir_hexx/2x $eip # 2Words from EIPx/2x $eip -4# $eip - 4x/8xb $eip # 8 bytes (b-> byte, h-> 2bytes, w-> 4bytes, g-> 8bytes)ireip# Value of $eipx/wpointer# Value of the pointerx/spointer# String pointed by the pointerx/xw&pointer# Address where the pointer is locatedx/i $eip # Instructions of the EIP
You could optionally use this fork of GEF which contains more interesting instructions.
helpmemory# Get help on memory commandcanary# Search for canary value in memorychecksec#Check protectionspsystem#Find system function addresssearch-pattern"/bin/sh"#Search in the process memoryvmmap#Get memory mappingsxinfo<addr># Shows page, size, perms, memory area and offset of the addr in the pagememorywatch0x7840000x1000byte#Add a view always showinf this memorygot#Check got tablememorywatch $_got()+0x185#Watch a part of the got table# Vulns detectionformat-string-helper#Detect insecure format stringsheap-analysis-helper#Checks allocation and deallocations of memory chunks:NULL free, UAF,double free, heap overlap#Patternspatterncreate200#Generate length 200 patternpatternsearch"avaaawaa"#Search for the offset of that substringpatternsearch $rsp #Search the offset given the content of $rsp#Shellcodeshellcodesearchx86#Search shellcodesshellcodeget61#Download shellcode number 61#Dump memory to filedumpbinarymemory/tmp/dump.bin0x2000000000x20000c350#Another way to get the offset of to the RIP1-PutabpafterthefunctionthatoverwritestheRIPandsendappaterntoovwerwriteit2-ef➤ifStacklevel0,frameat0x7fffffffddd0:rip=0x400cd3; savedrip=0x6261617762616176calledbyframeat0x7fffffffddd8Arglistat0x7fffffffdcf8,args:Localsat0x7fffffffdcf8,Previousframe's sp is 0x7fffffffddd0 Saved registers: rbp at 0x7fffffffddc0, rip at 0x7fffffffddc8gef➤ pattern search 0x6261617762616176[+] Searching for '0x6261617762616176'[+] Found at offset 184 (little-endian search) likely
Tricks
GDB same addresses
While debugging GDB will have slightly different addresses than the used by the binary when executed. You can make GDB have the same addresses by doing:
unset env LINES
unset env COLUMNS
set env _=<path>Put the absolute path to the binary
Exploit the binary using the same absolute route
PWD and OLDPWD must be the same when using GDB and when exploiting the binary
Backtrace to find functions called
When you have a statically linked binary all the functions will belong to the binary (and no to external libraries). In this case it will be difficult to identify the flow that the binary follows to for example ask for user input.
You can easily identify this flow by running the binary with gdb until you are asked for input. Then, stop it with CTRL+C and use the bt (backtrace) command to see the functions called:
gef➤ bt
#0 0x00000000004498ae in ?? ()
#1 0x0000000000400b90 in ?? ()
#2 0x0000000000400c1d in ?? ()
#3 0x00000000004011a9 in ?? ()
#4 0x0000000000400a5a in ?? ()
GDB server
gdbserver --multi 0.0.0.0:23947 (in IDA you have to fill the absolute path of the executable in the Linux machine and in the Windows machine)
Ghidra
Find stack offset
Ghidra is very useful to find the the offset for a buffer overflow thanks to the information about the position of the local variables.
For example, in the example below, a buffer flow in local_bc indicates that you need an offset of 0xbc. Moreover, if local_10 is a canary cookie it indicates that to overwrite it from local_bc there is an offset of 0xac.
Remember that the first 0x08 from where the RIP is saved belongs to the RBP.
gcc -fno-stack-protector -D_FORTIFY_SOURCE=0 -z norelro -z execstack 1.2.c -o 1.2 --> Compile without protections
-o --> Output
-g --> Save code (GDB will be able to see it)
echo 0 > /proc/sys/kernel/randomize_va_space --> To deactivate the ASLR in linux
To compile a shellcode:nasm -f elf assembly.asm --> return a ".o"
ld assembly.o -o shellcodeout --> Executable
Objdump
-d --> Disassemble executable sections (see opcodes of a compiled shellcode, find ROP Gadgets, find function address...)
-Mintel --> Intel syntax
-t --> Symbols table
-D --> Disassemble all (address of static variable)
-s -j .dtors --> dtors section
-s -j .got --> got section
-D -s -j .plt --> plt section decompiled-TR --> Relocationsojdump -t --dynamic-relo ./exec | grep puts --> Address of "puts" to modify in GOT
objdump -D ./exec | grep "VAR_NAME" --> Address or a static variable (those are stored in DATA section).
Core dumps
Run ulimit -c unlimited before starting my program
Run sudo sysctl -w kernel.core_pattern=/tmp/core-%e.%p.%h.%t
sudo gdb --core=<path/core> --quiet
More
ldd executable | grep libc.so.6 --> Address (if ASLR, then this change every time)
for i in `seq 0 20`; do ldd <Ejecutable> | grep libc; done --> Loop to see if the address changes a lot
readelf -s /lib/i386-linux-gnu/libc.so.6 | grep system --> Offset of "system"
strings -a -t x /lib/i386-linux-gnu/libc.so.6 | grep /bin/sh --> Offset of "/bin/sh"
strace executable --> Functions called by the executable
rabin2 -i ejecutable --> Address of all the functions
Inmunity debugger
!monamodules#Get protections, look for all false except last one (Dll of SO)!monafind-s"\xff\xe4"-mname_unsecure.dll#Search for opcodes insie dll space (JMP ESP)
IDA
Debugging in remote linux
Inside the IDA folder you can find binaries that can be used to debug a binary inside a linux. To do so move the binary linux_server or linux_server64 inside the linux server and run it nside the folder that contains the binary:
./linux_server64 -Ppass
Then, configure the debugger: Debugger (linux remote) --> Proccess options...:
