Ret2csu
Last updated
Last updated
Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)
ret2csu is a hacking technique used when you're trying to take control of a program but can't find the gadgets you usually use to manipulate the program's behavior.
When a program uses certain libraries (like libc), it has some built-in functions for managing how different pieces of the program talk to each other. Among these functions are some hidden gems that can act as our missing gadgets, especially one called __libc_csu_init.
In __libc_csu_init, there are two sequences of instructions (gadgets) to highlight:
The first sequence lets us set up values in several registers (rbx, rbp, r12, r13, r14, r15). These are like slots where we can store numbers or addresses we want to use later.
This gadget allows us to control these registers by popping values off the stack into them.
The second sequence uses the values we set up to do a couple of things:
Move specific values into other registers, making them ready for us to use as parameters in functions.
Perform a call to a location determined by adding together the values in r15 and rbx, then multiplying rbx by 8.
Maybe you don't know any address to write there and you need a ret instruction. Note that the second gadget will also end in a ret, but you will need to meet some conditions in order to reach it:
The conditions will be:
[r12 + rbx*8] must be pointing to an address storing a callable function (if no idea and no pie, you can just use _init func):
If _init is at 0x400560, use GEF to search for a pointer in memory to it and make [r12 + rbx*8] be the address with the pointer to _init:
rbp and rbx must have the same value to avoid the jump
There are some omitted pops you need to take into account
Another way to control rdi and rsi from the ret2csu gadget is by accessing it specific offsets:
Check this page for more info:
Imagine you want to make a syscall or call a function like write() but need specific values in the rdx and rsi registers as parameters. Normally, you'd look for gadgets that set these registers directly, but you can't find any.
Here's where ret2csu comes into play:
Set Up the Registers: Use the first magic gadget to pop values off the stack and into rbx, rbp, r12 (edi), r13 (rsi), r14 (rdx), and r15.
Use the Second Gadget: With those registers set, you use the second gadget. This lets you move your chosen values into rdx and rsi (from r14 and r13, respectively), readying parameters for a function call. Moreover, by controlling r15 and rbx, you can make the program call a function located at the address you calculate and place into [r15 + rbx*8].
You have an example using this technique and explaining it here, and this is the final exploit it used:
Note that the previous exploit isn't meant to do a RCE, it's meant to just call a function called win (taking the address of win from stdin calling gets in the ROP chain and storing it in r15) with a third argument with the value 0xdeadbeefcafed00d.
The following exploit was extracted from this page where the ret2csu is used but instead of using the call, it's bypassing the comparisons and reaching the ret after the call:
Usually these cases are also vulnerable to ret2plt + ret2lib, but sometimes you need to control more parameters than are easily controlled with the gadgets you find directly in libc. For example, the write() function requires three parameters, and finding gadgets to set all these directly might not be possible.
Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)
