BF Addresses in the Stack
Last updated
Last updated
Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)
Ikiwa unakutana na binary iliyo na kinga ya canary na PIE (Position Independent Executable) huenda ukahitaji kupata njia ya kuipita.
Kumbuka kwamba checksec huenda isipate kwamba binary inakingwa na canary ikiwa hii ilikusanywa kwa njia ya statically na haiwezi kutambua kazi hiyo.
Hata hivyo, unaweza kugundua hili kwa mikono ikiwa unapata kwamba thamani imehifadhiwa kwenye stack mwanzoni mwa wito wa kazi na thamani hii inakaguliwa kabla ya kutoka.
Ili kuipita PIE unahitaji kuvuja anwani fulani. Na ikiwa binary haivuji anwani zozote bora ni kujaribu RBP na RIP zilizohifadhiwa kwenye stack katika kazi iliyo hatarini. Kwa mfano, ikiwa binary inakingwa kwa kutumia canary na PIE, unaweza kuanza kujaribu canary, kisha bytes 8 zinazofuata (x64) zitakuwa RBP iliyohifadhiwa na bytes 8 zinazofuata zitakuwa RIP iliyohifadhiwa.
Inatarajiwa kwamba anwani ya kurudi ndani ya stack inahusiana na msimbo mkuu wa binary, ambayo, ikiwa udhaifu uko kwenye msimbo wa binary, kawaida itakuwa hivyo.
Ili kujaribu RBP na RIP kutoka kwa binary unaweza kugundua kwamba byte iliyokisiwa kuwa sahihi ni sahihi ikiwa programu inatoa kitu au haiporomoki. Kazi ile ile kama ilivyotolewa kwa kujaribu canary inaweza kutumika kujaribu RBP na RIP:
The last thing you need to defeat the PIE is to calculate anwani muhimu kutoka kwa zilizovuja anwani: the RBP and the RIP.
From the RBP you can calculate wapi unandika shell yako kwenye stack. This can be very useful to know where are you going to write the string "/bin/sh\x00" inside the stack. To calculate the distance between the leaked RBP and your shellcode you can just put a breakpoint after leaking the RBP an check wapi shellcode yako iko, then, you can calculate the distance between the shellcode and the RBP:
From the RIP you can calculate the base address of the PIE binary which is what you are going to need to create a valid ROP chain.
To calculate the base address just do objdump -d vunbinary and check the disassemble latest addresses:
Katika mfano huo unaweza kuona kwamba Byte 1 na nusu pekee inahitajika kutafuta msimbo wote, kisha, anwani ya msingi katika hali hii itakuwa RIP iliyovuja lakini ikimalizika kwenye "000". Kwa mfano, ikiwa umepata 0x562002970ecf anwani ya msingi ni 0x562002970000
Kulingana na uchambuzi fulani kutoka kwa chapisho hili, inawezekana kwamba wakati wa kuvuja thamani za RBP na RIP, seva haitakufa na baadhi ya thamani ambazo si sahihi na script ya BF itadhani ameweza kupata sahihi. Hii ni kwa sababu inawezekana kwamba anwani fulani hazitavunja hata kama hakuna zile sahihi kabisa.
Kulingana na chapisho hilo la blog, inapendekezwa kuongeza ucheleweshaji mfupi kati ya maombi kwa seva.
Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)
