Leaking libc address with ROP
Last updated
Last updated
Jifunze na fanya mazoezi ya AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Jifunze na fanya mazoezi ya GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)
Pata overflow offset
Pata gadget ya POP_RDI, PUTS_PLT na gadget za MAIN
Tumia gadget za awali ku onyesha anwani ya kumbukumbu ya puts au kazi nyingine ya libc na pata toleo la libc (pakua)
Pamoja na maktaba, hesabu ROP na uifanye
Mafunzo haya yatatumia msimbo/binary uliopendekezwa katika mafunzo haya: https://tasteofsecurity.com/security/ret2libc-unknown-libc/ Mafunzo mengine ya manufaa: https://made0x78.com/bseries-ret2libc/, https://guyinatuxedo.github.io/08-bof_dynamic/csaw19_babyboi/index.html
Jina la faili: vuln.c
Download the exploit and place it in the same directory as the vulnerable binary and give the needed data to the script:
The template need an offset before continuing with the exploit. If any is provided it will execute the necessary code to find it (by default OFFSET = ""):
Tekeleza python template.py itafungua GDB console na programu itakuwa inakabiliwa na ajali. Ndani ya GDB console tekeleza x/wx $rsp kupata bytes ambazo zilikuwa zinaenda kufunika RIP. Mwishowe pata offset ukitumia python console:
Baada ya kupata offset (katika kesi hii 40) badilisha variable ya OFFSET ndani ya template ukitumia thamani hiyo.
OFFSET = "A" * 40
Njia nyingine ingekuwa kutumia: pattern create 1000 -- tekeleza hadi ret -- pattern seach $rsp kutoka GEF.
Sasa tunahitaji kupata ROP gadgets ndani ya binary. Hizi ROP gadgets zitakuwa muhimu kuita puts ili kupata libc inayotumika, na baadaye kuanzisha exploit ya mwisho.
The PUTS_PLT is needed to call the function puts.
The MAIN_PLT is needed to call the main function again after one interaction to exploit the overflow again (infinite rounds of exploitation). It is used at the end of each ROP to call the program again.
The POP_RDI is needed to pass a parameter to the called function.
In this step you don't need to execute anything as everything will be found by pwntools during the execution.
Sasa ni wakati wa kutafuta ni toleo gani la libc maktaba linatumika. Ili kufanya hivyo tutavuja anwani katika kumbukumbu ya function puts na kisha tutatafuta ni toleo la maktaba gani toleo la puts lipo katika anwani hiyo.
Ili kufanya hivyo, mstari muhimu zaidi wa msimbo uliofanywa ni:
Hii itatuma baadhi ya bytes hadi kuandika RIP iwezekanavyo: OFFSET.
Kisha, itapanga anwani ya gadget POP_RDI ili anwani inayofuata (FUNC_GOT) iwe saved katika RDI registry. Hii ni kwa sababu tunataka kuita puts tukipitia anwani ya PUTS_GOT kwani anwani katika kumbukumbu ya kazi ya puts imehifadhiwa katika anwani inayotolewa na PUTS_GOT.
Baada ya hapo, PUTS_PLT itaitwa (ikiwa na PUTS_GOT ndani ya RDI) ili puts isome maudhui ndani ya PUTS_GOT (anwani ya kazi ya puts katika kumbukumbu) na it ichapishe.
Hatimaye, kazi kuu inaitwa tena ili tuweze kutumia overflow tena.
Kwa njia hii tumekuwa tukidanganya kazi ya puts ili ichapishe anwani katika kumbukumbu ya kazi puts (ambayo iko ndani ya maktaba ya libc). Sasa kwamba tuna hiyo anwani tunaweza kutafuta ni toleo gani la libc linatumika.
Kwa kuwa tunafanya exploiting baadhi ya binary za local si lazima kujua ni toleo gani la libc linatumika (pata tu maktaba katika /lib/x86_64-linux-gnu/libc.so.6).
Lakini, katika kesi ya exploit ya mbali nitafafanua hapa jinsi unavyoweza kulipata:
Unaweza kutafuta ni maktaba gani inatumika kwenye ukurasa wa wavuti: https://libc.blukat.me/ Itakuruhusu pia kupakua toleo lililogunduliwa la libc
Unaweza pia kufanya:
$ git clone https://github.com/niklasb/libc-database.git
$ cd libc-database
$ ./get
Hii itachukua muda, kuwa na subira. Ili hii ifanye kazi tunahitaji:
Jina la alama ya Libc: puts
Anwani ya libc iliyovuja: 0x7ff629878690
Tunaweza kubaini ni libc ipi ambayo ina uwezekano mkubwa inatumika.
Tunapata mechi 2 (unapaswa kujaribu ya pili ikiwa ya kwanza haifanyi kazi). Pakua ya kwanza:
Nakili libc kutoka libs/libc6_2.23-0ubuntu10_amd64/libc-2.23.so hadi kwenye saraka yetu ya kazi.
Katika hatua hii tunapaswa kujua maktaba ya libc inayotumika. Kwa kuwa tunatumia binary ya ndani, nitatumia tu: /lib/x86_64-linux-gnu/libc.so.6
Hivyo, mwanzoni mwa template.py badilisha libc variable kuwa: libc = ELF("/lib/x86_64-linux-gnu/libc.so.6") #Weka njia ya maktaba unapojua
Kutoa njia kwa maktaba ya libc sehemu nyingine ya exploit itakuwa inakokotwa kiotomatiki.
Ndani ya get_addrfunction anwani ya msingi ya libc itakokotwa:
Kumbuka kwamba anwani ya mwisho ya msingi wa libc lazima iishie na 00. Ikiwa hiyo si hali yako unaweza kuwa umepata maktaba isiyo sahihi.
Kisha, anwani ya kazi system na anwani ya string "/bin/sh" zitakuwa zinakokotwa kutoka kwa anwani ya msingi ya libc na kutolewa kwa maktaba ya libc.
Hatimaye, exploit ya utekelezaji wa /bin/sh itakuwa tayari kutumwa:
Let's explain this final ROP.
The last ROP (rop1) ended calling again the main function, then we can exploit again the overflow (that's why the OFFSET is here again). Then, we want to call POP_RDI pointing to the anwani of "/bin/sh" (BINSH) and call system function (SYSTEM) because the address of "/bin/sh" will be passed as a parameter.
Finally, the anwani ya exit function is called so the process exists nicely and any alert is generated.
This way the exploit will execute a _/bin/sh_** shell.**
You could also use ONE_GADGET to obtain a shell instead of using system and "/bin/sh". ONE_GADGET will find inside the libc library some way to obtain a shell using just one ROP address.
However, normally there are some constrains, the most common ones and easy to avoid are like [rsp+0x30] == NULL As you control the values inside the RSP you just have to send some more NULL values so the constrain is avoided.
You can find a template to exploit this vulnerability here:
If the "main" symbol does not exist. Then you can find where is the main code:
na weka anwani kwa mikono:
Ikiwa binary haitumii Puts unapaswa kuangalia ikiwa inatumia
sh: 1: %s%s%s%s%s%s%s%s: hazipatikaniIkiwa unapata kosa hili baada ya kuunda yote ya exploit: sh: 1: %s%s%s%s%s%s%s%s: hazipatikani
Jaribu kupunguza byte 64 kutoka anwani ya "/bin/sh":
Jifunze na fanya mazoezi ya AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Jifunze na fanya mazoezi ya GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)
