hlogin7

Size: px

Start display at page:

Download "hlogin7"

우혁 이
5 years ago
Views:

1 0x07. Return Oriented Programming

2 ROP?

4 , (DEP, ASLR).

5 ROP (Return Oriented Programming) (excutable memory) rop. plt, got got overwrite RTL RTL Chain DEP, ASLR gadget

6 Basic knowledge

7 plt, got call function before global offset table link_map struct address 2 4 plt jmp got push global offset table 1 push reloc_offset 3 5 got jmp plt + 6 jmp _dl_runtime_resolve call function 12 enter dynamic linker _dl_lookup_symbol_x 8 get SYMTAB address get libc address return _dl_fixup 7 _dl_fixup get.strtab address get function name offset 9 calc real libc address _dl_runtime_resolve 6 call _dl_fixup function name address return _dl_runtime_resolve 11 reloc_offset link_map struct address

8 plt, got call function before global offset table link_map struct address 2 4 plt jmp got push global offset table 1 push reloc_offset 3 5 got 10 function address jmp _dl_runtime_resolve call function 12 enter dynamic linker _dl_lookup_symbol_x 8 get SYMTAB address get libc address return _dl_fixup 7 _dl_fixup get.strtab address get function name offset 9 calc real libc address _dl_runtime_resolve 6 call _dl_fixup function name address return _dl_runtime_resolve 11 reloc_offset link_map struct address

9 plt, got call function after plt 1 2 jmp got got function address 3 call function

10 got overwrite plt 1 2 jmp got got function address 3 call function 3 call arbitrary function

11 RTL Chain Stack return address 1 return address 2 return address 3 return address 4 ESP Stack return address 1 pop pop ret parameter 1 function argv[1] = parameter 1 argv[2] = parameter 2 1 call function excute function function epilogue 2 parameter 2 return address 2

12 RTL Chain Stack return address 1 return address 2 return address 3 return address 4 ESP Stack return address 1 pop pop ret parameter 1 function argv[1] = parameter 1 argv[2] = parameter 2 1 call function excute function function epilogue 2 parameter 2 return address 2

13 RTL Chain Stack return address 1 return address 2 return address 3 return address 4 Stack return address 1 pop pop ret parameter 1 function argv[1] = parameter 1 argv[2] = parameter 2 1 call function excute function function epilogue 2 parameter 2 ESP return address 2

14 ROP Gadget pop - pop - return gadget ret. gadget next return address pop esp next return address, gadget. ex) return address 2

15 ROP Gadget 1. gadget 2. gadget ret. 3. gadget 4. gadget

16 ROP (Return Oriented Programming)

17 ROP (Return Oriented Programming).code section call call recv() argv[1] = fd argv[2] = buf_address argv[3] = sizeof(buf) argv[4] = 0 next instruction stack stack next instruction fd fd buf_address buf_address sizeof(buf) sizeof(buf) 0 0

18 ROP (stage 1).code section call call recv() argv[1] = fd argv[2] = buf_address argv[3] = sizeof(buf) argv[4] = 0 next instruction stack corruption, return send@plt stack stack fd buf_address send function ABCD hacker file descriptor recv_got sizeof(buf) 4 0 0

19 ROP (stage 1) send(hacker_fd, recv_got, 4, 0) recv_got 4. recv_got? got system offset. got plt + 6. got.

20 ROP (stage 1) offset? offset ex) p recv = 0xb7f03bf0 p system = 0xb7e56190 offset = recv - system system = recv - offset p/x recv - system = 0xada60 p/x recv - 0xada60 = 0xb7e56190 < system >

21 ROP (stage 0).code section call call recv() argv[1] = fd argv[2] = buf_address argv[3] = sizeof(buf) argv[4] = 0 next instruction stack corruption, return recv@plt stack stack stack ppppr return system fd buf_address recv function hacker file descriptor bss ABCD bss sizeof(buf) len(cmd) 0 0

22 ROP (stage 0) recv(hacker_fd, bss, len(cmd), 0) bss cmd (recv). system(bss) recv cmd bss bss system bss..bss section? C 0..

23 ROP (Return Oriented Programming) 1. gdb. 2. set follow-fork-mode child run ( ) 5. nc localhost port pid killall [binaryname]. ex) nc localhost 7777 python test.py ex) killall python

24 DEMO

25 ROP (Return Oriented Programming)

26 ROP (Return Oriented Programming) help.

27 ROP (Return Oriented Programming). - send, recv -.bss section 8 - recv stack corruption ROP (stage 1) - send hacker. - offset system. ROP (stage 0) - recv system bss section. - stage 1 system rtl chain

28 ROP (stage 1) recv stack corruption. vuln 100, recv 200. vuln 100 byte sfp 4 byte return address

29 ROP (stage 1) find gadget for stage 1

30 ROP (stage 1) calc system address struct.pack( <I, 0x ) == \x78\x56\x34\x12

31 ROP (stage 0) find gadget for stage 0 readelf -S python find.bss section

32 ROP (stage 0) objdump -d python grep -04 ret find ppppr

33 ROP (stage 0)

34 ROP (stage 0)

hlogin2

hlogin2 0x02. Stack Corruption off-limit Kernel Stack libc Heap BSS Data Code off-limit Kernel Kernel : OS Stack libc Heap BSS Data Code Stack : libc : Heap : BSS, Data : bss Code : off-limit Kernel Kernel : OS