Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Binary Exploitation - Basic

Binary Exploitation - Basic

2021/05/19 台科資安社 社課
直播記錄檔: https://www.youtube.com/watch?v=H52LnWjcC_A
- Stack-Based Buffer Overflow
- Shellcode
- GOT Hijack
- One Gadget
- ROP

LJP-TW

May 18, 2021
Tweet

More Decks by LJP-TW

Other Decks in Technology

Transcript

  1. # whoami - LJP / LJP-TW - Pwn / Rev

    - NTUST / NCTU / NYCU - 10sec CTF Team 1
  2. 先來個小調查 - 略懂 C - 略懂 任何一種組合語言 - 略懂 逆向工程

    - 略懂 怎用 GDB - 略懂 Pwn - 略懂 ROP - 略懂 Heap Exploitation 2
  3. Outline - What’s PWN? - 基礎知識 – x86 Assembly -

    基礎知識 – Stack Frame - 基礎知識 – GDB - 基礎知識 – Pwntools - Stack-Based Buffer Overflow - Shellcode - 基礎知識 – Lazy Binding 3 - GOT Hijack - One Gadget - ROP
  4. x86 Assembly 19 mov rax, 1 add rax, 5 sub

    rbx, rax inc rax dec rax ASM rax = 1 rax = rax + 5 rbx = rbx – rax rax++ rax-- C ✕ ✕
  5. x86 Assembly 20 mov rax, 0 jmp BEGIN LOOP: inc

    rax BEGIN: cmp rax, 5 jle LOOP ASM rax = 0 while (rax <= 5) rax++ C ✕ ✕
  6. Stack Frame - 不同區域會有不同的 Stack Frame - 裡面存放著區域變數 - 在

    Function 的頭部和尾部, 會有一些用來處理 Stack Frame 的 指令 - 頭部: Prologue - 尾部: Epilogue 22 push rbp mov rbp, rsp … leave ret main
  7. Stack Frame 23 Stack RSP 0x00007fffffffe5c8 push rbp mov rbp,

    rsp sub rsp, 20h … call function1 leave ret main push rbp mov rbp, rsp sub rsp, 30h … leave ret function1
  8. push rbp mov rbp, rsp sub rsp, 20h … call

    function1 leave ret Stack Frame 24 Stack RSP 0x00007fffffffe5c8 main push rbp mov rbp, rsp sub rsp, 30h … leave ret function1
  9. push rbp mov rbp, rsp sub rsp, 20h … call

    function1 leave ret Stack Frame 25 Stack RSP 0x00007fffffffe5c8 RBP 原本的值 0x00007fffffffe5c0 main push rbp mov rbp, rsp sub rsp, 30h … leave ret function1
  10. push rbp mov rbp, rsp sub rsp, 20h … call

    function1 leave ret Stack Frame 26 Stack RSP 0x00007fffffffe5c8 0x00007fffffffe5c0 RBP RBP 原本的值 main push rbp mov rbp, rsp sub rsp, 30h … leave ret function1
  11. push rbp mov rbp, rsp sub rsp, 20h … call

    function1 leave ret Stack Frame 27 Stack RBP 0x00007fffffffe5c8 0x00007fffffffe5c0 RSP RBP 原本的值 0x00007fffffffe5a0 0x401234 main push rbp mov rbp, rsp sub rsp, 30h … leave ret function1
  12. push rbp mov rbp, rsp sub rsp, 30h … leave

    ret Stack Frame 28 Stack RBP 0x00007fffffffe5c8 0x00007fffffffe5c0 RSP RBP 原本的值 0x401234 0x00007fffffffe5a0 0x401234 0x00007fffffffe598 push rbp mov rbp, rsp sub rsp, 20h … call function1 leave ret main function1
  13. push rbp mov rbp, rsp sub rsp, 30h … leave

    ret Stack Frame 29 Stack RBP 0x00007fffffffe5c8 0x00007fffffffe5c0 RSP RBP 原本的值 0x401234 0x00007fffffffe5a0 0x401234 0x00007fffffffe5c0 0x00007fffffffe598 0x00007fffffffe590 push rbp mov rbp, rsp sub rsp, 20h … call function1 leave ret main function1
  14. push rbp mov rbp, rsp sub rsp, 30h … leave

    ret Stack Frame 30 Stack RBP 0x00007fffffffe5c8 0x00007fffffffe5c0 RSP RBP 原本的值 0x401234 0x00007fffffffe5a0 0x401234 0x00007fffffffe5c0 0x00007fffffffe598 0x00007fffffffe590 push rbp mov rbp, rsp sub rsp, 20h … call function1 leave ret main function1
  15. push rbp mov rbp, rsp sub rsp, 30h … leave

    ret Stack Frame 31 Stack 0x00007fffffffe5c8 0x00007fffffffe5c0 RBP RBP 原本的值 0x401234 0x00007fffffffe5a0 0x401234 0x00007fffffffe5c0 0x00007fffffffe598 0x00007fffffffe590 RSP 0x00007fffffffe560 leave = mov rsp, rbp pop rbp push rbp mov rbp, rsp sub rsp, 20h … call function1 leave ret main function1
  16. push rbp mov rbp, rsp sub rsp, 30h … leave

    ret Stack Frame 32 Stack 0x00007fffffffe5c8 0x00007fffffffe5c0 RSP RBP 原本的值 0x401234 0x00007fffffffe5a0 0x401234 0x00007fffffffe5c0 0x00007fffffffe598 0x00007fffffffe590 0x00007fffffffe560 leave = mov rsp, rbp pop rbp RBP push rbp mov rbp, rsp sub rsp, 20h … call function1 leave ret main function1
  17. push rbp mov rbp, rsp sub rsp, 30h … leave

    ret push rbp mov rbp, rsp sub rsp, 20h … call function1 leave ret Stack Frame 33 Stack 0x00007fffffffe5c8 0x00007fffffffe5c0 RSP RBP 原本的值 0x401234 0x00007fffffffe5a0 0x401234 0x00007fffffffe5c0 0x00007fffffffe598 0x00007fffffffe590 0x00007fffffffe560 leave = mov rsp, rbp pop rbp RBP main function1
  18. push rbp mov rbp, rsp sub rsp, 30h … leave

    ret push rbp mov rbp, rsp sub rsp, 20h … call function1 leave ret Stack Frame 34 Stack 0x00007fffffffe5c8 0x00007fffffffe5c0 RBP 原本的值 0x401234 0x00007fffffffe5a0 0x401234 0x00007fffffffe5c0 0x00007fffffffe598 0x00007fffffffe590 0x00007fffffffe560 leave = mov rsp, rbp pop rbp RSP main function1
  19. GDB - 推薦套件: gef - https://github.com/hugsy/gef - 推薦套件: pwngdb -

    https://github.com/scwuaptx/Pwngdb - 常用指令 - b *[Address expression]:設定中斷點 (break point) - c:繼續執行 (continue) - ni:執行一個指令 (不步入) - si:執行一個指令 (步入) - x/[Length][Format] [Address expression]:顯示記憶體內容 36
  20. Pwntools - Python 模組 - 方便寫 exploit - 常用 function

    - process() - remote() - send()、sendline() - sendafter()、sendlineafter() - recv()、recvline() - recvuntil() 39
  21. push rbp mov rbp, rsp sub rsp, 30h … leave

    ret Stack-Based Buffer Overflow 43 Stack 0x00007fffffffe5c8 0x00007fffffffe5c0 RBP RBP 原本的值 0x401234 0x00007fffffffe5a0 0x401234 0x00007fffffffe5c0 0x00007fffffffe598 0x00007fffffffe590 RSP 0x00007fffffffe560 push rbp mov rbp, rsp sub rsp, 20h … call function1 leave ret main function1
  22. push rbp mov rbp, rsp sub rsp, 30h … leave

    ret Stack-Based Buffer Overflow 44 Stack 0x00007fffffffe5c8 0x00007fffffffe5c0 RBP RBP 原本的值 0x401234 0x00007fffffffe5a0 0x401234 0x00007fffffffe5c0 0x00007fffffffe598 0x00007fffffffe590 RSP 0x00007fffffffe560 AAAAAAAA push rbp mov rbp, rsp sub rsp, 20h … call function1 leave ret main function1
  23. push rbp mov rbp, rsp sub rsp, 30h … leave

    ret Stack-Based Buffer Overflow 45 Stack 0x00007fffffffe5c8 0x00007fffffffe5c0 RBP RBP 原本的值 0x401234 0x00007fffffffe5a0 0x401234 0x00007fffffffe5c0 0x00007fffffffe598 0x00007fffffffe590 RSP 0x00007fffffffe560 AAAAAAAA AAAAAAAA … push rbp mov rbp, rsp sub rsp, 20h … call function1 leave ret main function1
  24. push rbp mov rbp, rsp sub rsp, 30h … leave

    ret RBP Stack-Based Buffer Overflow 46 Stack 0x00007fffffffe5c8 0x00007fffffffe5c0 RBP 原本的值 AAAAAAAA 0x00007fffffffe5a0 0x401234 AAAAAAAA 0x00007fffffffe598 0x00007fffffffe590 RSP 0x00007fffffffe560 AAAAAAAA AAAAAAAA … push rbp mov rbp, rsp sub rsp, 20h … call function1 leave ret main function1
  25. push rbp mov rbp, rsp sub rsp, 30h … leave

    ret RBP Stack-Based Buffer Overflow 47 Stack 0x00007fffffffe5c8 0x00007fffffffe5c0 RBP 原本的值 AAAAAAAA 0x00007fffffffe5a0 0x401234 AAAAAAAA 0x00007fffffffe598 0x00007fffffffe590 RSP 0x00007fffffffe560 AAAAAAAA … AAAAAAAA push rbp mov rbp, rsp sub rsp, 20h … call function1 leave ret main function1
  26. push rbp mov rbp, rsp sub rsp, 30h … leave

    ret Stack-Based Buffer Overflow 48 Stack 0x00007fffffffe5c8 0x00007fffffffe5c0 RSP RBP 原本的值 AAAAAAAA 0x00007fffffffe5a0 0x401234 AAAAAAAA 0x00007fffffffe598 0x00007fffffffe590 0x00007fffffffe560 AAAAAAAA AAAAAAAA … push rbp mov rbp, rsp sub rsp, 20h … call function1 leave ret main function1
  27. push rbp mov rbp, rsp sub rsp, 20h … call

    function1 leave ret push rbp mov rbp, rsp sub rsp, 30h … leave ret Stack-Based Buffer Overflow 49 Stack 0x00007fffffffe5c8 0x00007fffffffe5c0 RSP RBP 原本的值 AAAAAAAA 0x00007fffffffe5a0 0x401234 AAAAAAAA 0x00007fffffffe598 0x00007fffffffe590 0x00007fffffffe560 AAAAAAAA AAAAAAAA … main function1
  28. Stack Canary - 在函數的頭部, 往 Stack 上寫入一個值 (Canary) - 在函數的尾部,

    驗證 Canary 的值是否還是一樣 - 不一樣就表示發生了 BOF, 呼叫 __stack_chk_fail - 至於為何叫做 Canary? 51
  29. Stack Canary 52 push rbp mov rbp, rsp sub rsp,

    20h … call function1 leave ret main push rbp mov rbp, rsp sub rsp, 30h mov rax, fs:28h mov [rbp-8], rax … mov rcx, [rbp-8] xor rcx, fs:28h jz OK call __stack_chk_fail OK: leave ret function1 Stack 0x7fffffffe5c8 0x7fffffffe5c0 RBP RBP 原本的值 0x401234 0x7fffffffe5a0 0x401234 0x00007fffffffe5c0 0x7fffffffe598 0x7fffffffe590 RSP 0x7fffffffe560
  30. Stack Canary 53 push rbp mov rbp, rsp sub rsp,

    20h … call function1 leave ret main push rbp mov rbp, rsp sub rsp, 30h mov rax, fs:28h mov [rbp-8], rax … mov rcx, [rbp-8] xor rcx, fs:28h jz OK call __stack_chk_fail OK: leave ret function1 Stack 0x7fffffffe5c8 0x7fffffffe5c0 RBP RBP 原本的值 0x401234 0x7fffffffe5a0 0x401234 0x00007fffffffe5c0 0x7fffffffe598 0x7fffffffe590 RSP 0x7fffffffe560
  31. Stack Canary 54 push rbp mov rbp, rsp sub rsp,

    20h … call function1 leave ret main push rbp mov rbp, rsp sub rsp, 30h mov rax, fs:28h mov [rbp-8], rax … mov rcx, [rbp-8] xor rcx, fs:28h jz OK call __stack_chk_fail OK: leave ret function1 Stack 0x7fffffffe5c8 0x7fffffffe5c0 RBP RBP 原本的值 0x401234 0x7fffffffe5a0 0x401234 0x00007fffffffe5c0 0x7fffffffe598 0x7fffffffe590 RSP 0x7fffffffe560 0xd32a99e5e7cd3300 0x7fffffffe588
  32. Stack Canary 55 push rbp mov rbp, rsp sub rsp,

    20h … call function1 leave ret main push rbp mov rbp, rsp sub rsp, 30h mov rax, fs:28h mov [rbp-8], rax … mov rcx, [rbp-8] xor rcx, fs:28h jz OK call __stack_chk_fail OK: leave ret function1 Stack 0x7fffffffe5c8 0x7fffffffe5c0 RBP RBP 原本的值 AAAAAAAA 0x7fffffffe5a0 0x401234 AAAAAAAA 0x7fffffffe598 0x7fffffffe590 RSP 0x7fffffffe560 AAAAAAAA 0x7fffffffe588 AAAAAAAA …
  33. Stack Canary 56 push rbp mov rbp, rsp sub rsp,

    20h … call function1 leave ret main push rbp mov rbp, rsp sub rsp, 30h mov rax, fs:28h mov [rbp-8], rax … mov rcx, [rbp-8] xor rcx, fs:28h jz OK call __stack_chk_fail OK: leave ret function1 Stack 0x7fffffffe5c8 0x7fffffffe5c0 RBP RBP 原本的值 AAAAAAAA 0x7fffffffe5a0 0x401234 AAAAAAAA 0x7fffffffe598 0x7fffffffe590 RSP 0x7fffffffe560 AAAAAAAA 0x7fffffffe588 AAAAAAAA …
  34. Stack Canary 57 push rbp mov rbp, rsp sub rsp,

    20h … call function1 leave ret main push rbp mov rbp, rsp sub rsp, 30h mov rax, fs:28h mov [rbp-8], rax … mov rcx, [rbp-8] xor rcx, fs:28h jz OK call __stack_chk_fail OK: leave ret function1 Stack 0x7fffffffe5c8 0x7fffffffe5c0 RBP RBP 原本的值 AAAAAAAA 0x7fffffffe5a0 0x401234 AAAAAAAA 0x7fffffffe598 0x7fffffffe590 RSP 0x7fffffffe560 AAAAAAAA 0x7fffffffe588 AAAAAAAA …
  35. Stack Canary 58 push rbp mov rbp, rsp sub rsp,

    20h … call function1 leave ret main push rbp mov rbp, rsp sub rsp, 30h mov rax, fs:28h mov [rbp-8], rax … mov rcx, [rbp-8] xor rcx, fs:28h jz OK call __stack_chk_fail OK: leave ret function1 Stack 0x7fffffffe5c8 0x7fffffffe5c0 RBP RBP 原本的值 AAAAAAAA 0x7fffffffe5a0 0x401234 AAAAAAAA 0x7fffffffe598 0x7fffffffe590 RSP 0x7fffffffe560 AAAAAAAA 0x7fffffffe588 AAAAAAAA …
  36. Stack Canary 59 push rbp mov rbp, rsp sub rsp,

    20h … call function1 leave ret main push rbp mov rbp, rsp sub rsp, 30h mov rax, fs:28h mov [rbp-8], rax … mov rcx, [rbp-8] xor rcx, fs:28h jz OK call __stack_chk_fail OK: leave ret function1 Stack 0x7fffffffe5c8 0x7fffffffe5c0 RBP RBP 原本的值 AAAAAAAA 0x7fffffffe5a0 0x401234 AAAAAAAA 0x7fffffffe598 0x7fffffffe590 RSP 0x7fffffffe560 AAAAAAAA 0x7fffffffe588 AAAAAAAA …
  37. Stack Canary - 繞過方式 - 想辦法洩漏出 Canary 的值 - 想蓋

    Return Address 時, 把 Canary 的值寫回去, 就能繞過 60
  38. push rbp mov rbp, rsp sub rsp, 30h … leave

    ret Shellcode 64 Stack 0x00007fffffffe5c8 0x00007fffffffe5c0 RBP RBP 原本的值 0x401234 0x00007fffffffe5a0 0x401234 0x00007fffffffe5c0 0x00007fffffffe598 0x00007fffffffe590 RSP 0x00007fffffffe560 push rbp mov rbp, rsp sub rsp, 20h … call function1 leave ret main function1
  39. push rbp mov rbp, rsp sub rsp, 30h … leave

    ret Shellcode 65 Stack 0x00007fffffffe5c8 0x00007fffffffe5c0 RBP RBP 原本的值 0x00007fffffffe560 0x00007fffffffe5a0 0x401234 AAAAAAAA 0x00007fffffffe598 0x00007fffffffe590 RSP 0x00007fffffffe560 push rbp mov rbp, rsp sub rsp, 20h … call function1 leave ret main function1 Shellcode
  40. RBP push rbp mov rbp, rsp sub rsp, 30h …

    leave ret Shellcode 66 Stack 0x00007fffffffe5c8 0x00007fffffffe5c0 RBP 原本的值 0x00007fffffffe560 0x00007fffffffe5a0 0x401234 AAAAAAAA 0x00007fffffffe598 0x00007fffffffe590 RSP 0x00007fffffffe560 push rbp mov rbp, rsp sub rsp, 20h … call function1 leave ret main function1 Shellcode
  41. RSP push rbp mov rbp, rsp sub rsp, 30h …

    leave ret Shellcode 67 Stack 0x00007fffffffe5c8 0x00007fffffffe5c0 RBP 原本的值 0x00007fffffffe560 0x00007fffffffe5a0 0x401234 AAAAAAAA 0x00007fffffffe598 0x00007fffffffe590 0x00007fffffffe560 push rbp mov rbp, rsp sub rsp, 20h … call function1 leave ret main function1 Shellcode
  42. RSP push rbp mov rbp, rsp sub rsp, 30h …

    leave ret Shellcode 68 Stack 0x00007fffffffe5c8 0x00007fffffffe5c0 RBP 原本的值 0x00007fffffffe560 0x00007fffffffe5a0 0x401234 AAAAAAAA 0x00007fffffffe598 0x00007fffffffe590 0x00007fffffffe560 push rbp mov rbp, rsp sub rsp, 20h … call function1 leave ret main function1 Shellcode
  43. NX (No-eXecute) - NX aka DEP (Data Execution Prevention) -

    從剛剛的例子, 你會發現, 我們是執行位於 Stack 上的指令 - Stack 上的咚咚能執行?! 超怪 - 給每個記憶體區段設立三種權限 r(Read) w(Write) x(eXecute) - 設定 NX 就沒有 rwx 的區段 70
  44. Lazy Binding - 由於 Library 在執行時期才被 Load 上來, 位址不固定 -

    因此程式需要將引用的 Library Call 連結到 Library - But 1. 在程式一開始就解析所有用到的 Library Call 會讓程式很晚執行 2. 其實不是所有引用的 Library Call 都會被呼叫到 - 於是有了 Lazy Binding - 簡單來說就是在程式第一次呼叫到 Library Call 才開始解析其位 址 73
  45. Lazy Binding 74 <main> call <puts@plt> <0x555555555020> push [<link_map>] bnd

    jmp [<_dl_runtime_resolve>] nop <0x555555555030> endbr64 push 0x0 bnd jmp 0x555555555020 nop <0x555555555040> endbr64 push 0x1 bnd jmp 0x555555555020 nop main .plt <+0x0> (.dynamic) 0x3df8 <+0x8> (link_map) 0x00007ffff7ffe190 <+0x10> (_dl_runtime_resolve) 0x00007ffff7fe7bb0 <+0x18> ([email protected]) 0x0000555555555030 <+0x20> ([email protected]) 0x0000555555555040 .got.plt <puts@plt> endbr64 bnd jmp [<[email protected]>] nop <setvbuf@plt> endbr64 bnd jmp [<[email protected]>] nop .plt.sec
  46. Lazy Binding 75 <main> call <puts@plt> <0x555555555020> push [<link_map>] bnd

    jmp [<_dl_runtime_resolve>] nop <0x555555555030> endbr64 push 0x0 bnd jmp 0x555555555020 nop <0x555555555040> endbr64 push 0x1 bnd jmp 0x555555555020 nop main .plt <+0x0> (.dynamic) 0x3df8 <+0x8> (link_map) 0x00007ffff7ffe190 <+0x10> (_dl_runtime_resolve) 0x00007ffff7fe7bb0 <+0x18> ([email protected]) 0x0000555555555030 <+0x20> ([email protected]) 0x0000555555555040 .got.plt <puts@plt> endbr64 bnd jmp [<[email protected]>] nop <setvbuf@plt> endbr64 bnd jmp [<[email protected]>] nop .plt.sec 第一次呼叫 puts
  47. Lazy Binding 76 <main> call <puts@plt> <0x555555555020> push [<link_map>] bnd

    jmp [<_dl_runtime_resolve>] nop <0x555555555030> endbr64 push 0x0 bnd jmp 0x555555555020 nop <0x555555555040> endbr64 push 0x1 bnd jmp 0x555555555020 nop main .plt <+0x0> (.dynamic) 0x3df8 <+0x8> (link_map) 0x00007ffff7ffe190 <+0x10> (_dl_runtime_resolve) 0x00007ffff7fe7bb0 <+0x18> ([email protected]) 0x0000555555555030 <+0x20> ([email protected]) 0x0000555555555040 .got.plt <puts@plt> endbr64 bnd jmp [<[email protected]>] nop <setvbuf@plt> endbr64 bnd jmp [<[email protected]>] nop .plt.sec
  48. Lazy Binding 77 <main> call <puts@plt> <0x555555555020> push [<link_map>] bnd

    jmp [<_dl_runtime_resolve>] nop <0x555555555030> endbr64 push 0x0 bnd jmp 0x555555555020 nop <0x555555555040> endbr64 push 0x1 bnd jmp 0x555555555020 nop main .plt <+0x0> (.dynamic) 0x3df8 <+0x8> (link_map) 0x00007ffff7ffe190 <+0x10> (_dl_runtime_resolve) 0x00007ffff7fe7bb0 <+0x18> ([email protected]) 0x0000555555555030 <+0x20> ([email protected]) 0x0000555555555040 .got.plt <puts@plt> endbr64 bnd jmp [<[email protected]>] nop <setvbuf@plt> endbr64 bnd jmp [<[email protected]>] nop .plt.sec
  49. Lazy Binding 78 <main> call <puts@plt> <0x555555555020> push [<link_map>] bnd

    jmp [<_dl_runtime_resolve>] nop <0x555555555030> endbr64 push 0x0 bnd jmp 0x555555555020 nop <0x555555555040> endbr64 push 0x1 bnd jmp 0x555555555020 nop main .plt <+0x0> (.dynamic) 0x3df8 <+0x8> (link_map) 0x00007ffff7ffe190 <+0x10> (_dl_runtime_resolve) 0x00007ffff7fe7bb0 <+0x18> ([email protected]) 0x0000555555555030 <+0x20> ([email protected]) 0x0000555555555040 .got.plt <puts@plt> endbr64 bnd jmp [<[email protected]>] nop <setvbuf@plt> endbr64 bnd jmp [<[email protected]>] nop .plt.sec 跳至 .plt 中
  50. Lazy Binding 79 <main> call <puts@plt> <0x555555555020> push [<link_map>] bnd

    jmp [<_dl_runtime_resolve>] nop <0x555555555030> endbr64 push 0x0 bnd jmp 0x555555555020 nop <0x555555555040> endbr64 push 0x1 bnd jmp 0x555555555020 nop main .plt <+0x0> (.dynamic) 0x3df8 <+0x8> (link_map) 0x00007ffff7ffe190 <+0x10> (_dl_runtime_resolve) 0x00007ffff7fe7bb0 <+0x18> ([email protected]) 0x0000555555555030 <+0x20> ([email protected]) 0x0000555555555040 .got.plt <puts@plt> endbr64 bnd jmp [<[email protected]>] nop <setvbuf@plt> endbr64 bnd jmp [<[email protected]>] nop .plt.sec
  51. Lazy Binding 80 <main> call <puts@plt> <0x555555555020> push [<link_map>] bnd

    jmp [<_dl_runtime_resolve>] nop <0x555555555030> endbr64 push 0x0 bnd jmp 0x555555555020 nop <0x555555555040> endbr64 push 0x1 bnd jmp 0x555555555020 nop main .plt <+0x0> (.dynamic) 0x3df8 <+0x8> (link_map) 0x00007ffff7ffe190 <+0x10> (_dl_runtime_resolve) 0x00007ffff7fe7bb0 <+0x18> ([email protected]) 0x0000555555555030 <+0x20> ([email protected]) 0x0000555555555040 .got.plt <puts@plt> endbr64 bnd jmp [<[email protected]>] nop <setvbuf@plt> endbr64 bnd jmp [<[email protected]>] nop .plt.sec 推入 index
  52. Lazy Binding 81 <main> call <puts@plt> <0x555555555020> push [<link_map>] bnd

    jmp [<_dl_runtime_resolve>] nop <0x555555555030> endbr64 push 0x0 bnd jmp 0x555555555020 nop <0x555555555040> endbr64 push 0x1 bnd jmp 0x555555555020 nop main .plt <+0x0> (.dynamic) 0x3df8 <+0x8> (link_map) 0x00007ffff7ffe190 <+0x10> (_dl_runtime_resolve) 0x00007ffff7fe7bb0 <+0x18> ([email protected]) 0x0000555555555030 <+0x20> ([email protected]) 0x0000555555555040 .got.plt <puts@plt> endbr64 bnd jmp [<[email protected]>] nop <setvbuf@plt> endbr64 bnd jmp [<[email protected]>] nop .plt.sec
  53. Lazy Binding 82 <main> call <puts@plt> <0x555555555020> push [<link_map>] bnd

    jmp [<_dl_runtime_resolve>] nop <0x555555555030> endbr64 push 0x0 bnd jmp 0x555555555020 nop <0x555555555040> endbr64 push 0x1 bnd jmp 0x555555555020 nop main .plt <+0x0> (.dynamic) 0x3df8 <+0x8> (link_map) 0x00007ffff7ffe190 <+0x10> (_dl_runtime_resolve) 0x00007ffff7fe7bb0 <+0x18> ([email protected]) 0x0000555555555030 <+0x20> ([email protected]) 0x0000555555555040 .got.plt <puts@plt> endbr64 bnd jmp [<[email protected]>] nop <setvbuf@plt> endbr64 bnd jmp [<[email protected]>] nop .plt.sec
  54. Lazy Binding 83 <main> call <puts@plt> <0x555555555020> push [<link_map>] bnd

    jmp [<_dl_runtime_resolve>] nop <0x555555555030> endbr64 push 0x0 bnd jmp 0x555555555020 nop <0x555555555040> endbr64 push 0x1 bnd jmp 0x555555555020 nop main .plt <+0x0> (.dynamic) 0x3df8 <+0x8> (link_map) 0x00007ffff7ffe190 <+0x10> (_dl_runtime_resolve) 0x00007ffff7fe7bb0 <+0x18> ([email protected]) 0x0000555555555030 <+0x20> ([email protected]) 0x0000555555555040 .got.plt <puts@plt> endbr64 bnd jmp [<[email protected]>] nop <setvbuf@plt> endbr64 bnd jmp [<[email protected]>] nop .plt.sec
  55. Lazy Binding 84 <main> call <puts@plt> <0x555555555020> push [<link_map>] bnd

    jmp [<_dl_runtime_resolve>] nop <0x555555555030> endbr64 push 0x0 bnd jmp 0x555555555020 nop <0x555555555040> endbr64 push 0x1 bnd jmp 0x555555555020 nop main .plt <+0x0> (.dynamic) 0x3df8 <+0x8> (link_map) 0x00007ffff7ffe190 <+0x10> (_dl_runtime_resolve) 0x00007ffff7fe7bb0 <+0x18> ([email protected]) 0x0000555555555030 <+0x20> ([email protected]) 0x0000555555555040 .got.plt <puts@plt> endbr64 bnd jmp [<[email protected]>] nop <setvbuf@plt> endbr64 bnd jmp [<[email protected]>] nop .plt.sec
  56. Lazy Binding 85 <main> call <puts@plt> <0x555555555020> push [<link_map>] bnd

    jmp [<_dl_runtime_resolve>] nop <0x555555555030> endbr64 push 0x0 bnd jmp 0x555555555020 nop <0x555555555040> endbr64 push 0x1 bnd jmp 0x555555555020 nop main .plt <+0x0> (.dynamic) 0x3df8 <+0x8> (link_map) 0x00007ffff7ffe190 <+0x10> (_dl_runtime_resolve) 0x00007ffff7fe7bb0 <+0x18> ([email protected]) 0x0000555555555030 <+0x20> ([email protected]) 0x0000555555555040 .got.plt <puts@plt> endbr64 bnd jmp [<[email protected]>] nop <setvbuf@plt> endbr64 bnd jmp [<[email protected]>] nop .plt.sec 跳到解析函數
  57. Lazy Binding 86 <main> call <puts@plt> <0x555555555020> push [<link_map>] bnd

    jmp [<_dl_runtime_resolve>] nop <0x555555555030> endbr64 push 0x0 bnd jmp 0x555555555020 nop <0x555555555040> endbr64 push 0x1 bnd jmp 0x555555555020 nop main .plt <+0x0> (.dynamic) 0x3df8 <+0x8> (link_map) 0x00007ffff7ffe190 <+0x10> (_dl_runtime_resolve) 0x00007ffff7fe7bb0 <+0x18> ([email protected]) 0x00007ffff7e505a0 <+0x20> ([email protected]) 0x0000555555555040 .got.plt <puts@plt> endbr64 bnd jmp [<[email protected]>] nop <setvbuf@plt> endbr64 bnd jmp [<[email protected]>] nop .plt.sec 解析後回填真正地址
  58. Lazy Binding 87 <main> call <puts@plt> call <puts@plt> <0x555555555020> push

    [<link_map>] bnd jmp [<_dl_runtime_resolve>] nop <0x555555555030> endbr64 push 0x0 bnd jmp 0x555555555020 nop <0x555555555040> endbr64 push 0x1 bnd jmp 0x555555555020 nop main .plt <+0x0> (.dynamic) 0x3df8 <+0x8> (link_map) 0x00007ffff7ffe190 <+0x10> (_dl_runtime_resolve) 0x00007ffff7fe7bb0 <+0x18> ([email protected]) 0x00007ffff7e505a0 <+0x20> ([email protected]) 0x0000555555555040 .got.plt <puts@plt> endbr64 bnd jmp [<[email protected]>] nop <setvbuf@plt> endbr64 bnd jmp [<[email protected]>] nop .plt.sec
  59. Lazy Binding 88 <main> call <puts@plt> call <puts@plt> <0x555555555020> push

    [<link_map>] bnd jmp [<_dl_runtime_resolve>] nop <0x555555555030> endbr64 push 0x0 bnd jmp 0x555555555020 nop <0x555555555040> endbr64 push 0x1 bnd jmp 0x555555555020 nop main .plt <+0x0> (.dynamic) 0x3df8 <+0x8> (link_map) 0x00007ffff7ffe190 <+0x10> (_dl_runtime_resolve) 0x00007ffff7fe7bb0 <+0x18> ([email protected]) 0x00007ffff7e505a0 <+0x20> ([email protected]) 0x0000555555555040 .got.plt <puts@plt> endbr64 bnd jmp [<[email protected]>] nop <setvbuf@plt> endbr64 bnd jmp [<[email protected]>] nop .plt.sec 之後再度呼叫 puts
  60. Lazy Binding 89 <main> call <puts@plt> call <puts@plt> <0x555555555020> push

    [<link_map>] bnd jmp [<_dl_runtime_resolve>] nop <0x555555555030> endbr64 push 0x0 bnd jmp 0x555555555020 nop <0x555555555040> endbr64 push 0x1 bnd jmp 0x555555555020 nop main .plt <+0x0> (.dynamic) 0x3df8 <+0x8> (link_map) 0x00007ffff7ffe190 <+0x10> (_dl_runtime_resolve) 0x00007ffff7fe7bb0 <+0x18> ([email protected]) 0x00007ffff7e505a0 <+0x20> ([email protected]) 0x0000555555555040 .got.plt <puts@plt> endbr64 bnd jmp [<[email protected]>] nop <setvbuf@plt> endbr64 bnd jmp [<[email protected]>] nop .plt.sec
  61. Lazy Binding 90 <main> call <puts@plt> call <puts@plt> <0x555555555020> push

    [<link_map>] bnd jmp [<_dl_runtime_resolve>] nop <0x555555555030> endbr64 push 0x0 bnd jmp 0x555555555020 nop <0x555555555040> endbr64 push 0x1 bnd jmp 0x555555555020 nop main .plt <+0x0> (.dynamic) 0x3df8 <+0x8> (link_map) 0x00007ffff7ffe190 <+0x10> (_dl_runtime_resolve) 0x00007ffff7fe7bb0 <+0x18> ([email protected]) 0x00007ffff7e505a0 <+0x20> ([email protected]) 0x0000555555555040 .got.plt <puts@plt> endbr64 bnd jmp [<[email protected]>] nop <setvbuf@plt> endbr64 bnd jmp [<[email protected]>] nop .plt.sec
  62. Lazy Binding 91 <main> call <puts@plt> call <puts@plt> <0x555555555020> push

    [<link_map>] bnd jmp [<_dl_runtime_resolve>] nop <0x555555555030> endbr64 push 0x0 bnd jmp 0x555555555020 nop <0x555555555040> endbr64 push 0x1 bnd jmp 0x555555555020 nop main .plt <+0x0> (.dynamic) 0x3df8 <+0x8> (link_map) 0x00007ffff7ffe190 <+0x10> (_dl_runtime_resolve) 0x00007ffff7fe7bb0 <+0x18> ([email protected]) 0x00007ffff7e505a0 <+0x20> ([email protected]) 0x0000555555555040 .got.plt <puts@plt> endbr64 bnd jmp [<[email protected]>] nop <setvbuf@plt> endbr64 bnd jmp [<[email protected]>] nop .plt.sec 跳到 puts 真正位址
  63. GOT Hijack 94 <main> call <puts@plt> <0x555555555020> push [<link_map>] bnd

    jmp [<_dl_runtime_resolve>] nop <0x555555555030> endbr64 push 0x0 bnd jmp 0x555555555020 nop <0x555555555040> endbr64 push 0x1 bnd jmp 0x555555555020 nop main .plt <+0x0> (.dynamic) 0x3df8 <+0x8> (link_map) 0x00007ffff7ffe190 <+0x10> (_dl_runtime_resolve) 0x00007ffff7fe7bb0 <+0x18> ([email protected]) 0x0000555555555030 <+0x20> ([email protected]) 0x0000555555555040 .got.plt <puts@plt> endbr64 bnd jmp [<[email protected]>] nop <setvbuf@plt> endbr64 bnd jmp [<[email protected]>] nop .plt.sec
  64. GOT Hijack 95 <main> call <puts@plt> <0x555555555020> push [<link_map>] bnd

    jmp [<_dl_runtime_resolve>] nop <0x555555555030> endbr64 push 0x0 bnd jmp 0x555555555020 nop <0x555555555040> endbr64 push 0x1 bnd jmp 0x555555555020 nop main .plt <+0x0> (.dynamic) 0x3df8 <+0x8> (link_map) 0x00007ffff7ffe190 <+0x10> (_dl_runtime_resolve) 0x00007ffff7fe7bb0 <+0x18> ([email protected]) 0x4141414141414141 <+0x20> ([email protected]) 0x0000555555555040 .got.plt <puts@plt> endbr64 bnd jmp [<[email protected]>] nop <setvbuf@plt> endbr64 bnd jmp [<[email protected]>] nop .plt.sec Overwrite GOT Table
  65. GOT Hijack 96 <main> call <puts@plt> <0x555555555020> push [<link_map>] bnd

    jmp [<_dl_runtime_resolve>] nop <0x555555555030> endbr64 push 0x0 bnd jmp 0x555555555020 nop <0x555555555040> endbr64 push 0x1 bnd jmp 0x555555555020 nop main .plt <+0x0> (.dynamic) 0x3df8 <+0x8> (link_map) 0x00007ffff7ffe190 <+0x10> (_dl_runtime_resolve) 0x00007ffff7fe7bb0 <+0x18> ([email protected]) 0x4141414141414141 <+0x20> ([email protected]) 0x0000555555555040 .got.plt <puts@plt> endbr64 bnd jmp [<[email protected]>] nop <setvbuf@plt> endbr64 bnd jmp [<[email protected]>] nop .plt.sec
  66. GOT Hijack 97 <main> call <puts@plt> <0x555555555020> push [<link_map>] bnd

    jmp [<_dl_runtime_resolve>] nop <0x555555555030> endbr64 push 0x0 bnd jmp 0x555555555020 nop <0x555555555040> endbr64 push 0x1 bnd jmp 0x555555555020 nop main .plt <+0x0> (.dynamic) 0x3df8 <+0x8> (link_map) 0x00007ffff7ffe190 <+0x10> (_dl_runtime_resolve) 0x00007ffff7fe7bb0 <+0x18> ([email protected]) 0x4141414141414141 <+0x20> ([email protected]) 0x0000555555555040 .got.plt <puts@plt> endbr64 bnd jmp [<[email protected]>] nop <setvbuf@plt> endbr64 bnd jmp [<[email protected]>] nop .plt.sec
  67. GOT Hijack 98 <main> call <puts@plt> <0x555555555020> push [<link_map>] bnd

    jmp [<_dl_runtime_resolve>] nop <0x555555555030> endbr64 push 0x0 bnd jmp 0x555555555020 nop <0x555555555040> endbr64 push 0x1 bnd jmp 0x555555555020 nop main .plt <+0x0> (.dynamic) 0x3df8 <+0x8> (link_map) 0x00007ffff7ffe190 <+0x10> (_dl_runtime_resolve) 0x00007ffff7fe7bb0 <+0x18> ([email protected]) 0x4141414141414141 <+0x20> ([email protected]) 0x0000555555555040 .got.plt <puts@plt> endbr64 bnd jmp [<[email protected]>] nop <setvbuf@plt> endbr64 bnd jmp [<[email protected]>] nop .plt.sec
  68. GOT Hijack 99 <main> call <puts@plt> <0x555555555020> push [<link_map>] bnd

    jmp [<_dl_runtime_resolve>] nop <0x555555555030> endbr64 push 0x0 bnd jmp 0x555555555020 nop <0x555555555040> endbr64 push 0x1 bnd jmp 0x555555555020 nop main .plt <+0x0> (.dynamic) 0x3df8 <+0x8> (link_map) 0x00007ffff7ffe190 <+0x10> (_dl_runtime_resolve) 0x00007ffff7fe7bb0 <+0x18> ([email protected]) 0x4141414141414141 <+0x20> ([email protected]) 0x0000555555555040 .got.plt <puts@plt> endbr64 bnd jmp [<[email protected]>] nop <setvbuf@plt> endbr64 bnd jmp [<[email protected]>] nop .plt.sec Hijack Control Flow
  69. One Gadget - Gadget 是指一些可利用的指令片段 - libc 中有一些位址, 跳過去就會開 shell

    了 - 這個 Gadget 就是 One Gadget, 一發入魂 - https://github.com/david942j/one_gadget - libc 2.31: https://qiita.com/kusano_k/items/4a6f285cca613fcf9c9e#gl ibc-231の場合 102 圖片來源: https://ithelp.ithome.com.tw/articles/10226977
  70. ROP - ROP 全名 Return-Oriented Programming - 找結尾是 ret 的

    Gadgets - 並在 Stack 上安排這些 Gadgets - 就能依序執行到所有在 Stack 上的 Gadgets 的指令片段 105
  71. push rbp mov rbp, rsp sub rsp, 30h … leave

    ret ROP 106 Stack 0x00007fffffffe5c8 0x00007fffffffe5c0 RBP RBP 原本的值 0x401234 0x00007fffffffe5a0 0x405566 0x00007fffffffe5c0 0x00007fffffffe598 0x00007fffffffe590 RSP 0x00007fffffffe560 pop rdi ret Gadget1 function1 0x407777 pop rsi pop rdx pop rax ret Gadget2 0x408888 syscall Gadget3
  72. RBP push rbp mov rbp, rsp sub rsp, 30h …

    leave ret ROP 107 Stack 0x405566 0x00007fffffffe5a0 0x405566 AAAAAAAA 0x00007fffffffe598 0x00007fffffffe590 RSP 0x00007fffffffe560 pop rdi ret Gadget1 function1 0x00007fffffffe560 0x407777 0 0 59 0x00007fffffffe5a8 0x00007fffffffe5b0 0x00007fffffffe5b8 0x00007fffffffe5c0 /bin/sh\0 AAAAAAAA … AAAAAAAA 0x407777 pop rsi pop rdx pop rax ret Gadget2 0x408888 syscall Gadget3 0x408888 0x00007fffffffe5c8 Overwrite Stack
  73. RBP push rbp mov rbp, rsp sub rsp, 30h …

    leave ret ROP 108 Stack 0x405566 0x00007fffffffe5a0 0x405566 AAAAAAAA 0x00007fffffffe598 0x00007fffffffe590 RSP 0x00007fffffffe560 pop rdi ret Gadget1 function1 0x00007fffffffe560 0x407777 0 0 59 0x00007fffffffe5a8 0x00007fffffffe5b0 0x00007fffffffe5b8 0x00007fffffffe5c0 /bin/sh\0 AAAAAAAA … AAAAAAAA 0x407777 pop rsi pop rdx pop rax ret Gadget2 0x408888 syscall Gadget3 0x408888 0x00007fffffffe5c8
  74. RSP push rbp mov rbp, rsp sub rsp, 30h …

    leave ret ROP 109 Stack 0x405566 0x00007fffffffe5a0 0x405566 AAAAAAAA 0x00007fffffffe598 0x00007fffffffe590 0x00007fffffffe560 pop rdi ret Gadget1 function1 0x00007fffffffe560 0x407777 0 0 59 0x00007fffffffe5a8 0x00007fffffffe5b0 0x00007fffffffe5b8 0x00007fffffffe5c0 /bin/sh\0 AAAAAAAA … AAAAAAAA 0x407777 pop rsi pop rdx pop rax ret Gadget2 0x408888 syscall Gadget3 0x408888 0x00007fffffffe5c8 Return to Gadget1
  75. RSP push rbp mov rbp, rsp sub rsp, 30h …

    leave ret ROP 110 Stack 0x405566 0x00007fffffffe5a0 0x405566 AAAAAAAA 0x00007fffffffe598 0x00007fffffffe590 0x00007fffffffe560 pop rdi ret Gadget1 function1 0x00007fffffffe560 0x407777 0 0 59 0x00007fffffffe5a8 0x00007fffffffe5b0 0x00007fffffffe5b8 0x00007fffffffe5c0 /bin/sh\0 AAAAAAAA … AAAAAAAA 0x407777 pop rsi pop rdx pop rax ret Gadget2 0x408888 syscall Gadget3 0x408888 0x00007fffffffe5c8
  76. RSP push rbp mov rbp, rsp sub rsp, 30h …

    leave ret ROP 111 Stack 0x405566 0x00007fffffffe5a0 0x405566 AAAAAAAA 0x00007fffffffe598 0x00007fffffffe590 0x00007fffffffe560 pop rdi ret Gadget1 function1 0x00007fffffffe560 0x407777 0 0 59 0x00007fffffffe5a8 0x00007fffffffe5b0 0x00007fffffffe5b8 0x00007fffffffe5c0 /bin/sh\0 AAAAAAAA … AAAAAAAA 0x407777 pop rsi pop rdx pop rax ret Gadget2 0x408888 syscall Gadget3 0x408888 0x00007fffffffe5c8 rdi: 0x00007fffffffe560 (“/bin/sh”) Return to Gadget2
  77. RSP push rbp mov rbp, rsp sub rsp, 30h …

    leave ret ROP 112 Stack 0x405566 0x00007fffffffe5a0 0x405566 AAAAAAAA 0x00007fffffffe598 0x00007fffffffe590 0x00007fffffffe560 pop rdi ret Gadget1 function1 0x00007fffffffe560 0x407777 0 0 59 0x00007fffffffe5a8 0x00007fffffffe5b0 0x00007fffffffe5b8 0x00007fffffffe5c0 /bin/sh\0 AAAAAAAA … AAAAAAAA 0x407777 pop rsi pop rdx pop rax ret Gadget2 0x408888 syscall Gadget3 0x408888 0x00007fffffffe5c8 rdi: 0x00007fffffffe560 (“/bin/sh”)
  78. RSP push rbp mov rbp, rsp sub rsp, 30h …

    leave ret ROP 113 Stack 0x405566 0x00007fffffffe5a0 0x405566 AAAAAAAA 0x00007fffffffe598 0x00007fffffffe590 0x00007fffffffe560 pop rdi ret Gadget1 function1 0x00007fffffffe560 0x407777 0 0 59 0x00007fffffffe5a8 0x00007fffffffe5b0 0x00007fffffffe5b8 0x00007fffffffe5c0 /bin/sh\0 AAAAAAAA … AAAAAAAA 0x407777 pop rsi pop rdx pop rax ret Gadget2 0x408888 syscall Gadget3 0x408888 0x00007fffffffe5c8 rdi: 0x00007fffffffe560 (“/bin/sh”) rsi: 0
  79. RSP push rbp mov rbp, rsp sub rsp, 30h …

    leave ret ROP 114 Stack 0x405566 0x00007fffffffe5a0 0x405566 AAAAAAAA 0x00007fffffffe598 0x00007fffffffe590 0x00007fffffffe560 pop rdi ret Gadget1 function1 0x00007fffffffe560 0x407777 0 0 59 0x00007fffffffe5a8 0x00007fffffffe5b0 0x00007fffffffe5b8 0x00007fffffffe5c0 /bin/sh\0 AAAAAAAA … AAAAAAAA 0x407777 pop rsi pop rdx pop rax ret Gadget2 0x408888 syscall Gadget3 0x408888 0x00007fffffffe5c8 rdi: 0x00007fffffffe560 (“/bin/sh”) rsi: 0 rdx: 0
  80. RSP push rbp mov rbp, rsp sub rsp, 30h …

    leave ret ROP 115 Stack 0x405566 0x00007fffffffe5a0 0x405566 AAAAAAAA 0x00007fffffffe598 0x00007fffffffe590 0x00007fffffffe560 pop rdi ret Gadget1 function1 0x00007fffffffe560 0x407777 0 0 59 0x00007fffffffe5a8 0x00007fffffffe5b0 0x00007fffffffe5b8 0x00007fffffffe5c0 /bin/sh\0 AAAAAAAA … AAAAAAAA 0x407777 pop rsi pop rdx pop rax ret Gadget2 0x408888 syscall Gadget3 0x408888 0x00007fffffffe5c8 rdi: 0x00007fffffffe560 (“/bin/sh”) rsi: 0 rdx: 0 rax: 59 Return to Gadget3
  81. RSP push rbp mov rbp, rsp sub rsp, 30h …

    leave ret ROP 116 Stack 0x405566 0x00007fffffffe5a0 0x405566 AAAAAAAA 0x00007fffffffe598 0x00007fffffffe590 0x00007fffffffe560 pop rdi ret Gadget1 function1 0x00007fffffffe560 0x407777 0 0 59 0x00007fffffffe5a8 0x00007fffffffe5b0 0x00007fffffffe5b8 0x00007fffffffe5c0 /bin/sh\0 AAAAAAAA … AAAAAAAA 0x407777 pop rsi pop rdx pop rax ret Gadget2 0x408888 syscall Gadget3 0x408888 0x00007fffffffe5c8 rdi: 0x00007fffffffe560 (“/bin/sh”) rsi: 0 rdx: 0 rax: 59
  82. RSP push rbp mov rbp, rsp sub rsp, 30h …

    leave ret ROP 117 Stack 0x405566 0x00007fffffffe5a0 0x405566 AAAAAAAA 0x00007fffffffe598 0x00007fffffffe590 0x00007fffffffe560 pop rdi ret Gadget1 function1 0x00007fffffffe560 0x407777 0 0 59 0x00007fffffffe5a8 0x00007fffffffe5b0 0x00007fffffffe5b8 0x00007fffffffe5c0 /bin/sh\0 AAAAAAAA … AAAAAAAA 0x407777 pop rsi pop rdx pop rax ret Gadget2 0x408888 syscall Gadget3 0x408888 0x00007fffffffe5c8 rdi: 0x00007fffffffe560 (“/bin/sh”) rsi: 0 rdx: 0 rax: 59