Upgrade to Pro
— share decks privately, control downloads, hide ads and more …
Speaker Deck
Features
Speaker Deck
PRO
Sign in
Sign up for free
Search
Search
Binary Exploitation
Search
yuawn
November 22, 2019
Education
2
1.5k
Binary Exploitation
NTU CS 2019 Fall week2 - Binary Exploitation
台大 - 計算機安全 Pwn
交大 - 程式安全
台科大 - 資訊安全實務
yuawn
November 22, 2019
Tweet
Share
More Decks by yuawn
See All by yuawn
MediaTek Fuzzing Workshop
yuawn
2
1.1k
Kernel Exploitation
yuawn
4
3.2k
Heap Exploitation
yuawn
2
1.3k
Binary Exploitation - Basic
yuawn
2
2.9k
HITCON Badge 2019 - MCU ARM TrustZone Challenge
yuawn
2
370
Other Decks in Education
See All in Education
Qualtricsで相互作用実験する「SMARTRIQS」入門編
kscscr
0
320
CompTIA Security+ SY0-601 Resumo
mariliarochas
2
2.6k
Human Perception and Cognition - Lecture 4 - Human-Computer Interaction (1023841ANR)
signer
PRO
0
710
2409_CompanyInfo_Hanji_published.pdf
yosukemurata
0
370
Chapitre_1_-__L_atmosphère_et_la_vie_-_Partie_2.pdf
bernhardsvt
0
200
Introduction - Lecture 1 - Web Technologies (1019888BNR)
signer
PRO
0
4.9k
勉強したらどうなるの?
mineo_matsuya
10
6.5k
お仕事図鑑pitchトーク
tetsuyaooooo
0
2.3k
HCI Research Methods - Lecture 7 - Human-Computer Interaction (1023841ANR)
signer
PRO
0
710
JavaScript - Lecture 6 - Web Technologies (1019888BNR)
signer
PRO
0
2.5k
Image Processing 1 : 1.Introduction
hachama
0
260
Beispiel einer Fortbildung für "Soziales Lernen"
gsgoethe
0
110
Featured
See All Featured
It's Worth the Effort
3n
183
27k
Why Our Code Smells
bkeepers
PRO
334
57k
Responsive Adventures: Dirty Tricks From The Dark Corners of Front-End
smashingmag
250
21k
Done Done
chrislema
181
16k
Building a Scalable Design System with Sketch
lauravandoore
459
33k
Fight the Zombie Pattern Library - RWD Summit 2016
marcelosomers
232
17k
Agile that works and the tools we love
rasmusluckow
327
21k
How STYLIGHT went responsive
nonsquared
95
5.2k
Happy Clients
brianwarren
98
6.7k
Design and Strategy: How to Deal with People Who Don’t "Get" Design
morganepeng
126
18k
Statistics for Hackers
jakevdp
796
220k
Facilitating Awesome Meetings
lara
50
6.1k
Transcript
Binary Exploitation yuawn
About • yuawn • Pwn • Balsn / DoubleSigma
_yuawn
Outline • ROP • ret2plt • ret2libc • Information leak
• Stack Pivoting • ROP 萬解 - ret2csu PWNED
ROP Return Oriented Programming Attack
ROP gadgets
ROP gadget • 片段可執⾏行行的 code • 結尾是 ret instruction •
call, jmp … 等任何可以繼續控制流程的⽅方式 • How to find the gadgets? • https://github.com/JonathanSalwan/ROPgadget • https://github.com/sashs/Ropper • ⼿手動找
ROP • NX - ⾒見見招拆招 • 在既有的執⾏行行區域 (code segment) 尋找
gadgets,運⽤用這些 gadgets 疊成⼀一長串串的 return address chain (ROP chain)。 • 透過許多片段執⾏行行⾏行行為的 gadget,來來串串出任意代碼執⾏行行,藉此繞過 NX 保護機制的限制。 • Function return 時,會拿走第⼀一個 return address,此時 rsp 指在第⼆二個 return address, 並跳⾄至第⼀一個 return address 執⾏行行,接著會執⾏行行到 ret instruction,⽽而第⼆二個 return address 也在開始時放置好,做到繼續 control flow,如此反覆來來達到 Return Oriented Programming 型式的攻擊。
ROP • Overflow • NX - Shellcode mov rax, 100
mov rbx, 66 add rax, rbx
… Gadget 2: mov rbx, 66 ret … Gadget 3:
add rax, rbx ret … main: … leave ret … Gadget 1: mov rax, 100 ret ... low address high address return address saved rbp local variables of func()
… Gadget 2: mov rbx, 66 ret … Gadget 3:
add rax, rbx ret … main: … leave ret … Gadget 1: mov rax, 100 ret ... low address high address AAAAAAAA AAAAAAAA AAAAAAAA
… Gadget 2: mov rbx, 66 ret … Gadget 3:
add rax, rbx ret … main: … leave ret … Gadget 1: mov rax, 100 ret ... low address high address Gadget 1 AAAAAAAA AAAAAAAA Gadget 2 Gadget 3
… Gadget 2: mov rbx, 66 ret … Gadget 3:
add rax, rbx ret … main: … leave ret … Gadget 1: mov rax, 100 ret ... low address high address AAAAAAAA AAAAAAAA rsp rip Gadget 1 Gadget 2 Gadget 3
… Gadget 2: mov rbx, 66 ret … Gadget 3:
add rax, rbx ret … main: … leave ret … Gadget 1: mov rax, 100 ret ... low address high address AAAAAAAA AAAAAAAA rsp rip Gadget 1 Gadget 2 Gadget 3
… Gadget 2: mov rbx, 66 ret … Gadget 3:
add rax, rbx ret … main: … leave ret … Gadget 1: mov rax, 100 ret ... low address high address AAAAAAAA AAAAAAAA rsp rip Gadget 1 Gadget 2 Gadget 3 rax = 100
… Gadget 2: mov rbx, 66 ret … Gadget 3:
add rax, rbx ret … main: … leave ret … Gadget 1: mov rax, 100 ret ... low address high address AAAAAAAA AAAAAAAA rsp rip Gadget 1 Gadget 2 Gadget 3 Control return address again.
… Gadget 2: mov rbx, 66 ret … Gadget 3:
add rax, rbx ret … main: … leave ret … Gadget 1: mov rax, 100 ret ... low address high address AAAAAAAA AAAAAAAA rsp rip Gadget 1 Gadget 2 Gadget 3
… Gadget 2: mov rbx, 66 ret … Gadget 3:
add rax, rbx ret … main: … leave ret … Gadget 1: mov rax, 100 ret ... low address high address AAAAAAAA AAAAAAAA rsp rip Gadget 1 Gadget 2 Gadget 3 rbx = 66
… Gadget 2: mov rbx, 66 ret … Gadget 3:
add rax, rbx ret … main: … leave ret … Gadget 1: mov rax, 100 ret ... low address high address AAAAAAAA AAAAAAAA rsp rip Gadget 1 Gadget 2 Gadget 3
… Gadget 2: mov rbx, 66 ret … Gadget 3:
add rax, rbx ret … main: … leave ret … Gadget 1: mov rax, 100 ret ... low address high address AAAAAAAA AAAAAAAA rsp rip Gadget 1 Gadget 2 Gadget 3 rax = 100 + 66 = 166
Control Register
ROP • Control Register • Gadget - pop <reg>; ret
pop rax ret rsp pop rax 0xfaceb00c Gadget Return
pop rax ret rip pop rax 0xfaceb00c Gadget rsp
pop rax ret rip rsp pop rax 0xfaceb00c Gadget rax
= 0xfaceb00c
pop rax ret rip rsp pop rax 0xfaceb00c Gadget 繼續
ROP Gadget
ROP • 常常不會那麼剛好都會有我們想要的 gadget 並且是 ret 結尾。 • 想辦法組合 gadget,達成同樣的⽬目的
• 例例如想控制 rax,沒有 pop rax; ret gadget 也⾼高機率不會剛剛好有 mov rax, <希望的值>: • 假設存在,pop rdi; ret 與 mov rax, rdi; ret,組合出控制 rax 值的 payload • 或是找到 xor rax, rax; ret 與 inc rax; ret,先將 rax 清零在⼀一直加⼀一⾄至想要的值 • 等等
ROP • 存在 overflow,或任何成功 control rip 的前提下: • NX 關的情況下,我們可以撰寫執⾏行行
execve( "/bin/sh" , 0 , 0 ) 的 shellcode 並嘗試控制 rip 跳⾄至 shellcode。 • 但 NX 開啟時,則可以透過 ROP 的⽅方式,堆疊出執⾏行行 execve( "/bin/sh" , 0 , 0 ) ⾏行行為的 ROP Chain。
ROP int execve( const char *pathname, char *const argv[], char
*const envp[] ); rdi = address of "/bin/sh" rsi = 0x0 rdx = 0x0 rax = 0x3b Shellocode
ROP int execve( const char *pathname, char *const argv[], char
*const envp[] ); rdi = address of "/bin/sh" rsi = 0x0 rdx = 0x0 rax = 0x3b NX - Shellocode
ROP int execve( const char *pathname, char *const argv[], char
*const envp[] ); rdi = address of "/bin/sh" rsi = 0x0 rdx = 0x0 rax = 0x3b ROP!
ROP pop rdi 0x601000 pop rsi "/bin/sh\0" mov [rdi], rsi
pop rdx; pop rsi 0 0 pop rax 0x3b syscall rax = rbx = rcx = rdx = rdi = rsi = rsp
ROP 0x400686 0x601000 pop rsi "/bin/sh\0" mov [rdi], rsi pop
rdx; pop rsi 0 0 pop rax 0x3b syscall rsp rax = rbx = rcx = rdx = rdi = rsi = 假如 pop rdi; ret 此 gadget 位於 0x400686
ROP 0x400686 0x601000 pop rsi "/bin/sh\0" mov [rdi], rsi pop
rdx; pop rsi 0 0 pop rax 0x3b syscall pop rdi ret rip = 0x400686 rsp rax = rbx = rcx = rdx = rdi = rsi =
ROP 0x601000 pop rsi "/bin/sh\0" mov [rdi], rsi pop rdx;
pop rsi 0 0 pop rax 0x3b syscall pop rdi ret rip rsp rax = rbx = rcx = rdx = rdi = 0x601000 rsi = pop rdi
ROP 0x601000 pop rsi "/bin/sh\0" mov [rdi], rsi pop rdx;
pop rsi 0 0 pop rax 0x3b syscall pop rdi ret rip rsp rax = rbx = rcx = rdx = rdi = 0x601000 rsi = pop rdi
ROP 0x601000 pop rsi "/bin/sh\0" mov [rdi], rsi pop rdx;
pop rsi 0 0 pop rax 0x3b syscall pop rsi ret rip rsp rax = rbx = rcx = rdx = rdi = 0x601000 rsi = pop rdi
ROP 0x601000 pop rsi "/bin/sh\0" mov [rdi], rsi pop rdx;
pop rsi 0 0 pop rax 0x3b syscall pop rsi ret rip rsp rax = rbx = rcx = rdx = rdi = 0x601000 rsi = 0x68732f6e69622f pop rdi
ROP 0x601000 pop rsi "/bin/sh\0" mov [rdi], rsi pop rdx;
pop rsi 0 0 pop rax 0x3b syscall pop rsi ret rip rsp rax = rbx = rcx = rdx = rdi = 0x601000 rsi = "/bin/sh" pop rdi
ROP 0x601000 pop rsi "/bin/sh\0" mov [rdi], rsi pop rdx;
pop rsi 0 0 pop rax 0x3b syscall rip rsp mov [rdi], rsi ret 將 "/bin/sh" 字串串 存到 0x601000 的位置 rax = rbx = rcx = rdx = rdi = 0x601000 rsi = "/bin/sh" pop rdi
ROP 0x601000 pop rsi "/bin/sh\0" mov [rdi], rsi pop rdx;
pop rsi 0 0 pop rax 0x3b syscall rip rsp mov [rdi], rsi ret rax = rbx = rcx = rdx = rdi = ["/bin/sh"] rsi = "/bin/sh" pop rdi
ROP 0x601000 pop rsi "/bin/sh\0" mov [rdi], rsi pop rdx;
pop rsi 0 0 pop rax 0x3b syscall rip rsp pop rdx pop rsi ret rax = rbx = rcx = rdx = rdi = ["/bin/sh"] rsi = "/bin/sh" pop rdi
ROP 0x601000 pop rsi "/bin/sh\0" mov [rdi], rsi pop rdx;
pop rsi 0 0 pop rax 0x3b syscall rip rsp pop rdx pop rsi ret rax = rbx = rcx = rdx = 0x0 rdi = ["/bin/sh"] rsi = "/bin/sh" pop rdi
ROP 0x601000 pop rsi "/bin/sh\0" mov [rdi], rsi pop rdx;
pop rsi 0 0 pop rax 0x3b syscall rip rsp pop rdx pop rsi ret rax = rbx = rcx = rdx = 0x0 rdi = ["/bin/sh"] rsi = 0x0 pop rdi
ROP 0x601000 pop rsi "/bin/sh\0" mov [rdi], rsi pop rdx;
pop rsi 0 0 pop rax 0x3b syscall rip rsp rax = rbx = rcx = rdx = 0x0 rdi = ["/bin/sh"] rsi = 0x0 pop rax ret pop rdi
ROP 0x601000 pop rsi "/bin/sh\0" mov [rdi], rsi pop rdx;
pop rsi 0 0 pop rax 0x3b syscall rip rsp rax = 0x3b rbx = rcx = rdx = 0x0 rdi = ["/bin/sh"] rsi = 0x0 pop rax ret pop rdi
ROP 0x601000 pop rsi "/bin/sh\0" mov [rdi], rsi pop rdx;
pop rsi 0 0 pop rax 0x3b syscall rip rsp rax = 0x3b rbx = rcx = rdx = 0x0 rdi = ["/bin/sh"] rsi = 0x0 syscall pop rdi
ROP 0x601000 pop rsi "/bin/sh\0" mov [rdi], rsi pop rdx;
pop rsi 0 0 pop rax 0x3b syscall rip rsp rax = 0x3b rbx = rcx = rdx = 0x0 rdi = ["/bin/sh"] rsi = 0x0 syscall execve( "/bin/sh" , 0 , 0 ) Get Shell! pop rdi
ROP 0x601000 pop rsi "/bin/sh\0" mov [rdi], rsi pop rdx;
pop rsi 0 0 pop rax 0x3b syscall rip rsp rax = 0x3b rbx = rcx = rdx = 0x0 rdi = ["/bin/sh"] rsi = 0x0 syscall execve( "/bin/sh" , 0 , 0 ) Get Shell! PWNED ☠ pop rdi
Demo
ret2plt return to .plt
ret2plt • 如果想要串串的⾏行行為本⾝身就有 function 在 binary 中,例例如,binary 本⾝身有 puts(),我 們可以直接⽤用
ROP 放好參參數直接使⽤用它,就不⽤用⽤用 ROP 去堆全部的⾏行行為。 • 在 PIE 關的情況下,即使不知道 library function address (因 ASLR),也可以透過 return 到 .plt 上來來使⽤用這個 function,這個做法即稱為 ret2plt。
ret2plt • write( 1 , "Hello World" , 12 )
pop rdi 1 pop rsi ["Hello World"] pop rdx 11 pop rax 1 syscall
ret2plt • puts( "Hello World" ) pop rdi ["Hello World"]
puts@plt
ret2plt • system("/bin/sh") pop rdi ["/bin/sh"] system@plt
ret2plt • system("/bin/sh") pop rdi ["/bin/sh"] system@plt PWNED ☠
Demo
ret2libc return to libc
ret2libc • Return to libc • 倘若若能得知 library 被 map
到的隨機起始地址 (base address),則可以計 算出 libc 中 function 的位置,便便能調⽤用 library 中的函式。
ret2libc • 關鍵為 bypass ASLR,找出 libc 的隨機 base • 透過
information leak 漏洞洞,洩漏 memory 上的內容,獲取屬於 libc segment 的 address • 此 address 會是隨機的 base address 加上⼀一固定位移植 offset (不同版 本的 libc offset 不同)
ret2libc • leaked_address - offset = base_address • 例例如,洩漏出 printf@got
中的內容為 0x7fd0f9e57e80,⽽而已知 libc 版本為 2.27,可以 透過靜態分析 (readelf -s 等) 得知 printf function 在 library 中的 offset 為 0x64e80, 扣掉 offset 後求得此次執⾏行行 libc 的隨機 base address 是 0x7fd0f9df3000 = 0x7fd0f9e57e80 - 0x64e80 • 有 base 後就可以透過加上 offset 的⽅方式得知其他 function 的 address,來來 call 它,結 合 ROP 等等。 • system() = libc_base_address + system_offset = 0x7fd0f9df3000 + 0x4f440 = 0x7fd0f9e42440
Demo
Demo Information leak
Stack Pivoting stack migration
Stack pivoting • ROP 需要很多的空間來來放置長串串的 ROP Chain,有時候並不會有那麼多的發揮空 間,可能很短甚⾄至只能控第⼀一次 rip (function
pointer 等等),沒有⾜足夠的空間存放 ROP payload。 • 倘若若找到其他地⽅方有⾜足夠的空間放置 ROP payload,此時可以透過運⽤用較少的 gadget 數,來來將 stack 搬移⾄至 ROP payload 的位置,再進⾏行行 ROP,此作法即為 stack pivoting 或 stack migration。
Stack pivoting • 很多作法 • leave; ret • overflow 時將
rbp 填成 ROP Chain 的 address - 8, • return address 填 leave; ret gadget • pop rsp; ret • ⼿手動找針對各種當下情況的 gadget
Stack pivoting low address high address return address saved rbp
local variables of func() rsp rbp
Stack pivoting low address high address AAAAAAAA AAAAAAAA AAAAAAAA trigger
程式漏洞洞,僅能 overflow 16 bytes 恰只能剛好蓋到 return address rsp rbp
Stack pivoting ["/bin/sh"] system pop rdi low address high address
AAAAAAAA AAAAAAAA AAAAAAAA 找到他處可以⾜足夠放置 ROP payload 的空間 rsp rbp 0x601090 0xdeadbeef
Stack pivoting low address high address leave; ret 0x601098 -
8 AAAAAAAA rsp rbp ["/bin/sh"] system pop rdi 0x601090 0xdeadbeef
Stack pivoting low address high address leave; ret 0x601090 AAAAAAAA
rsp rbp ["/bin/sh"] system pop rdi 0x601090 0xdeadbeef
Stack pivoting low address high address AAAAAAAA rsp rbp leave
ret leave; ret 0x601090 ["/bin/sh"] system pop rdi 0x601090 0xdeadbeef
Stack pivoting low address high address AAAAAAAA rsp rbp leave
ret leave; ret 0x601090 ["/bin/sh"] system pop rdi 0x601090 0xdeadbeef mov rsp, rbp pop rbp
Stack pivoting low address high address AAAAAAAA rsp rbp leave
ret leave; ret 0x601090 ["/bin/sh"] system pop rdi 0x601090 0xdeadbeef mov rsp, rbp pop rbp
Stack pivoting low address high address AAAAAAAA leave; ret 0x601090
["/bin/sh"] system pop rdi 0x601090 0xdeadbeef leave ret mov rsp, rbp pop rbp rsp rbp
Stack pivoting low address high address AAAAAAAA rsp rbp leave
ret leave; ret 0x601090 ["/bin/sh"] system pop rdi 0x601090 0xdeadbeef
Stack pivoting low address high address AAAAAAAA rsp rbp leave
ret leave; ret 0x601090 ["/bin/sh"] system pop rdi 0x601090 0xdeadbeef
Stack pivoting low address high address AAAAAAAA rsp rbp leave
ret leave; ret 0x601090 ["/bin/sh"] system pop rdi 0x601090 0xdeadbeef
Stack pivoting low address high address AAAAAAAA rsp rbp leave
ret leave; ret 0x601090 ["/bin/sh"] system pop rdi 0x601090 0xdeadbeef
Stack pivoting low address high address AAAAAAAA rsp rbp leave;
ret 0x601090 ["/bin/sh"] system pop rdi 0x601090 0xdeadbeef leave ret mov rsp, rbp pop rbp
Stack pivoting low address high address AAAAAAAA rsp rbp leave;
ret 0x601090 ["/bin/sh"] system pop rdi 0x601090 0xdeadbeef leave ret mov rsp, rbp pop rbp
Stack pivoting low address high address AAAAAAAA rbp leave; ret
0x601090 ["/bin/sh"] system pop rdi 0x601090 0xdeadbeef leave ret mov rsp, rbp pop rbp rsp 0xdeadbeef
Stack pivoting low address high address AAAAAAAA rbp leave; ret
0x601090 ["/bin/sh"] system pop rdi 0x601090 0xdeadbeef rsp 0xdeadbeef leave ret
Stack pivoting low address high address AAAAAAAA rbp leave; ret
0x601090 ["/bin/sh"] system pop rdi 0x601090 0xdeadbeef rsp 0xdeadbeef ROP!!!!
Stack pivoting low address high address AAAAAAAA rbp leave; ret
0x601090 ["/bin/sh"] system pop rdi 0x601090 0xdeadbeef rsp 0xdeadbeef system( "/bin/sh" )
Stack pivoting low address high address AAAAAAAA rbp leave; ret
0x601090 ["/bin/sh"] system pop rdi 0x601090 0xdeadbeef rsp 0xdeadbeef Get shell!
Stack pivoting low address high address AAAAAAAA rbp leave; ret
0x601090 ["/bin/sh"] system pop rdi 0x601090 0xdeadbeef rsp 0xdeadbeef Get shell! PWNED ☠
Demo
ret2csu return to __libc_csu_init
ret2csu • 位於 __libc_csu_init 函式中,為 compiler 編進去的 function。 • 尾部有⼀一片段
code,很適合拿來來控制 register 放置參參數,以及 control flow。
ret2csu • __libc_csu_init 00000000004006d0 <__libc_csu_init>: 4006d0: 41 57 push r15
4006d2: 41 56 push r14 4006d4: 49 89 d7 mov r15,rdx 4006d7: 41 55 push r13 4006d9: 41 54 push r12 4006db: 4c 8d 25 2e 07 20 00 lea r12,[rip+0x20072e] 4006e2: 55 push rbp 4006e3: 48 8d 2d 2e 07 20 00 lea rbp,[rip+0x20072e] 4006ea: 53 push rbx 4006eb: 41 89 fd mov r13d,edi 4006ee: 49 89 f6 mov r14,rsi 4006f1: 4c 29 e5 sub rbp,r12 4006f4: 48 83 ec 08 sub rsp,0x8 4006f8: 48 c1 fd 03 sar rbp,0x3 4006fc: e8 f7 fd ff ff call 4004f8 <_init> 400701: 48 85 ed test rbp,rbp 400704: 74 20 je 400726 <__libc_csu_init+0x56> 400706: 31 db xor ebx,ebx 400708: 0f 1f 84 00 00 00 00 nop DWORD PTR [rax+rax*1+0x0] 40070f: 00 400710: 4c 89 fa mov rdx,r15 400713: 4c 89 f6 mov rsi,r14 400716: 44 89 ef mov edi,r13d 400719: 41 ff 14 dc call QWORD PTR [r12+rbx*8] 40071d: 48 83 c3 01 add rbx,0x1 400721: 48 39 dd cmp rbp,rbx 400724: 75 ea jne 400710 <__libc_csu_init+0x40> 400726: 48 83 c4 08 add rsp,0x8 40072a: 5b pop rbx 40072b: 5d pop rbp 40072c: 41 5c pop r12 40072e: 41 5d pop r13 400730: 41 5e pop r14 400732: 41 5f pop r15 400734: c3 ret
ret2csu • gadget 00000000004006d0 <__libc_csu_init>: 4006d0: 41 57 push r15
4006d2: 41 56 push r14 4006d4: 49 89 d7 mov r15,rdx 4006d7: 41 55 push r13 4006d9: 41 54 push r12 4006db: 4c 8d 25 2e 07 20 00 lea r12,[rip+0x20072e] 4006e2: 55 push rbp 4006e3: 48 8d 2d 2e 07 20 00 lea rbp,[rip+0x20072e] 4006ea: 53 push rbx 4006eb: 41 89 fd mov r13d,edi 4006ee: 49 89 f6 mov r14,rsi 4006f1: 4c 29 e5 sub rbp,r12 4006f4: 48 83 ec 08 sub rsp,0x8 4006f8: 48 c1 fd 03 sar rbp,0x3 4006fc: e8 f7 fd ff ff call 4004f8 <_init> 400701: 48 85 ed test rbp,rbp 400704: 74 20 je 400726 <__libc_csu_init+0x56> 400706: 31 db xor ebx,ebx 400708: 0f 1f 84 00 00 00 00 nop DWORD PTR [rax+rax*1+0x0] 40070f: 00 400710: 4c 89 fa mov rdx,r15 400713: 4c 89 f6 mov rsi,r14 400716: 44 89 ef mov edi,r13d 400719: 41 ff 14 dc call QWORD PTR [r12+rbx*8] 40071d: 48 83 c3 01 add rbx,0x1 400721: 48 39 dd cmp rbp,rbx 400724: 75 ea jne 400710 <__libc_csu_init+0x40> 400726: 48 83 c4 08 add rsp,0x8 40072a: 5b pop rbx 40072b: 5d pop rbp 40072c: 41 5c pop r12 40072e: 41 5d pop r13 400730: 41 5e pop r14 400732: 41 5f pop r15 400734: c3 ret
ret2csu 400710: 4c 89 fa mov rdx,r15 400713: 4c 89
f6 mov rsi,r14 400716: 44 89 ef mov edi,r13d 400719: 41 ff 14 dc call QWORD PTR [r12+rbx*8] 40071d: 48 83 c3 01 add rbx,0x1 400721: 48 39 dd cmp rbp,rbx 400724: 75 ea jne 400710 <__libc_csu_init+0x40> 400726: 48 83 c4 08 add rsp,0x8 40072a: 5b pop rbx 40072b: 5d pop rbp 40072c: 41 5c pop r12 40072e: 41 5d pop r13 400730: 41 5e pop r14 400732: 41 5f pop r15 400734: c3 ret
ret2csu • 透過控制 rbp rbx r12 r13 r14 r15 registers
的值,跳⾄至 gadget 開頭,r13 r14 r15,分 別放置前三個參參數 rdi rsi rdx,此部分解決了了很少找到 pop rdx gadget,ROP 很難 控制第三個參參數的問題。 • 控制 r12 rbx 來來指定任意記憶體位置 call [r12+rbx*8]。 • 將 rbx 設為 0,將 rbp 設為 1,在 call 完後使 rbx == rbp == 1,jne 不會 take,⽽而繼 續執⾏行行後⾯面的連續 pop register,如此可重複使⽤用,達到任意 ROP。
ret2csu 400710: 4c 89 fa mov rdx,r15 400713: 4c 89
f6 mov rsi,r14 400716: 44 89 ef mov edi,r13d 400719: 41 ff 14 dc call QWORD PTR [r12+rbx*8] 40071d: 48 83 c3 01 add rbx,0x1 400721: 48 39 dd cmp rbp,rbx 400724: 75 ea jne 400710 <__libc_csu_init+0x40> 400726: 48 83 c4 08 add rsp,0x8 40072a: 5b pop rbx 40072b: 5d pop rbp 40072c: 41 5c pop r12 40072e: 41 5d pop r13 400730: 41 5e pop r14 400732: 41 5f pop r15 400734: c3 ret
Casino++ HW
HW - Casino++ • Same source code. • NX enabled
• Just pwn it again!
Thanks! yuawn _yuawn