SlideShare una empresa de Scribd logo

Linux Binary Exploitation - Return-oritend Programing

•
•
A
Angel Boy

Linux Binary Exploitation - Return-oritend Programing

Tecnología
1 de 91
Descargar para leer sin conexión
Linux Binary Exploitation Return-oriented Programing angelboy@chroot.org
Outline • ROP • Using ROP bypass ASLR • Stack migration
Outline • ROP • Using ROP bypass ASLR • Stack migration
ROP • 透過 ret 去執⾏行行其他包含 ret 的程式碼片段 • 這些片段⼜又稱為 gadget
ROP • Why do we need ROP ? • Bypass DEP • Static linking can do more thing
ROP • ROP chain • 在夠長的 buffer overflow 後 stack 內容幾乎都由我們控制，我們可以藉由 ret = pop rip 指令，持續的控制 rip gadget2 1 gadget1 high low rsp retoverflow pop rax ret syscall gadget1 gadget2
ROP • ROP chain • 在夠長的 buffer overflow 後 stack 內容幾乎都由我們控制，我們可以藉由 ret = pop rip 指令，持續的控制 rip gadget2 1 gadget1 high low rsp retoverflow pop rax ret syscall gadget1 gadget2
ROP • ROP chain • 在夠長的 buffer overflow 後 stack 內容幾乎都由我們控制，我們可以藉由 ret = pop rip 指令，持續的控制 rip gadget2 1 gadget1 high low rsp retoverflow pop rax ret syscall gadget1 gadget2
ROP • ROP chain • 在夠長的 buffer overflow 後 stack 內容幾乎都由我們控制，我們可以藉由 ret = pop rip 指令，持續的控制 rip gadget2 1 gadget1 high low rsp retoverflow pop rax ret syscall gadget1 gadget2
ROP • ROP chain • 在夠長的 buffer overflow 後 stack 內容幾乎都由我們控制，我們可以藉由 ret = pop rip 指令，持續的控制 rip gadget2 1 gadget1 high low rsp retoverflow pop rax ret syscall gadget1 gadget2 exit
ROP • ROP chain • 由眾多的 ROP gadget 組成 • 藉由不同的 register 及記憶體操作，呼叫 system call 達成任意代碼執⾏行行 • 基本上就是利利⽤用 ROP gadget 來來串串出我們之前寫的 shellcode 的效果
ROP • Gadget • read/write register/memory • pop rax;pop rcx ; ret • mov [rax],rcx ; ret • system call • syscall • change rsp • pop rsp ; ret • leave ; ret
ROP • Write to Register • pop reg ; ret • mov reg, reg ; ret • …
ROP • Write to Register • let rax = 0xdead rbx = 0xbeef 0x401041 0xdead 0x4010fb high low rsp pop rax ret 0x401041 0xbeef pop rbx ret 0x4010fb 0 0 retoverflow rax rbx
ROP • Write to Register • let rax = 0xdead rbx = 0xbeef 0x401041 0xdead 0x4010fb high low rsp pop rax ret 0x401041 0xbeef pop rbx ret 0x4010fb 0 0 retoverflow rax rbx
ROP • Write to Register • let rax = 0xdead rbx = 0xbeef 0x401041 0xdead 0x4010fb high low rsppop rax ret 0x401041 0xbeef pop rbx ret 0x4010fb 0xdead 0 retoverflow rax rbx
ROP • Write to Register • let rax = 0xdead rbx = 0xbeef 0x401041 0xdead 0x4010fb high low rsp pop rax ret 0x401041 0xbeef pop rbx ret 0x4010fb 0xdead 0 retoverflow rax rbx
ROP • Write to Register • let rax = 0xdead rbx = 0xbeef 0x401041 0xdead 0x4010fb high low rsp pop rax ret 0x401041 0xbeef pop rbx ret 0x4010fb 0xdead 0xbeef retoverflow rax rbx
ROP • Write to Memory • mov [reg],reg • mov [reg+xx], reg • …
ROP • Write to Memory • let *0x602080 = 0xdeadbeef 0x40108a 0xdeadbeef 0x4010d1 high low rsp pop rax pop rbx ret 0x40108a 0xbeef mov [rax],rbx ret 0x4010d1 0 0 rax rbx 0x602080 0 0x602080 retoverflow
ROP • Write to Memory • let *0x602080 = 0xdeadbeef 0x40108a 0xdeadbeef 0x4010d1 high low rsp pop rax pop rbx ret 0x40108a 0xbeef mov [rax],rbx ret 0x4010d1 0 0 rax rbx 0x602080 0 0x602080 retoverflow
ROP • Write to Memory • let *0x602080 = 0xdeadbeef 0x40108a 0xdeadbeef 0x4010d1 high low rsp pop rax pop rbx ret 0x40108a 0xbeef mov [rax],rbx ret 0x4010d1 0x602080 0 rax rbx 0x602080 0 0x602080 retoverflow
ROP • Write to Memory • let *0x602080 = 0xdeadbeef 0x40108a 0xdeadbeef 0x4010d1 high low rsp pop rax pop rbx ret 0x40108a 0xbeef mov [rax],rbx ret 0x4010d1 0x602080 0xdeadbeef rax rbx 0x602080 0 0x602080 retoverflow
ROP • Write to Memory • let *0x602080 = 0xdeadbeef 0x40108a 0xdeadbeef 0x4010d1 high low rsp pop rax pop rbx ret 0x40108a 0xbeef mov [rax],rbx ret 0x4010d1 0x602080 0xdeadbeef rax rbx 0x602080 0 0x602080 retoverflow
ROP • Write to Memory • let *0x602080 = 0xdeadbeef 0x40108a 0xdeadbeef 0x4010d1 high low rsp pop rax pop rbx ret 0x40108a 0xbeef mov [rax],rbx ret 0x4010d1 0x602080 0xdeadbeef rax rbx 0x602080 0xdeadbeef 0x602080 retoverflow
ROP • execve(“/bin/sh”,NULL,NULL) • write to memory • 將 “/bin/sh” 寫入已知位置記憶體中 • 可分多次將所需字串串寫入記憶體中 /bin/das 0x602080 0x602088 hx00x00x00…
ROP • execve(“/bin/sh”,NULL,NULL) • write to register • rax = 0x3b , rdi = address of “/bin/sh” • rsi = 0 , rdx = 0 • syscall
ROP • find gadget • https://github.com/JonathanSalwan/ROPgadget
ROP • find gadget • ROPgadget - - binary binary • ROPgadget - - ropchain - - binary binary • 在 Static linking 通常可以組成功 execve 的 rop chain 但通常都很長， 需要⾃自⼰己找更更短的 gadget 來來改短⼀一點
Outline • ROP • Using ROP bypass ASLR • Stack migration
Using ROP bypass ASLR • 假設 dynamic 編譯的程式中有 Buffer Overflow 的漏洞洞且在沒 PIE 情況下 ( 先不考慮 StackGuard 的情況） • How to bypass ASLR and DEP ? • Use .plt section to leak some information • ret2plt • 通常⼀一般的程式中都會有 put 、 send 、write 等 output function !31
Using ROP bypass ASLR ret code stack high low rsp !32 put@plt pop rdi put@GOT pop rdi 0 pop rsi puts@GOT …… 0 rdi 0 rsi 0 rdx
Using ROP bypass ASLR ret pop rdi
 ret code stack high low rsp !33 put@plt pop rdi put@GOT pop rdi 0 pop rsi puts@GOT …… 0 rdi 0 rsi 0 rdx
Using ROP bypass ASLR ret pop rdi
 ret code stack high low rsp !34 put@plt pop rdi put@GOT pop rdi 0 pop rsi puts@GOT …… put@GOT rdi 0 rsi 0 rdx
Using ROP bypass ASLR ret pop rdi
 ret put@plt code stack high low rsp !35 put@plt pop rdi put@GOT pop rdi 0 pop rsi puts@GOT …… put@GOT rdi 0 rsi 0 rdx
Using ROP bypass ASLR ret pop rdi
 ret jmp *(put@GOT) code stack high low rsp !36 put@plt pop rdi put@GOT pop rdi 0 pop rsi puts@GOT …… put@GOT rdi 0 rsi 0 rdx
Using ROP bypass ASLR ret pop rdi
 ret jmp put(put@GOT) code stack high low rsp !37 put@plt pop rdi put@GOT pop rdi 0 pop rsi puts@GOT …… put@GOT rdi 0 rsi 0 rdx
Using ROP bypass ASLR ret pop rdi
 ret jmp put(put@GOT) code stack high low rsp !38 put@plt pop rdi put@GOT pop rdi 0 pop rsi puts@GOT …… put@GOT rdi 0 rsi 0 rdx Information leak
Using ROP bypass ASLR ret pop rdi
 ret jmp put(put@GOT) ret code stack high low rsp !39 put@plt pop rdi put@GOT pop rdi 0 pop rsi puts@GOT …… put@GOT rdi 0 rsi 0 rdx
Using ROP bypass ASLR ret pop rdi
 ret jmp put(put@GOT) ret pop rdi ret code stack high low rsp !40 put@plt pop rdi put@GOT pop rdi 0 pop rsi puts@GOT …… put@GOT rdi 0 rsi 0 rdx
Using ROP bypass ASLR ret pop rdi
 ret jmp put(put@GOT) ret pop rdi ret code stack high low rsp !41 put@plt pop rdi put@GOT pop rdi 0 pop rsi puts@GOT …… 0 rdi 0 rsi 0 rdx
Using ROP bypass ASLR ret pop rdi
 ret jmp put(put@GOT) ret pop rdi ret pop rsi ret code stack high low rsp !42 put@plt pop rdi put@GOT pop rdi 0 pop rsi puts@GOT …… 0 rdi 0 rsi 0 rdx
Using ROP bypass ASLR ret pop rdi
 ret jmp put(put@GOT) ret pop rdi ret pop rsi ret code stack high low rsp !43 puts@GOT 0 rdi puts@GOT rsi 0 rdx pop rdx read@plt pop rdi Address of /bin/sh puts@plt 0x8
Using ROP bypass ASLR ret pop rdx ret code stack high low rsp !44 puts@GOT 0 rdi puts@GOT rsi 0 rdx pop rdx read@plt pop rdi Address of /bin/sh puts@plt 0x8
Using ROP bypass ASLR ret pop rdx ret code stack high low rsp !45 puts@GOT 0 rdi puts@GOT rsi 8 rdx pop rdx read@plt pop rdi Address of /bin/sh puts@plt 0x8
Using ROP bypass ASLR ret pop rdx ret jmp read@plt code stack high low rsp !46 puts@GOT 0 rdi puts@GOT rsi 8 rdx pop rdx read@plt pop rdi Address of /bin/sh puts@plt 0x8
Using ROP bypass ASLR ret pop rdx ret jmp read(0,put@GOT,8) code stack high low !47 puts@GOT 0 rdi puts@GOT rsi 8 rdx pop rdx read@plt pop rdi Address of /bin/sh puts@plt 0x8 rsp
rsp Using ROP bypass ASLR ret pop rdx ret jmp read(0,put@GOT,8) code stack high low rsp !48 puts@GOT 0 rdi puts@GOT rsi 8 rdx pop rdx read@plt pop rdi Address of /bin/sh puts@plt 0x8 GOT Hijacking puts -> system
Using ROP bypass ASLR ret pop rdx ret jmp read(0,put@GOT,8) ret code stack high low !49 puts@GOT 0 rdi puts@GOT rsi 8 rdx pop rdx read@plt pop rdi Address of /bin/sh puts@plt 0x8 rsp
Using ROP bypass ASLR ret pop rdx ret jmp read(0,put@GOT,8) ret pop rdi ret code stack high low !50 puts@GOT 0 rdi puts@GOT rsi 8 rdx pop rdx read@plt pop rdi Address of /bin/sh puts@plt 0x8 rsp
Using ROP bypass ASLR ret pop rdx ret jmp read(0,put@GOT,8) ret pop rdi ret code stack high low !51 puts@GOT &/bin/sh rdi puts@GOT rsi 8 rdx pop rdx read@plt pop rdi Address of /bin/sh puts@plt 0x8 rsp
Using ROP bypass ASLR ret pop rdx ret jmp read(0,put@GOT,8) ret pop rdi ret jmp puts@plt code stack high low !52 puts@GOT &/bin/sh rdi puts@GOT rsi 8 rdx pop rdx read@plt pop rdi Address of /bin/sh puts@plt 0x8 rsp
Using ROP bypass ASLR ret pop rdx ret jmp read(0,put@GOT,8) ret pop rdi ret jmp *(puts@GOT) code stack high low !53 puts@GOT &/bin/sh rdi puts@GOT rsi 8 rdx pop rdx read@plt pop rdi Address of /bin/sh puts@plt 0x8 rsp
Using ROP bypass ASLR ret pop rdx ret jmp read(0,put@GOT,8) ret pop rdi ret jmp system(“/bin/sh”) code stack high low !54 puts@GOT &/bin/sh rdi puts@GOT rsi 8 rdx pop rdx read@plt pop rdi Address of /bin/sh puts@plt 0x8 rsp
Using ROP bypass ASLR ret pop rdx ret jmp read(0,put@GOT,8) ret pop rdi ret jmp system(“/bin/sh”) code stack high low !55 puts@GOT &/bin/sh rdi puts@GOT rsi 8 rdx pop rdx read@plt pop rdi Address of /bin/sh puts@plt 0x8 rsp GET SHELL
Using ROP bypass ASLR !56 • Bypass PIE • 必須比平常多 leak ⼀一個 code 段的位置，藉由這個值算出 code base 進 ⽽而推出所有 GOT 等資訊 • 有了了 code base 之後其他就跟沒有 PIE 的情況下⼀一樣
Using ROP bypass ASLR !57 • Bypass StackGuard • canary 只有在 function return 時做檢查 • 只檢查 canary 值時否⼀一樣 • 所以可以先想辦法 leak 出 canary 的值，塞⼀一模⼀一樣的內容就可 bypass，或是想辦法不要改到 canary 也可以
Using ROP bypass ASLR !58 • Weakness in fork • canary and memory mappings are same as parent.
Outline • ROP • Using ROP bypass ASLR • Stack migration
Stack Migration • 將 ROP Chain 寫在已知固定位置上 • 再利利⽤用 leave 搬移 Stack 位置到已知位置 • 可無限接 ROP Chain • 必須注意到 Migration 之後 stack 要留留⼤大⼀一點，有些 function 可能會需要很 ⼤大的 stack frame ，太⼩小可能會存取到唯獨區域，導致 Segmentation Fault !60
Stack Migration !61 return address rbp rbp/rsp push rbp mov rbp,rsp … leave ret high low
Stack Migration !62 buf1 rbp push rbp mov rbp,rsp … leave ret aaaa aaaa rsp gets() buf1 high low buf1 leave_ret pop rdi
Stack Migration !63 buf1 push rbp mov rbp,rsp … leave ret aaaa aaaa rsp gets() buf1 buf1 leave_ret leave = mov rsp,rbp ; pop rbp rbp pop rdi high low
Stack Migration !64 buf1 rbp/rsp push rbp mov rbp,rsp … leave ret aaaa aaaa gets() buf1 buf1 leave_ret leave = mov rsp,rbp ; pop rbp pop rdi high low
Stack Migration !65 buf1 rsp push rbp mov rbp,rsp … leave ret aaaa aaaa gets() buf1 buf1 leave_ret rbp pop rdi high low
Stack Migration !66 buf1 rsp push rbp mov rbp,rsp … leave ret pop rdi
 ret aaaa aaaa gets() buf1 buf1 leave_ret pop rdi rdi 0 high low rbp
Stack Migration !67 buf1 rsppush rbp mov rbp,rsp … leave ret pop rdi
 ret aaaa aaaa gets() buf1 buf1 leave_ret pop rdi rdi buf1 high low rbp
Stack Migration !68 buf1 rsp push rbp mov rbp,rsp … leave ret pop rdi
 ret gets(buf1) aaaa aaaa gets() buf1 buf1 leave_ret pop rdi rdi buf1 high low rbp
Stack Migration !69 buf1 rsp push rbp mov rbp,rsp … leave ret pop rdi
 ret gets(buf1) ret aaaa aaaa gets() buf1 buf1 leave_ret rbp pop rdi rdi buf1 buf2 pop rdi puts@GOT puts() pop rdi buf2 gets() high low leave_ret
Stack Migration !70 buf1 rsp leave
 ret aaaa aaaa gets() buf1 buf1 leave_ret pop rdi rdi buf1 buf2 pop rdi puts@GOT puts() pop rdi buf2 gets() high low leave_ret leave = mov rsp,rbp ; pop rbp rbp
Stack Migration !71 leave
 ret buf1 rdi buf1 buf2 pop rdi puts@GOT puts() pop rdi buf2 gets() high low leave_ret rsp rbp buf2
Stack Migration !72 pop rdi
 ret buf1 rdi buf1 buf2 pop rdi puts@GOT puts() pop rdi buf2 gets() high low leave_ret rsp rbp buf2
Stack Migration !73 pop rdi
 ret buf1 rdi puts@GOT buf2 pop rdi puts@GOT puts() pop rdi buf2 gets() high low leave_ret rbp buf2 rsp
Stack Migration !74 pop rdi
 ret puts(puts@GOT) ret buf1 rdi puts@GOT buf2 pop rdi puts@GOT puts() pop rdi buf2 gets() high low leave_ret rsp rbp buf2 Information leakage
Stack Migration !75 pop rdi
 ret puts(puts@GOT) ret buf1 rdi puts@GOT buf2 pop rdi puts@GOT puts() pop rdi buf2 gets() high low leave_ret rsp rbp buf2
Stack Migration !76 pop rdi
 ret buf1 rdi puts@GOT buf2 pop rdi puts@GOT puts() pop rdi buf2 gets() high low leave_ret rsp rbp buf2
Stack Migration !77 pop rdi
 ret buf1 rdi buf2 buf2 pop rdi puts@GOT puts() pop rdi buf2 gets() high low leave_ret rsp rbp buf2
Stack Migration !78 pop rdi
 ret gets(buf2) ret buf1 rdi buf2 buf2 pop rdi puts@GOT puts() pop rdi buf2 gets() high low leave_retrsp rbp buf2
Stack Migration !79 pop rdi
 ret gets(buf2) ret buf1 rdi buf2 buf2 pop rdi puts@GOT puts() pop rdi buf2 gets() high low leave_retrsp rbp buf2 buf1 pop rdi &/bin/sh /bin/sh system
Stack Migration !80 pop rdi
 ret gets(buf2) ret leave ret buf1 rdi buf2 buf2 pop rdi puts@GOT puts() pop rdi buf2 gets() high low leave_retrsp rbp buf2 buf1 pop rdi &/bin/sh /bin/sh system leave = mov rsp,rbp ; pop rbp
Stack Migration !81 pop rdi
 ret gets(buf2) ret leave ret buf1 rdi buf2 buf2 pop rdi puts@GOT puts() pop rdi buf2 gets() high low leave_ret rbp rsp buf2 buf1 pop rdi &/bin/sh /bin/sh system
Stack Migration !82 pop rdi
 ret buf1 rdi buf2 buf2 pop rdi puts@GOT puts() pop rdi buf2 gets() high low leave_ret rbp rsp buf2 buf1 pop rdi &/bin/sh /bin/sh system
Stack Migration !83 pop rdi
 ret buf1 rdi &/bin/sh buf2 pop rdi puts@GOT puts() pop rdi buf2 gets() high low leave_ret rbp rsp buf2 buf1 pop rdi &/bin/sh /bin/sh system
Stack Migration !84 pop rdi ret system(“/bin/sh”) buf1 rdi &/bin/sh buf2 pop rdi puts@GOT puts() pop rdi buf2 gets() high low leave_ret rbp rsp buf2 buf1 pop rdi &/bin/sh /bin/sh system GET SHELL
Stack Migration • 若若能妥善利利⽤用，在沒有 libc 的情況下，有機會將整個 libc 給 dump 出來來， 更更有機會直接找出 system 的位置 • 無限 ROP ，幾乎可以做出所有事情，但唯⼀一要注意的是 buf ⼤大⼩小要控制 好，盡量量選 bss 後半段位置，否則可能因為 stack 不夠⼤大⽽而 segfault !85
Stack Migration • Other migration gadget • add rsp,0xNN ; ret • sub rsp,0xNN ; ret • ret 0xNN • xchg rsp,exx ; ret • partial overwrite rbp !86
Stack Migration !87 ret add rsp,0x30 ret you can’t control gadget rsp rop chain high low
Stack Migration !88 ret add rsp,0x30 ret you can’t control gadget rop chain high low rsp
Stack Migration !89 ret add rsp,0x30 ret you can’t control gadget rop chain high low rsp
Reference • http://www.slideshare.net/hackstuff/rop-40525248 !90
Q & A

Recomendados

Linux Binary Exploitation - Stack buffer overflow
Linux Binary Exploitation - Stack buffer overflowLinux Binary Exploitation - Stack buffer overflow
Linux Binary Exploitation - Stack buffer overflow
Angel Boy
 
Sigreturn Oriented Programming
Sigreturn Oriented ProgrammingSigreturn Oriented Programming
Sigreturn Oriented Programming
Angel Boy
 
Linux binary Exploitation - Basic knowledge
Linux binary Exploitation - Basic knowledgeLinux binary Exploitation - Basic knowledge
Linux binary Exploitation - Basic knowledge
Angel Boy
 
Binary exploitation - AIS3
Binary exploitation - AIS3Binary exploitation - AIS3
Binary exploitation - AIS3
Angel Boy
 
Linux Binary Exploitation - Heap Exploitation
Linux Binary Exploitation - Heap Exploitation Linux Binary Exploitation - Heap Exploitation
Linux Binary Exploitation - Heap Exploitation
Angel Boy
 
Heap exploitation
Heap exploitationHeap exploitation
Heap exploitation
Angel Boy
 
MacOS memory allocator (libmalloc) Exploitation
MacOS memory allocator (libmalloc) ExploitationMacOS memory allocator (libmalloc) Exploitation
MacOS memory allocator (libmalloc) Exploitation
Angel Boy
 
Tcache Exploitation
Tcache ExploitationTcache Exploitation
Tcache Exploitation
Angel Boy
 

Recomendados

Linux Binary Exploitation - Stack buffer overflow
Linux Binary Exploitation - Stack buffer overflowLinux Binary Exploitation - Stack buffer overflow
Linux Binary Exploitation - Stack buffer overflow
Angel Boy
 
Sigreturn Oriented Programming
Sigreturn Oriented ProgrammingSigreturn Oriented Programming
Sigreturn Oriented Programming
Angel Boy
 
Linux binary Exploitation - Basic knowledge
Linux binary Exploitation - Basic knowledgeLinux binary Exploitation - Basic knowledge
Linux binary Exploitation - Basic knowledge
Angel Boy
 
Binary exploitation - AIS3
Binary exploitation - AIS3Binary exploitation - AIS3
Binary exploitation - AIS3
Angel Boy
 
Linux Binary Exploitation - Heap Exploitation
Linux Binary Exploitation - Heap Exploitation Linux Binary Exploitation - Heap Exploitation
Linux Binary Exploitation - Heap Exploitation
Angel Boy
 
Heap exploitation
Heap exploitationHeap exploitation
Heap exploitation
Angel Boy
 
MacOS memory allocator (libmalloc) Exploitation
MacOS memory allocator (libmalloc) ExploitationMacOS memory allocator (libmalloc) Exploitation
MacOS memory allocator (libmalloc) Exploitation
Angel Boy
 
Tcache Exploitation
Tcache ExploitationTcache Exploitation
Tcache Exploitation
Angel Boy
 
Windows 10 Nt Heap Exploitation (English version)
Windows 10 Nt Heap Exploitation (English version)Windows 10 Nt Heap Exploitation (English version)
Windows 10 Nt Heap Exploitation (English version)
Angel Boy
 
Pwning in c++ (basic)
Pwning in c++ (basic)Pwning in c++ (basic)
Pwning in c++ (basic)
Angel Boy
 
Execution
ExecutionExecution
Execution
Angel Boy
 
Advanced heap exploitaion
Advanced heap exploitaionAdvanced heap exploitaion
Advanced heap exploitaion
Angel Boy
 
TDOH x 台科 pwn課程
TDOH x 台科 pwn課程TDOH x 台科 pwn課程
TDOH x 台科 pwn課程
Weber Tsai
 
台科逆向簡報
台科逆向簡報台科逆向簡報
台科逆向簡報
耀德 蔡
 
ROP 輕鬆談
ROP 輕鬆談ROP 輕鬆談
ROP 輕鬆談
hackstuff
 
Play with FILE Structure - Yet Another Binary Exploit Technique
Play with FILE Structure - Yet Another Binary Exploit TechniquePlay with FILE Structure - Yet Another Binary Exploit Technique
Play with FILE Structure - Yet Another Binary Exploit Technique
Angel Boy
 
Windows 10 Nt Heap Exploitation (Chinese version)
Windows 10 Nt Heap Exploitation (Chinese version)Windows 10 Nt Heap Exploitation (Chinese version)
Windows 10 Nt Heap Exploitation (Chinese version)
Angel Boy
 
Return to dlresolve
Return to dlresolveReturn to dlresolve
Return to dlresolve
Angel Boy
 
You didnt see it’s coming? "Dawn of hardened Windows Kernel"
You didnt see it’s coming? "Dawn of hardened Windows Kernel" You didnt see it’s coming? "Dawn of hardened Windows Kernel"
You didnt see it’s coming? "Dawn of hardened Windows Kernel"
Peter Hlavaty
 
Building Network Functions with eBPF & BCC
Building Network Functions with eBPF & BCCBuilding Network Functions with eBPF & BCC
Building Network Functions with eBPF & BCC
Kernel TLV
 
BPF Internals (eBPF)
BPF Internals (eBPF)BPF Internals (eBPF)
BPF Internals (eBPF)
Brendan Gregg
 
x86
x86x86
x86
Wei-Bo Chen
 
DeathNote of Microsoft Windows Kernel
DeathNote of Microsoft Windows KernelDeathNote of Microsoft Windows Kernel
DeathNote of Microsoft Windows Kernel
Peter Hlavaty
 
Receive side scaling (RSS) with eBPF in QEMU and virtio-net
Receive side scaling (RSS) with eBPF in QEMU and virtio-netReceive side scaling (RSS) with eBPF in QEMU and virtio-net
Receive side scaling (RSS) with eBPF in QEMU and virtio-net
Yan Vugenfirer
 
Windows Kernel Exploitation : This Time Font hunt you down in 4 bytes
Windows Kernel Exploitation : This Time Font hunt you down in 4 bytesWindows Kernel Exploitation : This Time Font hunt you down in 4 bytes
Windows Kernel Exploitation : This Time Font hunt you down in 4 bytes
Peter Hlavaty
 
NTUSTxTDOH - Pwn基礎 2015/12/27
NTUSTxTDOH - Pwn基礎 2015/12/27NTUSTxTDOH - Pwn基礎 2015/12/27
NTUSTxTDOH - Pwn基礎 2015/12/27
Sheng-Hao Ma
 
How Functions Work
How Functions WorkHow Functions Work
How Functions Work
Saumil Shah
 
Windows kernel basic exploit
Windows kernel basic exploitWindows kernel basic exploit
Windows kernel basic exploit
Kyoungseok Yang
 
Buffer overflow
Buffer overflowBuffer overflow
Buffer overflow
Jacob Pimental
 
week5_giveup_pwn.pdf
week5_giveup_pwn.pdfweek5_giveup_pwn.pdf
week5_giveup_pwn.pdf
ssuser83af16
 

Más contenido relacionado

La actualidad más candente

You didnt see it’s coming? "Dawn of hardened Windows Kernel"
You didnt see it’s coming? "Dawn of hardened Windows Kernel" You didnt see it’s coming? "Dawn of hardened Windows Kernel"
You didnt see it’s coming? "Dawn of hardened Windows Kernel"
Peter Hlavaty
 
Building Network Functions with eBPF & BCC
Building Network Functions with eBPF & BCCBuilding Network Functions with eBPF & BCC
Building Network Functions with eBPF & BCC
Kernel TLV
 
DeathNote of Microsoft Windows Kernel
DeathNote of Microsoft Windows KernelDeathNote of Microsoft Windows Kernel
DeathNote of Microsoft Windows Kernel
Peter Hlavaty
 
Windows Kernel Exploitation : This Time Font hunt you down in 4 bytes
Windows Kernel Exploitation : This Time Font hunt you down in 4 bytesWindows Kernel Exploitation : This Time Font hunt you down in 4 bytes
Windows Kernel Exploitation : This Time Font hunt you down in 4 bytes
Peter Hlavaty
 

La actualidad más candente (20)

Windows 10 Nt Heap Exploitation (English version)
Windows 10 Nt Heap Exploitation (English version)Windows 10 Nt Heap Exploitation (English version)
Windows 10 Nt Heap Exploitation (English version)
 
Pwning in c++ (basic)
Pwning in c++ (basic)Pwning in c++ (basic)
Pwning in c++ (basic)
 
Execution
ExecutionExecution
Execution
 
Advanced heap exploitaion
Advanced heap exploitaionAdvanced heap exploitaion
Advanced heap exploitaion
 
TDOH x 台科 pwn課程
TDOH x 台科 pwn課程TDOH x 台科 pwn課程
TDOH x 台科 pwn課程
 
台科逆向簡報
台科逆向簡報台科逆向簡報
台科逆向簡報
 
ROP 輕鬆談
ROP 輕鬆談ROP 輕鬆談
ROP 輕鬆談
 
Play with FILE Structure - Yet Another Binary Exploit Technique
Play with FILE Structure - Yet Another Binary Exploit TechniquePlay with FILE Structure - Yet Another Binary Exploit Technique
Play with FILE Structure - Yet Another Binary Exploit Technique
 
Windows 10 Nt Heap Exploitation (Chinese version)
Windows 10 Nt Heap Exploitation (Chinese version)Windows 10 Nt Heap Exploitation (Chinese version)
Windows 10 Nt Heap Exploitation (Chinese version)
 
Return to dlresolve
Return to dlresolveReturn to dlresolve
Return to dlresolve
 
You didnt see it’s coming? "Dawn of hardened Windows Kernel"
You didnt see it’s coming? "Dawn of hardened Windows Kernel" You didnt see it’s coming? "Dawn of hardened Windows Kernel"
You didnt see it’s coming? "Dawn of hardened Windows Kernel"
 
Building Network Functions with eBPF & BCC
Building Network Functions with eBPF & BCCBuilding Network Functions with eBPF & BCC
Building Network Functions with eBPF & BCC
 
BPF Internals (eBPF)
BPF Internals (eBPF)BPF Internals (eBPF)
BPF Internals (eBPF)
 
x86
x86x86
x86
 
DeathNote of Microsoft Windows Kernel
DeathNote of Microsoft Windows KernelDeathNote of Microsoft Windows Kernel
DeathNote of Microsoft Windows Kernel
 
Receive side scaling (RSS) with eBPF in QEMU and virtio-net
Receive side scaling (RSS) with eBPF in QEMU and virtio-netReceive side scaling (RSS) with eBPF in QEMU and virtio-net
Receive side scaling (RSS) with eBPF in QEMU and virtio-net
 
Windows Kernel Exploitation : This Time Font hunt you down in 4 bytes
Windows Kernel Exploitation : This Time Font hunt you down in 4 bytesWindows Kernel Exploitation : This Time Font hunt you down in 4 bytes
Windows Kernel Exploitation : This Time Font hunt you down in 4 bytes
 
NTUSTxTDOH - Pwn基礎 2015/12/27
NTUSTxTDOH - Pwn基礎 2015/12/27NTUSTxTDOH - Pwn基礎 2015/12/27
NTUSTxTDOH - Pwn基礎 2015/12/27
 
How Functions Work
How Functions WorkHow Functions Work
How Functions Work
 
Windows kernel basic exploit
Windows kernel basic exploitWindows kernel basic exploit
Windows kernel basic exploit
 

Similar a Linux Binary Exploitation - Return-oritend Programing

Exploring the x64
Exploring the x64Exploring the x64
Exploring the x64
FFRI, Inc.
 
20190521 pwn 101_by_roy
20190521 pwn 101_by_roy20190521 pwn 101_by_roy
20190521 pwn 101_by_roy
Roy
 
Redis深入浅出
Redis深入浅出Redis深入浅出
Redis深入浅出
ruoyi ruan
 

Similar a Linux Binary Exploitation - Return-oritend Programing (20)

Buffer overflow
Buffer overflowBuffer overflow
Buffer overflow
 
week5_giveup_pwn.pdf
week5_giveup_pwn.pdfweek5_giveup_pwn.pdf
week5_giveup_pwn.pdf
 
Go Go Gadget! - An Intro to Return Oriented Programming (ROP)
Go Go Gadget! - An Intro to Return Oriented Programming (ROP)Go Go Gadget! - An Intro to Return Oriented Programming (ROP)
Go Go Gadget! - An Intro to Return Oriented Programming (ROP)
 
Exploring the x64
Exploring the x64Exploring the x64
Exploring the x64
 
20190521 pwn 101_by_roy
20190521 pwn 101_by_roy20190521 pwn 101_by_roy
20190521 pwn 101_by_roy
 
lec15_x86procedure_4up.pdf
lec15_x86procedure_4up.pdflec15_x86procedure_4up.pdf
lec15_x86procedure_4up.pdf
 
[cb22] Are Embedded Devices Ready for ROP Attacks? -ROP verification for low-...
[cb22] Are Embedded Devices Ready for ROP Attacks? -ROP verification for low-...[cb22] Are Embedded Devices Ready for ROP Attacks? -ROP verification for low-...
[cb22] Are Embedded Devices Ready for ROP Attacks? -ROP verification for low-...
 
Php extensions
Php extensionsPhp extensions
Php extensions
 
Keynote: O PHP, Where Art Thou?
Keynote: O PHP, Where Art Thou?Keynote: O PHP, Where Art Thou?
Keynote: O PHP, Where Art Thou?
 
Os Treat
Os TreatOs Treat
Os Treat
 
Raspberry Pi + ROS
Raspberry Pi + ROSRaspberry Pi + ROS
Raspberry Pi + ROS
 
Shellcodes for ARM: Your Pills Don't Work on Me, x86
Shellcodes for ARM: Your Pills Don't Work on Me, x86Shellcodes for ARM: Your Pills Don't Work on Me, x86
Shellcodes for ARM: Your Pills Don't Work on Me, x86
 
Intro to pl/PHP Oscon2007
Intro to pl/PHP Oscon2007Intro to pl/PHP Oscon2007
Intro to pl/PHP Oscon2007
 
ROP
ROPROP
ROP
 
Make ARM Shellcode Great Again - HITB2018PEK
Make ARM Shellcode Great Again - HITB2018PEKMake ARM Shellcode Great Again - HITB2018PEK
Make ARM Shellcode Great Again - HITB2018PEK
 
Redis深入浅出
Redis深入浅出Redis深入浅出
Redis深入浅出
 
TDC2016POA | Trilha Ruby - Stack Level too Deep e Tail Call Optimization: É u...
TDC2016POA | Trilha Ruby - Stack Level too Deep e Tail Call Optimization: É u...TDC2016POA | Trilha Ruby - Stack Level too Deep e Tail Call Optimization: É u...
TDC2016POA | Trilha Ruby - Stack Level too Deep e Tail Call Optimization: É u...
 
A deep dive about VIP,HAIP, and SCAN
A deep dive about VIP,HAIP, and SCAN A deep dive about VIP,HAIP, and SCAN
A deep dive about VIP,HAIP, and SCAN
 
R/C++ talk at earl 2014
R/C++ talk at earl 2014R/C++ talk at earl 2014
R/C++ talk at earl 2014
 
Winter training,Readymade Projects,Buy Projects,Corporate Training
Winter training,Readymade Projects,Buy Projects,Corporate TrainingWinter training,Readymade Projects,Buy Projects,Corporate Training
Winter training,Readymade Projects,Buy Projects,Corporate Training
 

Último

Mastering MySQL Database Architecture: Deep Dive into MySQL Shell and MySQL R...
Mastering MySQL Database Architecture: Deep Dive into MySQL Shell and MySQL R...Mastering MySQL Database Architecture: Deep Dive into MySQL Shell and MySQL R...
Mastering MySQL Database Architecture: Deep Dive into MySQL Shell and MySQL R...
Miguel Araújo
 
08448380779 Call Girls In Diplomatic Enclave Women Seeking Men
08448380779 Call Girls In Diplomatic Enclave Women Seeking Men08448380779 Call Girls In Diplomatic Enclave Women Seeking Men
08448380779 Call Girls In Diplomatic Enclave Women Seeking Men
Delhi Call girls
 
Histor y of HAM Radio presentation slide
Histor y of HAM Radio presentation slideHistor y of HAM Radio presentation slide
Histor y of HAM Radio presentation slide
vu2urc
 
Raspberry Pi 5: Challenges and Solutions in Bringing up an OpenGL/Vulkan Driv...
Raspberry Pi 5: Challenges and Solutions in Bringing up an OpenGL/Vulkan Driv...Raspberry Pi 5: Challenges and Solutions in Bringing up an OpenGL/Vulkan Driv...
Raspberry Pi 5: Challenges and Solutions in Bringing up an OpenGL/Vulkan Driv...
Igalia
 
08448380779 Call Girls In Friends Colony Women Seeking Men
08448380779 Call Girls In Friends Colony Women Seeking Men08448380779 Call Girls In Friends Colony Women Seeking Men
08448380779 Call Girls In Friends Colony Women Seeking Men
Delhi Call girls
 
08448380779 Call Girls In Civil Lines Women Seeking Men
08448380779 Call Girls In Civil Lines Women Seeking Men08448380779 Call Girls In Civil Lines Women Seeking Men
08448380779 Call Girls In Civil Lines Women Seeking Men
Delhi Call girls
 
The Role of Taxonomy and Ontology in Semantic Layers - Heather Hedden.pdf
The Role of Taxonomy and Ontology in Semantic Layers - Heather Hedden.pdfThe Role of Taxonomy and Ontology in Semantic Layers - Heather Hedden.pdf
The Role of Taxonomy and Ontology in Semantic Layers - Heather Hedden.pdf
Enterprise Knowledge
 
CNv6 Instructor Chapter 6 Quality of Service
CNv6 Instructor Chapter 6 Quality of ServiceCNv6 Instructor Chapter 6 Quality of Service
CNv6 Instructor Chapter 6 Quality of Service
giselly40
 

Último (20)

2024: Domino Containers - The Next Step. News from the Domino Container commu...
2024: Domino Containers - The Next Step. News from the Domino Container commu...2024: Domino Containers - The Next Step. News from the Domino Container commu...
2024: Domino Containers - The Next Step. News from the Domino Container commu...
 
Handwritten Text Recognition for manuscripts and early printed texts
Handwritten Text Recognition for manuscripts and early printed textsHandwritten Text Recognition for manuscripts and early printed texts
Handwritten Text Recognition for manuscripts and early printed texts
 
Boost Fertility New Invention Ups Success Rates.pdf
Boost Fertility New Invention Ups Success Rates.pdfBoost Fertility New Invention Ups Success Rates.pdf
Boost Fertility New Invention Ups Success Rates.pdf
 
Mastering MySQL Database Architecture: Deep Dive into MySQL Shell and MySQL R...
Mastering MySQL Database Architecture: Deep Dive into MySQL Shell and MySQL R...Mastering MySQL Database Architecture: Deep Dive into MySQL Shell and MySQL R...
Mastering MySQL Database Architecture: Deep Dive into MySQL Shell and MySQL R...
 
Presentation on how to chat with PDF using ChatGPT code interpreter
Presentation on how to chat with PDF using ChatGPT code interpreterPresentation on how to chat with PDF using ChatGPT code interpreter
Presentation on how to chat with PDF using ChatGPT code interpreter
 
08448380779 Call Girls In Diplomatic Enclave Women Seeking Men
08448380779 Call Girls In Diplomatic Enclave Women Seeking Men08448380779 Call Girls In Diplomatic Enclave Women Seeking Men
08448380779 Call Girls In Diplomatic Enclave Women Seeking Men
 
What Are The Drone Anti-jamming Systems Technology?
What Are The Drone Anti-jamming Systems Technology?What Are The Drone Anti-jamming Systems Technology?
What Are The Drone Anti-jamming Systems Technology?
 
GenCyber Cyber Security Day Presentation
GenCyber Cyber Security Day PresentationGenCyber Cyber Security Day Presentation
GenCyber Cyber Security Day Presentation
 
Tech Trends Report 2024 Future Today Institute.pdf
Tech Trends Report 2024 Future Today Institute.pdfTech Trends Report 2024 Future Today Institute.pdf
Tech Trends Report 2024 Future Today Institute.pdf
 
Workshop - Best of Both Worlds_ Combine KG and Vector search for enhanced R...
Workshop - Best of Both Worlds_ Combine KG and Vector search for enhanced R...Workshop - Best of Both Worlds_ Combine KG and Vector search for enhanced R...
Workshop - Best of Both Worlds_ Combine KG and Vector search for enhanced R...
 
GenAI Risks & Security Meetup 01052024.pdf
GenAI Risks & Security Meetup 01052024.pdfGenAI Risks & Security Meetup 01052024.pdf
GenAI Risks & Security Meetup 01052024.pdf
 
presentation ICT roal in 21st century education
presentation ICT roal in 21st century educationpresentation ICT roal in 21st century education
presentation ICT roal in 21st century education
 
Powerful Google developer tools for immediate impact! (2023-24 C)
Powerful Google developer tools for immediate impact! (2023-24 C)Powerful Google developer tools for immediate impact! (2023-24 C)
Powerful Google developer tools for immediate impact! (2023-24 C)
 
Histor y of HAM Radio presentation slide
Histor y of HAM Radio presentation slideHistor y of HAM Radio presentation slide
Histor y of HAM Radio presentation slide
 
04-2024-HHUG-Sales-and-Marketing-Alignment.pptx
04-2024-HHUG-Sales-and-Marketing-Alignment.pptx04-2024-HHUG-Sales-and-Marketing-Alignment.pptx
04-2024-HHUG-Sales-and-Marketing-Alignment.pptx
 
Raspberry Pi 5: Challenges and Solutions in Bringing up an OpenGL/Vulkan Driv...
Raspberry Pi 5: Challenges and Solutions in Bringing up an OpenGL/Vulkan Driv...Raspberry Pi 5: Challenges and Solutions in Bringing up an OpenGL/Vulkan Driv...
Raspberry Pi 5: Challenges and Solutions in Bringing up an OpenGL/Vulkan Driv...
 
08448380779 Call Girls In Friends Colony Women Seeking Men
08448380779 Call Girls In Friends Colony Women Seeking Men08448380779 Call Girls In Friends Colony Women Seeking Men
08448380779 Call Girls In Friends Colony Women Seeking Men
 
08448380779 Call Girls In Civil Lines Women Seeking Men
08448380779 Call Girls In Civil Lines Women Seeking Men08448380779 Call Girls In Civil Lines Women Seeking Men
08448380779 Call Girls In Civil Lines Women Seeking Men
 
The Role of Taxonomy and Ontology in Semantic Layers - Heather Hedden.pdf
The Role of Taxonomy and Ontology in Semantic Layers - Heather Hedden.pdfThe Role of Taxonomy and Ontology in Semantic Layers - Heather Hedden.pdf
The Role of Taxonomy and Ontology in Semantic Layers - Heather Hedden.pdf
 
CNv6 Instructor Chapter 6 Quality of Service
CNv6 Instructor Chapter 6 Quality of ServiceCNv6 Instructor Chapter 6 Quality of Service
CNv6 Instructor Chapter 6 Quality of Service
 

Linux Binary Exploitation - Return-oritend Programing

  • 1. Linux Binary Exploitation Return-oriented Programing angelboy@chroot.org
  • 2. Outline • ROP • Using ROP bypass ASLR • Stack migration
  • 3. Outline • ROP • Using ROP bypass ASLR • Stack migration
  • 4. ROP • 透過 ret 去執⾏行行其他包含 ret 的程式碼片段 • 這些片段⼜又稱為 gadget
  • 5. ROP • Why do we need ROP ? • Bypass DEP • Static linking can do more thing
  • 6. ROP • ROP chain • 在夠長的 buffer overflow 後 stack 內容幾乎都由我們控制，我們可以藉由 ret = pop rip 指令，持續的控制 rip gadget2 1 gadget1 high low rsp retoverflow pop rax ret syscall gadget1 gadget2
  • 7. ROP • ROP chain • 在夠長的 buffer overflow 後 stack 內容幾乎都由我們控制，我們可以藉由 ret = pop rip 指令，持續的控制 rip gadget2 1 gadget1 high low rsp retoverflow pop rax ret syscall gadget1 gadget2
  • 8. ROP • ROP chain • 在夠長的 buffer overflow 後 stack 內容幾乎都由我們控制，我們可以藉由 ret = pop rip 指令，持續的控制 rip gadget2 1 gadget1 high low rsp retoverflow pop rax ret syscall gadget1 gadget2
  • 9. ROP • ROP chain • 在夠長的 buffer overflow 後 stack 內容幾乎都由我們控制，我們可以藉由 ret = pop rip 指令，持續的控制 rip gadget2 1 gadget1 high low rsp retoverflow pop rax ret syscall gadget1 gadget2
  • 10. ROP • ROP chain • 在夠長的 buffer overflow 後 stack 內容幾乎都由我們控制，我們可以藉由 ret = pop rip 指令，持續的控制 rip gadget2 1 gadget1 high low rsp retoverflow pop rax ret syscall gadget1 gadget2 exit
  • 11. ROP • ROP chain • 由眾多的 ROP gadget 組成 • 藉由不同的 register 及記憶體操作，呼叫 system call 達成任意代碼執⾏行行 • 基本上就是利利⽤用 ROP gadget 來來串串出我們之前寫的 shellcode 的效果
  • 12. ROP • Gadget • read/write register/memory • pop rax;pop rcx ; ret • mov [rax],rcx ; ret • system call • syscall • change rsp • pop rsp ; ret • leave ; ret
  • 13. ROP • Write to Register • pop reg ; ret • mov reg, reg ; ret • …
  • 14. ROP • Write to Register • let rax = 0xdead rbx = 0xbeef 0x401041 0xdead 0x4010fb high low rsp pop rax ret 0x401041 0xbeef pop rbx ret 0x4010fb 0 0 retoverflow rax rbx
  • 15. ROP • Write to Register • let rax = 0xdead rbx = 0xbeef 0x401041 0xdead 0x4010fb high low rsp pop rax ret 0x401041 0xbeef pop rbx ret 0x4010fb 0 0 retoverflow rax rbx
  • 16. ROP • Write to Register • let rax = 0xdead rbx = 0xbeef 0x401041 0xdead 0x4010fb high low rsppop rax ret 0x401041 0xbeef pop rbx ret 0x4010fb 0xdead 0 retoverflow rax rbx
  • 17. ROP • Write to Register • let rax = 0xdead rbx = 0xbeef 0x401041 0xdead 0x4010fb high low rsp pop rax ret 0x401041 0xbeef pop rbx ret 0x4010fb 0xdead 0 retoverflow rax rbx
  • 18. ROP • Write to Register • let rax = 0xdead rbx = 0xbeef 0x401041 0xdead 0x4010fb high low rsp pop rax ret 0x401041 0xbeef pop rbx ret 0x4010fb 0xdead 0xbeef retoverflow rax rbx
  • 19. ROP • Write to Memory • mov [reg],reg • mov [reg+xx], reg • …
  • 20. ROP • Write to Memory • let *0x602080 = 0xdeadbeef 0x40108a 0xdeadbeef 0x4010d1 high low rsp pop rax pop rbx ret 0x40108a 0xbeef mov [rax],rbx ret 0x4010d1 0 0 rax rbx 0x602080 0 0x602080 retoverflow
  • 21. ROP • Write to Memory • let *0x602080 = 0xdeadbeef 0x40108a 0xdeadbeef 0x4010d1 high low rsp pop rax pop rbx ret 0x40108a 0xbeef mov [rax],rbx ret 0x4010d1 0 0 rax rbx 0x602080 0 0x602080 retoverflow
  • 22. ROP • Write to Memory • let *0x602080 = 0xdeadbeef 0x40108a 0xdeadbeef 0x4010d1 high low rsp pop rax pop rbx ret 0x40108a 0xbeef mov [rax],rbx ret 0x4010d1 0x602080 0 rax rbx 0x602080 0 0x602080 retoverflow
  • 23. ROP • Write to Memory • let *0x602080 = 0xdeadbeef 0x40108a 0xdeadbeef 0x4010d1 high low rsp pop rax pop rbx ret 0x40108a 0xbeef mov [rax],rbx ret 0x4010d1 0x602080 0xdeadbeef rax rbx 0x602080 0 0x602080 retoverflow
  • 24. ROP • Write to Memory • let *0x602080 = 0xdeadbeef 0x40108a 0xdeadbeef 0x4010d1 high low rsp pop rax pop rbx ret 0x40108a 0xbeef mov [rax],rbx ret 0x4010d1 0x602080 0xdeadbeef rax rbx 0x602080 0 0x602080 retoverflow
  • 25. ROP • Write to Memory • let *0x602080 = 0xdeadbeef 0x40108a 0xdeadbeef 0x4010d1 high low rsp pop rax pop rbx ret 0x40108a 0xbeef mov [rax],rbx ret 0x4010d1 0x602080 0xdeadbeef rax rbx 0x602080 0xdeadbeef 0x602080 retoverflow
  • 26. ROP • execve(“/bin/sh”,NULL,NULL) • write to memory • 將 “/bin/sh” 寫入已知位置記憶體中 • 可分多次將所需字串串寫入記憶體中 /bin/das 0x602080 0x602088 hx00x00x00…
  • 27. ROP • execve(“/bin/sh”,NULL,NULL) • write to register • rax = 0x3b , rdi = address of “/bin/sh” • rsi = 0 , rdx = 0 • syscall
  • 28. ROP • find gadget • https://github.com/JonathanSalwan/ROPgadget
  • 29. ROP • find gadget • ROPgadget - - binary binary • ROPgadget - - ropchain - - binary binary • 在 Static linking 通常可以組成功 execve 的 rop chain 但通常都很長， 需要⾃自⼰己找更更短的 gadget 來來改短⼀一點
  • 30. Outline • ROP • Using ROP bypass ASLR • Stack migration
  • 31. Using ROP bypass ASLR • 假設 dynamic 編譯的程式中有 Buffer Overflow 的漏洞洞且在沒 PIE 情況下 ( 先不考慮 StackGuard 的情況） • How to bypass ASLR and DEP ? • Use .plt section to leak some information • ret2plt • 通常⼀一般的程式中都會有 put 、 send 、write 等 output function !31
  • 32. Using ROP bypass ASLR ret code stack high low rsp !32 put@plt pop rdi put@GOT pop rdi 0 pop rsi puts@GOT …… 0 rdi 0 rsi 0 rdx
  • 33. Using ROP bypass ASLR ret pop rdi
 ret code stack high low rsp !33 put@plt pop rdi put@GOT pop rdi 0 pop rsi puts@GOT …… 0 rdi 0 rsi 0 rdx
  • 34. Using ROP bypass ASLR ret pop rdi
 ret code stack high low rsp !34 put@plt pop rdi put@GOT pop rdi 0 pop rsi puts@GOT …… put@GOT rdi 0 rsi 0 rdx
  • 35. Using ROP bypass ASLR ret pop rdi
 ret put@plt code stack high low rsp !35 put@plt pop rdi put@GOT pop rdi 0 pop rsi puts@GOT …… put@GOT rdi 0 rsi 0 rdx
  • 36. Using ROP bypass ASLR ret pop rdi
 ret jmp *(put@GOT) code stack high low rsp !36 put@plt pop rdi put@GOT pop rdi 0 pop rsi puts@GOT …… put@GOT rdi 0 rsi 0 rdx
  • 37. Using ROP bypass ASLR ret pop rdi
 ret jmp put(put@GOT) code stack high low rsp !37 put@plt pop rdi put@GOT pop rdi 0 pop rsi puts@GOT …… put@GOT rdi 0 rsi 0 rdx
  • 38. Using ROP bypass ASLR ret pop rdi
 ret jmp put(put@GOT) code stack high low rsp !38 put@plt pop rdi put@GOT pop rdi 0 pop rsi puts@GOT …… put@GOT rdi 0 rsi 0 rdx Information leak
  • 39. Using ROP bypass ASLR ret pop rdi
 ret jmp put(put@GOT) ret code stack high low rsp !39 put@plt pop rdi put@GOT pop rdi 0 pop rsi puts@GOT …… put@GOT rdi 0 rsi 0 rdx
  • 40. Using ROP bypass ASLR ret pop rdi
 ret jmp put(put@GOT) ret pop rdi ret code stack high low rsp !40 put@plt pop rdi put@GOT pop rdi 0 pop rsi puts@GOT …… put@GOT rdi 0 rsi 0 rdx
  • 41. Using ROP bypass ASLR ret pop rdi
 ret jmp put(put@GOT) ret pop rdi ret code stack high low rsp !41 put@plt pop rdi put@GOT pop rdi 0 pop rsi puts@GOT …… 0 rdi 0 rsi 0 rdx
  • 42. Using ROP bypass ASLR ret pop rdi
 ret jmp put(put@GOT) ret pop rdi ret pop rsi ret code stack high low rsp !42 put@plt pop rdi put@GOT pop rdi 0 pop rsi puts@GOT …… 0 rdi 0 rsi 0 rdx
  • 43. Using ROP bypass ASLR ret pop rdi
 ret jmp put(put@GOT) ret pop rdi ret pop rsi ret code stack high low rsp !43 puts@GOT 0 rdi puts@GOT rsi 0 rdx pop rdx read@plt pop rdi Address of /bin/sh puts@plt 0x8
  • 44. Using ROP bypass ASLR ret pop rdx ret code stack high low rsp !44 puts@GOT 0 rdi puts@GOT rsi 0 rdx pop rdx read@plt pop rdi Address of /bin/sh puts@plt 0x8
  • 45. Using ROP bypass ASLR ret pop rdx ret code stack high low rsp !45 puts@GOT 0 rdi puts@GOT rsi 8 rdx pop rdx read@plt pop rdi Address of /bin/sh puts@plt 0x8
  • 46. Using ROP bypass ASLR ret pop rdx ret jmp read@plt code stack high low rsp !46 puts@GOT 0 rdi puts@GOT rsi 8 rdx pop rdx read@plt pop rdi Address of /bin/sh puts@plt 0x8
  • 47. Using ROP bypass ASLR ret pop rdx ret jmp read(0,put@GOT,8) code stack high low !47 puts@GOT 0 rdi puts@GOT rsi 8 rdx pop rdx read@plt pop rdi Address of /bin/sh puts@plt 0x8 rsp
  • 48. rsp Using ROP bypass ASLR ret pop rdx ret jmp read(0,put@GOT,8) code stack high low rsp !48 puts@GOT 0 rdi puts@GOT rsi 8 rdx pop rdx read@plt pop rdi Address of /bin/sh puts@plt 0x8 GOT Hijacking puts -> system
  • 49. Using ROP bypass ASLR ret pop rdx ret jmp read(0,put@GOT,8) ret code stack high low !49 puts@GOT 0 rdi puts@GOT rsi 8 rdx pop rdx read@plt pop rdi Address of /bin/sh puts@plt 0x8 rsp
  • 50. Using ROP bypass ASLR ret pop rdx ret jmp read(0,put@GOT,8) ret pop rdi ret code stack high low !50 puts@GOT 0 rdi puts@GOT rsi 8 rdx pop rdx read@plt pop rdi Address of /bin/sh puts@plt 0x8 rsp
  • 51. Using ROP bypass ASLR ret pop rdx ret jmp read(0,put@GOT,8) ret pop rdi ret code stack high low !51 puts@GOT &/bin/sh rdi puts@GOT rsi 8 rdx pop rdx read@plt pop rdi Address of /bin/sh puts@plt 0x8 rsp
  • 52. Using ROP bypass ASLR ret pop rdx ret jmp read(0,put@GOT,8) ret pop rdi ret jmp puts@plt code stack high low !52 puts@GOT &/bin/sh rdi puts@GOT rsi 8 rdx pop rdx read@plt pop rdi Address of /bin/sh puts@plt 0x8 rsp
  • 53. Using ROP bypass ASLR ret pop rdx ret jmp read(0,put@GOT,8) ret pop rdi ret jmp *(puts@GOT) code stack high low !53 puts@GOT &/bin/sh rdi puts@GOT rsi 8 rdx pop rdx read@plt pop rdi Address of /bin/sh puts@plt 0x8 rsp
  • 54. Using ROP bypass ASLR ret pop rdx ret jmp read(0,put@GOT,8) ret pop rdi ret jmp system(“/bin/sh”) code stack high low !54 puts@GOT &/bin/sh rdi puts@GOT rsi 8 rdx pop rdx read@plt pop rdi Address of /bin/sh puts@plt 0x8 rsp
  • 55. Using ROP bypass ASLR ret pop rdx ret jmp read(0,put@GOT,8) ret pop rdi ret jmp system(“/bin/sh”) code stack high low !55 puts@GOT &/bin/sh rdi puts@GOT rsi 8 rdx pop rdx read@plt pop rdi Address of /bin/sh puts@plt 0x8 rsp GET SHELL
  • 56. Using ROP bypass ASLR !56 • Bypass PIE • 必須比平常多 leak ⼀一個 code 段的位置，藉由這個值算出 code base 進 ⽽而推出所有 GOT 等資訊 • 有了了 code base 之後其他就跟沒有 PIE 的情況下⼀一樣
  • 57. Using ROP bypass ASLR !57 • Bypass StackGuard • canary 只有在 function return 時做檢查 • 只檢查 canary 值時否⼀一樣 • 所以可以先想辦法 leak 出 canary 的值，塞⼀一模⼀一樣的內容就可 bypass，或是想辦法不要改到 canary 也可以
  • 58. Using ROP bypass ASLR !58 • Weakness in fork • canary and memory mappings are same as parent.
  • 59. Outline • ROP • Using ROP bypass ASLR • Stack migration
  • 60. Stack Migration • 將 ROP Chain 寫在已知固定位置上 • 再利利⽤用 leave 搬移 Stack 位置到已知位置 • 可無限接 ROP Chain • 必須注意到 Migration 之後 stack 要留留⼤大⼀一點，有些 function 可能會需要很 ⼤大的 stack frame ，太⼩小可能會存取到唯獨區域，導致 Segmentation Fault !60
  • 61. Stack Migration !61 return address rbp rbp/rsp push rbp mov rbp,rsp … leave ret high low
  • 62. Stack Migration !62 buf1 rbp push rbp mov rbp,rsp … leave ret aaaa aaaa rsp gets() buf1 high low buf1 leave_ret pop rdi
  • 63. Stack Migration !63 buf1 push rbp mov rbp,rsp … leave ret aaaa aaaa rsp gets() buf1 buf1 leave_ret leave = mov rsp,rbp ; pop rbp rbp pop rdi high low
  • 64. Stack Migration !64 buf1 rbp/rsp push rbp mov rbp,rsp … leave ret aaaa aaaa gets() buf1 buf1 leave_ret leave = mov rsp,rbp ; pop rbp pop rdi high low
  • 65. Stack Migration !65 buf1 rsp push rbp mov rbp,rsp … leave ret aaaa aaaa gets() buf1 buf1 leave_ret rbp pop rdi high low
  • 66. Stack Migration !66 buf1 rsp push rbp mov rbp,rsp … leave ret pop rdi
 ret aaaa aaaa gets() buf1 buf1 leave_ret pop rdi rdi 0 high low rbp
  • 67. Stack Migration !67 buf1 rsppush rbp mov rbp,rsp … leave ret pop rdi
 ret aaaa aaaa gets() buf1 buf1 leave_ret pop rdi rdi buf1 high low rbp
  • 68. Stack Migration !68 buf1 rsp push rbp mov rbp,rsp … leave ret pop rdi
 ret gets(buf1) aaaa aaaa gets() buf1 buf1 leave_ret pop rdi rdi buf1 high low rbp
  • 69. Stack Migration !69 buf1 rsp push rbp mov rbp,rsp … leave ret pop rdi
 ret gets(buf1) ret aaaa aaaa gets() buf1 buf1 leave_ret rbp pop rdi rdi buf1 buf2 pop rdi puts@GOT puts() pop rdi buf2 gets() high low leave_ret
  • 70. Stack Migration !70 buf1 rsp leave
 ret aaaa aaaa gets() buf1 buf1 leave_ret pop rdi rdi buf1 buf2 pop rdi puts@GOT puts() pop rdi buf2 gets() high low leave_ret leave = mov rsp,rbp ; pop rbp rbp
  • 72. Stack Migration !72 pop rdi
 ret buf1 rdi buf1 buf2 pop rdi puts@GOT puts() pop rdi buf2 gets() high low leave_ret rsp rbp buf2
  • 73. Stack Migration !73 pop rdi
 ret buf1 rdi puts@GOT buf2 pop rdi puts@GOT puts() pop rdi buf2 gets() high low leave_ret rbp buf2 rsp
  • 74. Stack Migration !74 pop rdi
 ret puts(puts@GOT) ret buf1 rdi puts@GOT buf2 pop rdi puts@GOT puts() pop rdi buf2 gets() high low leave_ret rsp rbp buf2 Information leakage
  • 75. Stack Migration !75 pop rdi
 ret puts(puts@GOT) ret buf1 rdi puts@GOT buf2 pop rdi puts@GOT puts() pop rdi buf2 gets() high low leave_ret rsp rbp buf2
  • 76. Stack Migration !76 pop rdi
 ret buf1 rdi puts@GOT buf2 pop rdi puts@GOT puts() pop rdi buf2 gets() high low leave_ret rsp rbp buf2
  • 77. Stack Migration !77 pop rdi
 ret buf1 rdi buf2 buf2 pop rdi puts@GOT puts() pop rdi buf2 gets() high low leave_ret rsp rbp buf2
  • 78. Stack Migration !78 pop rdi
 ret gets(buf2) ret buf1 rdi buf2 buf2 pop rdi puts@GOT puts() pop rdi buf2 gets() high low leave_retrsp rbp buf2
  • 79. Stack Migration !79 pop rdi
 ret gets(buf2) ret buf1 rdi buf2 buf2 pop rdi puts@GOT puts() pop rdi buf2 gets() high low leave_retrsp rbp buf2 buf1 pop rdi &/bin/sh /bin/sh system
  • 80. Stack Migration !80 pop rdi
 ret gets(buf2) ret leave ret buf1 rdi buf2 buf2 pop rdi puts@GOT puts() pop rdi buf2 gets() high low leave_retrsp rbp buf2 buf1 pop rdi &/bin/sh /bin/sh system leave = mov rsp,rbp ; pop rbp
  • 81. Stack Migration !81 pop rdi
 ret gets(buf2) ret leave ret buf1 rdi buf2 buf2 pop rdi puts@GOT puts() pop rdi buf2 gets() high low leave_ret rbp rsp buf2 buf1 pop rdi &/bin/sh /bin/sh system
  • 82. Stack Migration !82 pop rdi
 ret buf1 rdi buf2 buf2 pop rdi puts@GOT puts() pop rdi buf2 gets() high low leave_ret rbp rsp buf2 buf1 pop rdi &/bin/sh /bin/sh system
  • 83. Stack Migration !83 pop rdi
 ret buf1 rdi &/bin/sh buf2 pop rdi puts@GOT puts() pop rdi buf2 gets() high low leave_ret rbp rsp buf2 buf1 pop rdi &/bin/sh /bin/sh system
  • 84. Stack Migration !84 pop rdi ret system(“/bin/sh”) buf1 rdi &/bin/sh buf2 pop rdi puts@GOT puts() pop rdi buf2 gets() high low leave_ret rbp rsp buf2 buf1 pop rdi &/bin/sh /bin/sh system GET SHELL
  • 85. Stack Migration • 若若能妥善利利⽤用，在沒有 libc 的情況下，有機會將整個 libc 給 dump 出來來， 更更有機會直接找出 system 的位置 • 無限 ROP ，幾乎可以做出所有事情，但唯⼀一要注意的是 buf ⼤大⼩小要控制 好，盡量量選 bss 後半段位置，否則可能因為 stack 不夠⼤大⽽而 segfault !85
  • 86. Stack Migration • Other migration gadget • add rsp,0xNN ; ret • sub rsp,0xNN ; ret • ret 0xNN • xchg rsp,exx ; ret • partial overwrite rbp !86
  • 91. Q & A