SlideShare a Scribd company logo

Linux Binary Exploitation - Return-oritend Programing

A
Angel Boy

The document discusses using return-oriented programming (ROP) to bypass address space layout randomization (ASLR) and data execution prevention (DEP). It describes using the procedure linkage table (PLT) to leak the address of functions like puts to bypass ASLR. A ROP chain is then constructed to call read to read "/bin/sh" into memory and execute it, achieving arbitrary code execution.

Technology
1 of 91
Downloaded 170 times
1
2
3
4
Most read
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
Most read
71
72
73
74
75
76
77
78
79
80
81
82
83
84
Most read
85
86
87
88
89
90
91
Linux Binary Exploitation Return-oriented Programing angelboy@chroot.org
Outline • ROP • Using ROP bypass ASLR • Stack migration
Outline • ROP • Using ROP bypass ASLR • Stack migration
ROP • 透過 ret 去執⾏行行其他包含 ret 的程式碼片段 • 這些片段⼜又稱為 gadget
ROP • Why do we need ROP ? • Bypass DEP • Static linking can do more thing
ROP • ROP chain • 在夠長的 buffer overflow 後 stack 內容幾乎都由我們控制，我們可以藉由 ret = pop rip 指令，持續的控制 rip gadget2 1 gadget1 high low rsp retoverflow pop rax ret syscall gadget1 gadget2
ROP • ROP chain • 在夠長的 buffer overflow 後 stack 內容幾乎都由我們控制，我們可以藉由 ret = pop rip 指令，持續的控制 rip gadget2 1 gadget1 high low rsp retoverflow pop rax ret syscall gadget1 gadget2
ROP • ROP chain • 在夠長的 buffer overflow 後 stack 內容幾乎都由我們控制，我們可以藉由 ret = pop rip 指令，持續的控制 rip gadget2 1 gadget1 high low rsp retoverflow pop rax ret syscall gadget1 gadget2
ROP • ROP chain • 在夠長的 buffer overflow 後 stack 內容幾乎都由我們控制，我們可以藉由 ret = pop rip 指令，持續的控制 rip gadget2 1 gadget1 high low rsp retoverflow pop rax ret syscall gadget1 gadget2
ROP • ROP chain • 在夠長的 buffer overflow 後 stack 內容幾乎都由我們控制，我們可以藉由 ret = pop rip 指令，持續的控制 rip gadget2 1 gadget1 high low rsp retoverflow pop rax ret syscall gadget1 gadget2 exit
ROP • ROP chain • 由眾多的 ROP gadget 組成 • 藉由不同的 register 及記憶體操作，呼叫 system call 達成任意代碼執⾏行行 • 基本上就是利利⽤用 ROP gadget 來來串串出我們之前寫的 shellcode 的效果
ROP • Gadget • read/write register/memory • pop rax;pop rcx ; ret • mov [rax],rcx ; ret • system call • syscall • change rsp • pop rsp ; ret • leave ; ret
ROP • Write to Register • pop reg ; ret • mov reg, reg ; ret • …
ROP • Write to Register • let rax = 0xdead rbx = 0xbeef 0x401041 0xdead 0x4010fb high low rsp pop rax ret 0x401041 0xbeef pop rbx ret 0x4010fb 0 0 retoverflow rax rbx
ROP • Write to Register • let rax = 0xdead rbx = 0xbeef 0x401041 0xdead 0x4010fb high low rsp pop rax ret 0x401041 0xbeef pop rbx ret 0x4010fb 0 0 retoverflow rax rbx
ROP • Write to Register • let rax = 0xdead rbx = 0xbeef 0x401041 0xdead 0x4010fb high low rsppop rax ret 0x401041 0xbeef pop rbx ret 0x4010fb 0xdead 0 retoverflow rax rbx
ROP • Write to Register • let rax = 0xdead rbx = 0xbeef 0x401041 0xdead 0x4010fb high low rsp pop rax ret 0x401041 0xbeef pop rbx ret 0x4010fb 0xdead 0 retoverflow rax rbx
ROP • Write to Register • let rax = 0xdead rbx = 0xbeef 0x401041 0xdead 0x4010fb high low rsp pop rax ret 0x401041 0xbeef pop rbx ret 0x4010fb 0xdead 0xbeef retoverflow rax rbx
ROP • Write to Memory • mov [reg],reg • mov [reg+xx], reg • …
ROP • Write to Memory • let *0x602080 = 0xdeadbeef 0x40108a 0xdeadbeef 0x4010d1 high low rsp pop rax pop rbx ret 0x40108a 0xbeef mov [rax],rbx ret 0x4010d1 0 0 rax rbx 0x602080 0 0x602080 retoverflow
ROP • Write to Memory • let *0x602080 = 0xdeadbeef 0x40108a 0xdeadbeef 0x4010d1 high low rsp pop rax pop rbx ret 0x40108a 0xbeef mov [rax],rbx ret 0x4010d1 0 0 rax rbx 0x602080 0 0x602080 retoverflow
ROP • Write to Memory • let *0x602080 = 0xdeadbeef 0x40108a 0xdeadbeef 0x4010d1 high low rsp pop rax pop rbx ret 0x40108a 0xbeef mov [rax],rbx ret 0x4010d1 0x602080 0 rax rbx 0x602080 0 0x602080 retoverflow
ROP • Write to Memory • let *0x602080 = 0xdeadbeef 0x40108a 0xdeadbeef 0x4010d1 high low rsp pop rax pop rbx ret 0x40108a 0xbeef mov [rax],rbx ret 0x4010d1 0x602080 0xdeadbeef rax rbx 0x602080 0 0x602080 retoverflow
ROP • Write to Memory • let *0x602080 = 0xdeadbeef 0x40108a 0xdeadbeef 0x4010d1 high low rsp pop rax pop rbx ret 0x40108a 0xbeef mov [rax],rbx ret 0x4010d1 0x602080 0xdeadbeef rax rbx 0x602080 0 0x602080 retoverflow
ROP • Write to Memory • let *0x602080 = 0xdeadbeef 0x40108a 0xdeadbeef 0x4010d1 high low rsp pop rax pop rbx ret 0x40108a 0xbeef mov [rax],rbx ret 0x4010d1 0x602080 0xdeadbeef rax rbx 0x602080 0xdeadbeef 0x602080 retoverflow
ROP • execve(“/bin/sh”,NULL,NULL) • write to memory • 將 “/bin/sh” 寫入已知位置記憶體中 • 可分多次將所需字串串寫入記憶體中 /bin/das 0x602080 0x602088 hx00x00x00…
ROP • execve(“/bin/sh”,NULL,NULL) • write to register • rax = 0x3b , rdi = address of “/bin/sh” • rsi = 0 , rdx = 0 • syscall
ROP • find gadget • https://github.com/JonathanSalwan/ROPgadget
ROP • find gadget • ROPgadget - - binary binary • ROPgadget - - ropchain - - binary binary • 在 Static linking 通常可以組成功 execve 的 rop chain 但通常都很長， 需要⾃自⼰己找更更短的 gadget 來來改短⼀一點
Outline • ROP • Using ROP bypass ASLR • Stack migration
Using ROP bypass ASLR • 假設 dynamic 編譯的程式中有 Buffer Overflow 的漏洞洞且在沒 PIE 情況下 ( 先不考慮 StackGuard 的情況） • How to bypass ASLR and DEP ? • Use .plt section to leak some information • ret2plt • 通常⼀一般的程式中都會有 put 、 send 、write 等 output function !31
Using ROP bypass ASLR ret code stack high low rsp !32 put@plt pop rdi put@GOT pop rdi 0 pop rsi puts@GOT …… 0 rdi 0 rsi 0 rdx
Using ROP bypass ASLR ret pop rdi
 ret code stack high low rsp !33 put@plt pop rdi put@GOT pop rdi 0 pop rsi puts@GOT …… 0 rdi 0 rsi 0 rdx
Using ROP bypass ASLR ret pop rdi
 ret code stack high low rsp !34 put@plt pop rdi put@GOT pop rdi 0 pop rsi puts@GOT …… put@GOT rdi 0 rsi 0 rdx
Using ROP bypass ASLR ret pop rdi
 ret put@plt code stack high low rsp !35 put@plt pop rdi put@GOT pop rdi 0 pop rsi puts@GOT …… put@GOT rdi 0 rsi 0 rdx
Using ROP bypass ASLR ret pop rdi
 ret jmp *(put@GOT) code stack high low rsp !36 put@plt pop rdi put@GOT pop rdi 0 pop rsi puts@GOT …… put@GOT rdi 0 rsi 0 rdx
Using ROP bypass ASLR ret pop rdi
 ret jmp put(put@GOT) code stack high low rsp !37 put@plt pop rdi put@GOT pop rdi 0 pop rsi puts@GOT …… put@GOT rdi 0 rsi 0 rdx
Using ROP bypass ASLR ret pop rdi
 ret jmp put(put@GOT) code stack high low rsp !38 put@plt pop rdi put@GOT pop rdi 0 pop rsi puts@GOT …… put@GOT rdi 0 rsi 0 rdx Information leak
Using ROP bypass ASLR ret pop rdi
 ret jmp put(put@GOT) ret code stack high low rsp !39 put@plt pop rdi put@GOT pop rdi 0 pop rsi puts@GOT …… put@GOT rdi 0 rsi 0 rdx
Using ROP bypass ASLR ret pop rdi
 ret jmp put(put@GOT) ret pop rdi ret code stack high low rsp !40 put@plt pop rdi put@GOT pop rdi 0 pop rsi puts@GOT …… put@GOT rdi 0 rsi 0 rdx
Using ROP bypass ASLR ret pop rdi
 ret jmp put(put@GOT) ret pop rdi ret code stack high low rsp !41 put@plt pop rdi put@GOT pop rdi 0 pop rsi puts@GOT …… 0 rdi 0 rsi 0 rdx
Using ROP bypass ASLR ret pop rdi
 ret jmp put(put@GOT) ret pop rdi ret pop rsi ret code stack high low rsp !42 put@plt pop rdi put@GOT pop rdi 0 pop rsi puts@GOT …… 0 rdi 0 rsi 0 rdx
Using ROP bypass ASLR ret pop rdi
 ret jmp put(put@GOT) ret pop rdi ret pop rsi ret code stack high low rsp !43 puts@GOT 0 rdi puts@GOT rsi 0 rdx pop rdx read@plt pop rdi Address of /bin/sh puts@plt 0x8
Using ROP bypass ASLR ret pop rdx ret code stack high low rsp !44 puts@GOT 0 rdi puts@GOT rsi 0 rdx pop rdx read@plt pop rdi Address of /bin/sh puts@plt 0x8
Using ROP bypass ASLR ret pop rdx ret code stack high low rsp !45 puts@GOT 0 rdi puts@GOT rsi 8 rdx pop rdx read@plt pop rdi Address of /bin/sh puts@plt 0x8
Using ROP bypass ASLR ret pop rdx ret jmp read@plt code stack high low rsp !46 puts@GOT 0 rdi puts@GOT rsi 8 rdx pop rdx read@plt pop rdi Address of /bin/sh puts@plt 0x8
Using ROP bypass ASLR ret pop rdx ret jmp read(0,put@GOT,8) code stack high low !47 puts@GOT 0 rdi puts@GOT rsi 8 rdx pop rdx read@plt pop rdi Address of /bin/sh puts@plt 0x8 rsp
rsp Using ROP bypass ASLR ret pop rdx ret jmp read(0,put@GOT,8) code stack high low rsp !48 puts@GOT 0 rdi puts@GOT rsi 8 rdx pop rdx read@plt pop rdi Address of /bin/sh puts@plt 0x8 GOT Hijacking puts -> system
Using ROP bypass ASLR ret pop rdx ret jmp read(0,put@GOT,8) ret code stack high low !49 puts@GOT 0 rdi puts@GOT rsi 8 rdx pop rdx read@plt pop rdi Address of /bin/sh puts@plt 0x8 rsp
Using ROP bypass ASLR ret pop rdx ret jmp read(0,put@GOT,8) ret pop rdi ret code stack high low !50 puts@GOT 0 rdi puts@GOT rsi 8 rdx pop rdx read@plt pop rdi Address of /bin/sh puts@plt 0x8 rsp
Using ROP bypass ASLR ret pop rdx ret jmp read(0,put@GOT,8) ret pop rdi ret code stack high low !51 puts@GOT &/bin/sh rdi puts@GOT rsi 8 rdx pop rdx read@plt pop rdi Address of /bin/sh puts@plt 0x8 rsp
Using ROP bypass ASLR ret pop rdx ret jmp read(0,put@GOT,8) ret pop rdi ret jmp puts@plt code stack high low !52 puts@GOT &/bin/sh rdi puts@GOT rsi 8 rdx pop rdx read@plt pop rdi Address of /bin/sh puts@plt 0x8 rsp
Using ROP bypass ASLR ret pop rdx ret jmp read(0,put@GOT,8) ret pop rdi ret jmp *(puts@GOT) code stack high low !53 puts@GOT &/bin/sh rdi puts@GOT rsi 8 rdx pop rdx read@plt pop rdi Address of /bin/sh puts@plt 0x8 rsp
Using ROP bypass ASLR ret pop rdx ret jmp read(0,put@GOT,8) ret pop rdi ret jmp system(“/bin/sh”) code stack high low !54 puts@GOT &/bin/sh rdi puts@GOT rsi 8 rdx pop rdx read@plt pop rdi Address of /bin/sh puts@plt 0x8 rsp
Using ROP bypass ASLR ret pop rdx ret jmp read(0,put@GOT,8) ret pop rdi ret jmp system(“/bin/sh”) code stack high low !55 puts@GOT &/bin/sh rdi puts@GOT rsi 8 rdx pop rdx read@plt pop rdi Address of /bin/sh puts@plt 0x8 rsp GET SHELL
Using ROP bypass ASLR !56 • Bypass PIE • 必須比平常多 leak ⼀一個 code 段的位置，藉由這個值算出 code base 進 ⽽而推出所有 GOT 等資訊 • 有了了 code base 之後其他就跟沒有 PIE 的情況下⼀一樣
Using ROP bypass ASLR !57 • Bypass StackGuard • canary 只有在 function return 時做檢查 • 只檢查 canary 值時否⼀一樣 • 所以可以先想辦法 leak 出 canary 的值，塞⼀一模⼀一樣的內容就可 bypass，或是想辦法不要改到 canary 也可以
Using ROP bypass ASLR !58 • Weakness in fork • canary and memory mappings are same as parent.
Outline • ROP • Using ROP bypass ASLR • Stack migration
Stack Migration • 將 ROP Chain 寫在已知固定位置上 • 再利利⽤用 leave 搬移 Stack 位置到已知位置 • 可無限接 ROP Chain • 必須注意到 Migration 之後 stack 要留留⼤大⼀一點，有些 function 可能會需要很 ⼤大的 stack frame ，太⼩小可能會存取到唯獨區域，導致 Segmentation Fault !60
Stack Migration !61 return address rbp rbp/rsp push rbp mov rbp,rsp … leave ret high low
Stack Migration !62 buf1 rbp push rbp mov rbp,rsp … leave ret aaaa aaaa rsp gets() buf1 high low buf1 leave_ret pop rdi
Stack Migration !63 buf1 push rbp mov rbp,rsp … leave ret aaaa aaaa rsp gets() buf1 buf1 leave_ret leave = mov rsp,rbp ; pop rbp rbp pop rdi high low
Stack Migration !64 buf1 rbp/rsp push rbp mov rbp,rsp … leave ret aaaa aaaa gets() buf1 buf1 leave_ret leave = mov rsp,rbp ; pop rbp pop rdi high low
Stack Migration !65 buf1 rsp push rbp mov rbp,rsp … leave ret aaaa aaaa gets() buf1 buf1 leave_ret rbp pop rdi high low
Stack Migration !66 buf1 rsp push rbp mov rbp,rsp … leave ret pop rdi
 ret aaaa aaaa gets() buf1 buf1 leave_ret pop rdi rdi 0 high low rbp
Stack Migration !67 buf1 rsppush rbp mov rbp,rsp … leave ret pop rdi
 ret aaaa aaaa gets() buf1 buf1 leave_ret pop rdi rdi buf1 high low rbp
Stack Migration !68 buf1 rsp push rbp mov rbp,rsp … leave ret pop rdi
 ret gets(buf1) aaaa aaaa gets() buf1 buf1 leave_ret pop rdi rdi buf1 high low rbp
Stack Migration !69 buf1 rsp push rbp mov rbp,rsp … leave ret pop rdi
 ret gets(buf1) ret aaaa aaaa gets() buf1 buf1 leave_ret rbp pop rdi rdi buf1 buf2 pop rdi puts@GOT puts() pop rdi buf2 gets() high low leave_ret
Stack Migration !70 buf1 rsp leave
 ret aaaa aaaa gets() buf1 buf1 leave_ret pop rdi rdi buf1 buf2 pop rdi puts@GOT puts() pop rdi buf2 gets() high low leave_ret leave = mov rsp,rbp ; pop rbp rbp
Stack Migration !71 leave
 ret buf1 rdi buf1 buf2 pop rdi puts@GOT puts() pop rdi buf2 gets() high low leave_ret rsp rbp buf2
Stack Migration !72 pop rdi
 ret buf1 rdi buf1 buf2 pop rdi puts@GOT puts() pop rdi buf2 gets() high low leave_ret rsp rbp buf2
Stack Migration !73 pop rdi
 ret buf1 rdi puts@GOT buf2 pop rdi puts@GOT puts() pop rdi buf2 gets() high low leave_ret rbp buf2 rsp
Stack Migration !74 pop rdi
 ret puts(puts@GOT) ret buf1 rdi puts@GOT buf2 pop rdi puts@GOT puts() pop rdi buf2 gets() high low leave_ret rsp rbp buf2 Information leakage
Stack Migration !75 pop rdi
 ret puts(puts@GOT) ret buf1 rdi puts@GOT buf2 pop rdi puts@GOT puts() pop rdi buf2 gets() high low leave_ret rsp rbp buf2
Stack Migration !76 pop rdi
 ret buf1 rdi puts@GOT buf2 pop rdi puts@GOT puts() pop rdi buf2 gets() high low leave_ret rsp rbp buf2
Stack Migration !77 pop rdi
 ret buf1 rdi buf2 buf2 pop rdi puts@GOT puts() pop rdi buf2 gets() high low leave_ret rsp rbp buf2
Stack Migration !78 pop rdi
 ret gets(buf2) ret buf1 rdi buf2 buf2 pop rdi puts@GOT puts() pop rdi buf2 gets() high low leave_retrsp rbp buf2
Stack Migration !79 pop rdi
 ret gets(buf2) ret buf1 rdi buf2 buf2 pop rdi puts@GOT puts() pop rdi buf2 gets() high low leave_retrsp rbp buf2 buf1 pop rdi &/bin/sh /bin/sh system
Stack Migration !80 pop rdi
 ret gets(buf2) ret leave ret buf1 rdi buf2 buf2 pop rdi puts@GOT puts() pop rdi buf2 gets() high low leave_retrsp rbp buf2 buf1 pop rdi &/bin/sh /bin/sh system leave = mov rsp,rbp ; pop rbp
Stack Migration !81 pop rdi
 ret gets(buf2) ret leave ret buf1 rdi buf2 buf2 pop rdi puts@GOT puts() pop rdi buf2 gets() high low leave_ret rbp rsp buf2 buf1 pop rdi &/bin/sh /bin/sh system
Stack Migration !82 pop rdi
 ret buf1 rdi buf2 buf2 pop rdi puts@GOT puts() pop rdi buf2 gets() high low leave_ret rbp rsp buf2 buf1 pop rdi &/bin/sh /bin/sh system
Stack Migration !83 pop rdi
 ret buf1 rdi &/bin/sh buf2 pop rdi puts@GOT puts() pop rdi buf2 gets() high low leave_ret rbp rsp buf2 buf1 pop rdi &/bin/sh /bin/sh system
Stack Migration !84 pop rdi ret system(“/bin/sh”) buf1 rdi &/bin/sh buf2 pop rdi puts@GOT puts() pop rdi buf2 gets() high low leave_ret rbp rsp buf2 buf1 pop rdi &/bin/sh /bin/sh system GET SHELL
Stack Migration • 若若能妥善利利⽤用，在沒有 libc 的情況下，有機會將整個 libc 給 dump 出來來， 更更有機會直接找出 system 的位置 • 無限 ROP ，幾乎可以做出所有事情，但唯⼀一要注意的是 buf ⼤大⼩小要控制 好，盡量量選 bss 後半段位置，否則可能因為 stack 不夠⼤大⽽而 segfault !85
Stack Migration • Other migration gadget • add rsp,0xNN ; ret • sub rsp,0xNN ; ret • ret 0xNN • xchg rsp,exx ; ret • partial overwrite rbp !86
Stack Migration !87 ret add rsp,0x30 ret you can’t control gadget rsp rop chain high low
Stack Migration !88 ret add rsp,0x30 ret you can’t control gadget rop chain high low rsp
Stack Migration !89 ret add rsp,0x30 ret you can’t control gadget rop chain high low rsp
Reference • http://www.slideshare.net/hackstuff/rop-40525248 !90
Q & A
Ad

Recommended

PDF
Linux Binary Exploitation - Heap Exploitation
Angel Boy
 
PDF
ROP 輕鬆談
hackstuff
 
PDF
Linux Binary Exploitation - Stack buffer overflow
Angel Boy
 
PDF
Heap exploitation
Angel Boy
 
PDF
Execution
Angel Boy
 
PDF
Advanced heap exploitaion
Angel Boy
 
PDF
Pwning in c++ (basic)
Angel Boy
 
PDF
Linux binary Exploitation - Basic knowledge
Angel Boy
 
PDF
Tcache Exploitation
Angel Boy
 
PDF
Play with FILE Structure - Yet Another Binary Exploit Technique
Angel Boy
 
PDF
Sigreturn Oriented Programming
Angel Boy
 
PDF
Binary exploitation - AIS3
Angel Boy
 
PDF
Windows 10 Nt Heap Exploitation (Chinese version)
Angel Boy
 
PDF
Windows 10 Nt Heap Exploitation (English version)
Angel Boy
 
PDF
TDOH x 台科 pwn課程
Weber Tsai
 
PDF
MacOS memory allocator (libmalloc) Exploitation
Angel Boy
 
PPT
Glibc malloc internal
Motohiro KOSAKI
 
PPTX
Introduction to Debuggers
Saumil Shah
 
PDF
台科逆向簡報
耀德 蔡
 
PDF
VerilatorとSystemC
Mr. Vengineer
 
PPT
Javaバイトコード入門
Kota Mizushima
 
PDF
InnoDB Locking Explained with Stick Figures
Karwin Software Solutions LLC
 
PDF
Modern Kernel Pool Exploitation: Attacks and Techniques
Michael Scovetta
 
PDF
twlkh-linux-vsyscall-and-vdso
Viller Hsiao
 
PDF
[若渴計畫] Challenges and Solutions of Window Remote Shellcode
Aj MaChInE
 
PPTX
[CEDEC2017] LINEゲームのセキュリティ診断手法
LINE Corporation
 
PDF
x86とコンテキストスイッチ
Masami Ichikawa
 
PDF
SSE4.2の文字列処理命令の紹介
MITSUNARI Shigeo
 
PDF
week5_giveup_pwn.pdf
ssuser83af16
 
PDF
Go Go Gadget! - An Intro to Return Oriented Programming (ROP)
Miguel Arroyo
 

More Related Content

What's hot (20)

PDF
Tcache Exploitation
Angel Boy
 
PDF
Play with FILE Structure - Yet Another Binary Exploit Technique
Angel Boy
 
PDF
Sigreturn Oriented Programming
Angel Boy
 
PDF
Binary exploitation - AIS3
Angel Boy
 
PDF
Windows 10 Nt Heap Exploitation (Chinese version)
Angel Boy
 
PDF
Windows 10 Nt Heap Exploitation (English version)
Angel Boy
 
PDF
TDOH x 台科 pwn課程
Weber Tsai
 
PDF
MacOS memory allocator (libmalloc) Exploitation
Angel Boy
 
PPT
Glibc malloc internal
Motohiro KOSAKI
 
PPTX
Introduction to Debuggers
Saumil Shah
 
PDF
台科逆向簡報
耀德 蔡
 
PDF
VerilatorとSystemC
Mr. Vengineer
 
PPT
Javaバイトコード入門
Kota Mizushima
 
PDF
InnoDB Locking Explained with Stick Figures
Karwin Software Solutions LLC
 
PDF
Modern Kernel Pool Exploitation: Attacks and Techniques
Michael Scovetta
 
PDF
twlkh-linux-vsyscall-and-vdso
Viller Hsiao
 
PDF
[若渴計畫] Challenges and Solutions of Window Remote Shellcode
Aj MaChInE
 
PPTX
[CEDEC2017] LINEゲームのセキュリティ診断手法
LINE Corporation
 
PDF
x86とコンテキストスイッチ
Masami Ichikawa
 
PDF
SSE4.2の文字列処理命令の紹介
MITSUNARI Shigeo
 
Tcache Exploitation
Angel Boy
 
Play with FILE Structure - Yet Another Binary Exploit Technique
Angel Boy
 
Sigreturn Oriented Programming
Angel Boy
 
Binary exploitation - AIS3
Angel Boy
 
Windows 10 Nt Heap Exploitation (Chinese version)
Angel Boy
 
Windows 10 Nt Heap Exploitation (English version)
Angel Boy
 
TDOH x 台科 pwn課程
Weber Tsai
 
MacOS memory allocator (libmalloc) Exploitation
Angel Boy
 
Glibc malloc internal
Motohiro KOSAKI
 
Introduction to Debuggers
Saumil Shah
 
台科逆向簡報
耀德 蔡
 
VerilatorとSystemC
Mr. Vengineer
 
Javaバイトコード入門
Kota Mizushima
 
InnoDB Locking Explained with Stick Figures
Karwin Software Solutions LLC
 
Modern Kernel Pool Exploitation: Attacks and Techniques
Michael Scovetta
 
twlkh-linux-vsyscall-and-vdso
Viller Hsiao
 
[若渴計畫] Challenges and Solutions of Window Remote Shellcode
Aj MaChInE
 
[CEDEC2017] LINEゲームのセキュリティ診断手法
LINE Corporation
 
x86とコンテキストスイッチ
Masami Ichikawa
 
SSE4.2の文字列処理命令の紹介
MITSUNARI Shigeo
 

Similar to Linux Binary Exploitation - Return-oritend Programing (20)

PDF
week5_giveup_pwn.pdf
ssuser83af16
 
PDF
Go Go Gadget! - An Intro to Return Oriented Programming (ROP)
Miguel Arroyo
 
PDF
Return Oriented Programming - ROP
Mihir Shah
 
DOCX
Report on hacking blind
NikitaAndhale
 
PDF
[cb22] Are Embedded Devices Ready for ROP Attacks? -ROP verification for low-...
CODE BLUE
 
PDF
Return Oriented Programming
UTD Computer Security Group
 
PPTX
Buffer overflow
Jacob Pimental
 
PDF
ROP
Jian-Yu Li
 
PDF
Advanced Arm Exploitation
Himanshu Khokhar Jaat
 
PPTX
NTUSTxTDOH 資訊安全基礎工作坊 基礎逆向教育訓練
Sheng-Hao Ma
 
PPTX
Return Oriented Programming (ROP) Based Exploits - Part I
n|u - The Open Security Community
 
PDF
That Goes Without Alpha-Num (or Does It ?) all your base10 are belong to us
takesako
 
PDF
Format String Vulnerability
Jian-Yu Li
 
PDF
AllBits presentation - Lower Level SW Security
AllBits BVBA (freelancer)
 
PDF
rop heap attacks cfi int overflows computer security
FannyBellows
 
PDF
Sergi Álvarez & Roi Martín - Radare2 Preview [RootedCON 2010]
RootedCON
 
PDF
Hacklu11 Writeup
nkslides
 
PDF
Introduction to Return-Oriented Exploitation on ARM64 - Billy Ellis
BillyEllis3
 
PDF
Course lecture - An introduction to the Return Oriented Programming
Jonathan Salwan
 
PDF
Exploitation Crash Course
UTD Computer Security Group
 
week5_giveup_pwn.pdf
ssuser83af16
 
Go Go Gadget! - An Intro to Return Oriented Programming (ROP)
Miguel Arroyo
 
Return Oriented Programming - ROP
Mihir Shah
 
Report on hacking blind
NikitaAndhale
 
[cb22] Are Embedded Devices Ready for ROP Attacks? -ROP verification for low-...
CODE BLUE
 
Return Oriented Programming
UTD Computer Security Group
 
Buffer overflow
Jacob Pimental
 
ROP
Jian-Yu Li
 
Advanced Arm Exploitation
Himanshu Khokhar Jaat
 
NTUSTxTDOH 資訊安全基礎工作坊 基礎逆向教育訓練
Sheng-Hao Ma
 
Return Oriented Programming (ROP) Based Exploits - Part I
n|u - The Open Security Community
 
That Goes Without Alpha-Num (or Does It ?) all your base10 are belong to us
takesako
 
Format String Vulnerability
Jian-Yu Li
 
AllBits presentation - Lower Level SW Security
AllBits BVBA (freelancer)
 
rop heap attacks cfi int overflows computer security
FannyBellows
 
Sergi Álvarez & Roi Martín - Radare2 Preview [RootedCON 2010]
RootedCON
 
Hacklu11 Writeup
nkslides
 
Introduction to Return-Oriented Exploitation on ARM64 - Billy Ellis
BillyEllis3
 
Course lecture - An introduction to the Return Oriented Programming
Jonathan Salwan
 
Exploitation Crash Course
UTD Computer Security Group
 
Ad

Recently uploaded (20)

PDF
Connecting Data and Intelligence: The Role of FME in Machine Learning
Safe Software
 
PDF
Quantum AI: Where Impossible Becomes Probable
Saikat Basu
 
PDF
Oh, the Possibilities - Balancing Innovation and Risk with Generative AI.pdf
Priyanka Aash
 
PDF
9-1-1 Addressing: End-to-End Automation Using FME
Safe Software
 
PDF
"Scaling in space and time with Temporal", Andriy Lupa.pdf
Fwdays
 
PPTX
CapCut Pro Crack For PC Latest Version {Fully Unlocked} 2025
pcprocore
 
PDF
Using the SQLExecutor for Data Quality Management: aka One man's love for the...
Safe Software
 
PDF
Raman Bhaumik - Passionate Tech Enthusiast
Raman Bhaumik
 
PDF
Lessons Learned from Developing Secure AI Workflows.pdf
Priyanka Aash
 
PDF
GenAI Opportunities and Challenges - Where 370 Enterprises Are Focusing Now.pdf
Priyanka Aash
 
PDF
Enhance GitHub Copilot using MCP - Enterprise version.pdf
Nilesh Gule
 
PPTX
"How to survive Black Friday: preparing e-commerce for a peak season", Yurii ...
Fwdays
 
PDF
AI vs Human Writing: Can You Tell the Difference?
Shashi Sathyanarayana, Ph.D
 
PDF
cnc-processing-centers-centateq-p-110-en.pdf
AmirStern2
 
PDF
Database Benchmarking for Performance Masterclass: Session 2 - Data Modeling ...
ScyllaDB
 
PPTX
Securing Account Lifecycles in the Age of Deepfakes.pptx
FIDO Alliance
 
PPTX
Security Tips for Enterprise Azure Solutions
Michele Leroux Bustamante
 
PDF
Securing AI - There Is No Try, Only Do!.pdf
Priyanka Aash
 
PDF
The Growing Value and Application of FME & GenAI
Safe Software
 
PDF
Cracking the Code - Unveiling Synergies Between Open Source Security and AI.pdf
Priyanka Aash
 
Connecting Data and Intelligence: The Role of FME in Machine Learning
Safe Software
 
Quantum AI: Where Impossible Becomes Probable
Saikat Basu
 
Oh, the Possibilities - Balancing Innovation and Risk with Generative AI.pdf
Priyanka Aash
 
9-1-1 Addressing: End-to-End Automation Using FME
Safe Software
 
"Scaling in space and time with Temporal", Andriy Lupa.pdf
Fwdays
 
CapCut Pro Crack For PC Latest Version {Fully Unlocked} 2025
pcprocore
 
Using the SQLExecutor for Data Quality Management: aka One man's love for the...
Safe Software
 
Raman Bhaumik - Passionate Tech Enthusiast
Raman Bhaumik
 
Lessons Learned from Developing Secure AI Workflows.pdf
Priyanka Aash
 
GenAI Opportunities and Challenges - Where 370 Enterprises Are Focusing Now.pdf
Priyanka Aash
 
Enhance GitHub Copilot using MCP - Enterprise version.pdf
Nilesh Gule
 
"How to survive Black Friday: preparing e-commerce for a peak season", Yurii ...
Fwdays
 
AI vs Human Writing: Can You Tell the Difference?
Shashi Sathyanarayana, Ph.D
 
cnc-processing-centers-centateq-p-110-en.pdf
AmirStern2
 
Database Benchmarking for Performance Masterclass: Session 2 - Data Modeling ...
ScyllaDB
 
Securing Account Lifecycles in the Age of Deepfakes.pptx
FIDO Alliance
 
Security Tips for Enterprise Azure Solutions
Michele Leroux Bustamante
 
Securing AI - There Is No Try, Only Do!.pdf
Priyanka Aash
 
The Growing Value and Application of FME & GenAI
Safe Software
 
Cracking the Code - Unveiling Synergies Between Open Source Security and AI.pdf
Priyanka Aash
 
Ad

Linux Binary Exploitation - Return-oritend Programing

  • 2. Outline • ROP • Using ROP bypass ASLR • Stack migration
  • 3. Outline • ROP • Using ROP bypass ASLR • Stack migration
  • 4. ROP • 透過 ret 去執⾏行行其他包含 ret 的程式碼片段 • 這些片段⼜又稱為 gadget
  • 5. ROP • Why do we need ROP ? • Bypass DEP • Static linking can do more thing
  • 6. ROP • ROP chain • 在夠長的 buffer overflow 後 stack 內容幾乎都由我們控制，我們可以藉由 ret = pop rip 指令，持續的控制 rip gadget2 1 gadget1 high low rsp retoverflow pop rax ret syscall gadget1 gadget2
  • 7. ROP • ROP chain • 在夠長的 buffer overflow 後 stack 內容幾乎都由我們控制，我們可以藉由 ret = pop rip 指令，持續的控制 rip gadget2 1 gadget1 high low rsp retoverflow pop rax ret syscall gadget1 gadget2
  • 8. ROP • ROP chain • 在夠長的 buffer overflow 後 stack 內容幾乎都由我們控制，我們可以藉由 ret = pop rip 指令，持續的控制 rip gadget2 1 gadget1 high low rsp retoverflow pop rax ret syscall gadget1 gadget2
  • 9. ROP • ROP chain • 在夠長的 buffer overflow 後 stack 內容幾乎都由我們控制，我們可以藉由 ret = pop rip 指令，持續的控制 rip gadget2 1 gadget1 high low rsp retoverflow pop rax ret syscall gadget1 gadget2
  • 10. ROP • ROP chain • 在夠長的 buffer overflow 後 stack 內容幾乎都由我們控制，我們可以藉由 ret = pop rip 指令，持續的控制 rip gadget2 1 gadget1 high low rsp retoverflow pop rax ret syscall gadget1 gadget2 exit
  • 11. ROP • ROP chain • 由眾多的 ROP gadget 組成 • 藉由不同的 register 及記憶體操作，呼叫 system call 達成任意代碼執⾏行行 • 基本上就是利利⽤用 ROP gadget 來來串串出我們之前寫的 shellcode 的效果
  • 12. ROP • Gadget • read/write register/memory • pop rax;pop rcx ; ret • mov [rax],rcx ; ret • system call • syscall • change rsp • pop rsp ; ret • leave ; ret
  • 13. ROP • Write to Register • pop reg ; ret • mov reg, reg ; ret • …
  • 14. ROP • Write to Register • let rax = 0xdead rbx = 0xbeef 0x401041 0xdead 0x4010fb high low rsp pop rax ret 0x401041 0xbeef pop rbx ret 0x4010fb 0 0 retoverflow rax rbx
  • 15. ROP • Write to Register • let rax = 0xdead rbx = 0xbeef 0x401041 0xdead 0x4010fb high low rsp pop rax ret 0x401041 0xbeef pop rbx ret 0x4010fb 0 0 retoverflow rax rbx
  • 16. ROP • Write to Register • let rax = 0xdead rbx = 0xbeef 0x401041 0xdead 0x4010fb high low rsppop rax ret 0x401041 0xbeef pop rbx ret 0x4010fb 0xdead 0 retoverflow rax rbx
  • 17. ROP • Write to Register • let rax = 0xdead rbx = 0xbeef 0x401041 0xdead 0x4010fb high low rsp pop rax ret 0x401041 0xbeef pop rbx ret 0x4010fb 0xdead 0 retoverflow rax rbx
  • 18. ROP • Write to Register • let rax = 0xdead rbx = 0xbeef 0x401041 0xdead 0x4010fb high low rsp pop rax ret 0x401041 0xbeef pop rbx ret 0x4010fb 0xdead 0xbeef retoverflow rax rbx
  • 19. ROP • Write to Memory • mov [reg],reg • mov [reg+xx], reg • …
  • 20. ROP • Write to Memory • let *0x602080 = 0xdeadbeef 0x40108a 0xdeadbeef 0x4010d1 high low rsp pop rax pop rbx ret 0x40108a 0xbeef mov [rax],rbx ret 0x4010d1 0 0 rax rbx 0x602080 0 0x602080 retoverflow
  • 21. ROP • Write to Memory • let *0x602080 = 0xdeadbeef 0x40108a 0xdeadbeef 0x4010d1 high low rsp pop rax pop rbx ret 0x40108a 0xbeef mov [rax],rbx ret 0x4010d1 0 0 rax rbx 0x602080 0 0x602080 retoverflow
  • 22. ROP • Write to Memory • let *0x602080 = 0xdeadbeef 0x40108a 0xdeadbeef 0x4010d1 high low rsp pop rax pop rbx ret 0x40108a 0xbeef mov [rax],rbx ret 0x4010d1 0x602080 0 rax rbx 0x602080 0 0x602080 retoverflow
  • 23. ROP • Write to Memory • let *0x602080 = 0xdeadbeef 0x40108a 0xdeadbeef 0x4010d1 high low rsp pop rax pop rbx ret 0x40108a 0xbeef mov [rax],rbx ret 0x4010d1 0x602080 0xdeadbeef rax rbx 0x602080 0 0x602080 retoverflow
  • 24. ROP • Write to Memory • let *0x602080 = 0xdeadbeef 0x40108a 0xdeadbeef 0x4010d1 high low rsp pop rax pop rbx ret 0x40108a 0xbeef mov [rax],rbx ret 0x4010d1 0x602080 0xdeadbeef rax rbx 0x602080 0 0x602080 retoverflow
  • 25. ROP • Write to Memory • let *0x602080 = 0xdeadbeef 0x40108a 0xdeadbeef 0x4010d1 high low rsp pop rax pop rbx ret 0x40108a 0xbeef mov [rax],rbx ret 0x4010d1 0x602080 0xdeadbeef rax rbx 0x602080 0xdeadbeef 0x602080 retoverflow
  • 26. ROP • execve(“/bin/sh”,NULL,NULL) • write to memory • 將 “/bin/sh” 寫入已知位置記憶體中 • 可分多次將所需字串串寫入記憶體中 /bin/das 0x602080 0x602088 hx00x00x00…
  • 27. ROP • execve(“/bin/sh”,NULL,NULL) • write to register • rax = 0x3b , rdi = address of “/bin/sh” • rsi = 0 , rdx = 0 • syscall
  • 28. ROP • find gadget • https://github.com/JonathanSalwan/ROPgadget
  • 29. ROP • find gadget • ROPgadget - - binary binary • ROPgadget - - ropchain - - binary binary • 在 Static linking 通常可以組成功 execve 的 rop chain 但通常都很長， 需要⾃自⼰己找更更短的 gadget 來來改短⼀一點
  • 30. Outline • ROP • Using ROP bypass ASLR • Stack migration
  • 31. Using ROP bypass ASLR • 假設 dynamic 編譯的程式中有 Buffer Overflow 的漏洞洞且在沒 PIE 情況下 ( 先不考慮 StackGuard 的情況） • How to bypass ASLR and DEP ? • Use .plt section to leak some information • ret2plt • 通常⼀一般的程式中都會有 put 、 send 、write 等 output function !31
  • 32. Using ROP bypass ASLR ret code stack high low rsp !32 put@plt pop rdi put@GOT pop rdi 0 pop rsi puts@GOT …… 0 rdi 0 rsi 0 rdx
  • 33. Using ROP bypass ASLR ret pop rdi
 ret code stack high low rsp !33 put@plt pop rdi put@GOT pop rdi 0 pop rsi puts@GOT …… 0 rdi 0 rsi 0 rdx
  • 34. Using ROP bypass ASLR ret pop rdi
 ret code stack high low rsp !34 put@plt pop rdi put@GOT pop rdi 0 pop rsi puts@GOT …… put@GOT rdi 0 rsi 0 rdx
  • 35. Using ROP bypass ASLR ret pop rdi
 ret put@plt code stack high low rsp !35 put@plt pop rdi put@GOT pop rdi 0 pop rsi puts@GOT …… put@GOT rdi 0 rsi 0 rdx
  • 36. Using ROP bypass ASLR ret pop rdi
 ret jmp *(put@GOT) code stack high low rsp !36 put@plt pop rdi put@GOT pop rdi 0 pop rsi puts@GOT …… put@GOT rdi 0 rsi 0 rdx
  • 37. Using ROP bypass ASLR ret pop rdi
 ret jmp put(put@GOT) code stack high low rsp !37 put@plt pop rdi put@GOT pop rdi 0 pop rsi puts@GOT …… put@GOT rdi 0 rsi 0 rdx
  • 38. Using ROP bypass ASLR ret pop rdi
 ret jmp put(put@GOT) code stack high low rsp !38 put@plt pop rdi put@GOT pop rdi 0 pop rsi puts@GOT …… put@GOT rdi 0 rsi 0 rdx Information leak
  • 39. Using ROP bypass ASLR ret pop rdi
 ret jmp put(put@GOT) ret code stack high low rsp !39 put@plt pop rdi put@GOT pop rdi 0 pop rsi puts@GOT …… put@GOT rdi 0 rsi 0 rdx
  • 40. Using ROP bypass ASLR ret pop rdi
 ret jmp put(put@GOT) ret pop rdi ret code stack high low rsp !40 put@plt pop rdi put@GOT pop rdi 0 pop rsi puts@GOT …… put@GOT rdi 0 rsi 0 rdx
  • 41. Using ROP bypass ASLR ret pop rdi
 ret jmp put(put@GOT) ret pop rdi ret code stack high low rsp !41 put@plt pop rdi put@GOT pop rdi 0 pop rsi puts@GOT …… 0 rdi 0 rsi 0 rdx
  • 42. Using ROP bypass ASLR ret pop rdi
 ret jmp put(put@GOT) ret pop rdi ret pop rsi ret code stack high low rsp !42 put@plt pop rdi put@GOT pop rdi 0 pop rsi puts@GOT …… 0 rdi 0 rsi 0 rdx
  • 43. Using ROP bypass ASLR ret pop rdi
 ret jmp put(put@GOT) ret pop rdi ret pop rsi ret code stack high low rsp !43 puts@GOT 0 rdi puts@GOT rsi 0 rdx pop rdx read@plt pop rdi Address of /bin/sh puts@plt 0x8
  • 44. Using ROP bypass ASLR ret pop rdx ret code stack high low rsp !44 puts@GOT 0 rdi puts@GOT rsi 0 rdx pop rdx read@plt pop rdi Address of /bin/sh puts@plt 0x8
  • 45. Using ROP bypass ASLR ret pop rdx ret code stack high low rsp !45 puts@GOT 0 rdi puts@GOT rsi 8 rdx pop rdx read@plt pop rdi Address of /bin/sh puts@plt 0x8
  • 46. Using ROP bypass ASLR ret pop rdx ret jmp read@plt code stack high low rsp !46 puts@GOT 0 rdi puts@GOT rsi 8 rdx pop rdx read@plt pop rdi Address of /bin/sh puts@plt 0x8
  • 47. Using ROP bypass ASLR ret pop rdx ret jmp read(0,put@GOT,8) code stack high low !47 puts@GOT 0 rdi puts@GOT rsi 8 rdx pop rdx read@plt pop rdi Address of /bin/sh puts@plt 0x8 rsp
  • 48. rsp Using ROP bypass ASLR ret pop rdx ret jmp read(0,put@GOT,8) code stack high low rsp !48 puts@GOT 0 rdi puts@GOT rsi 8 rdx pop rdx read@plt pop rdi Address of /bin/sh puts@plt 0x8 GOT Hijacking puts -> system
  • 49. Using ROP bypass ASLR ret pop rdx ret jmp read(0,put@GOT,8) ret code stack high low !49 puts@GOT 0 rdi puts@GOT rsi 8 rdx pop rdx read@plt pop rdi Address of /bin/sh puts@plt 0x8 rsp
  • 50. Using ROP bypass ASLR ret pop rdx ret jmp read(0,put@GOT,8) ret pop rdi ret code stack high low !50 puts@GOT 0 rdi puts@GOT rsi 8 rdx pop rdx read@plt pop rdi Address of /bin/sh puts@plt 0x8 rsp
  • 51. Using ROP bypass ASLR ret pop rdx ret jmp read(0,put@GOT,8) ret pop rdi ret code stack high low !51 puts@GOT &/bin/sh rdi puts@GOT rsi 8 rdx pop rdx read@plt pop rdi Address of /bin/sh puts@plt 0x8 rsp
  • 52. Using ROP bypass ASLR ret pop rdx ret jmp read(0,put@GOT,8) ret pop rdi ret jmp puts@plt code stack high low !52 puts@GOT &/bin/sh rdi puts@GOT rsi 8 rdx pop rdx read@plt pop rdi Address of /bin/sh puts@plt 0x8 rsp
  • 53. Using ROP bypass ASLR ret pop rdx ret jmp read(0,put@GOT,8) ret pop rdi ret jmp *(puts@GOT) code stack high low !53 puts@GOT &/bin/sh rdi puts@GOT rsi 8 rdx pop rdx read@plt pop rdi Address of /bin/sh puts@plt 0x8 rsp
  • 54. Using ROP bypass ASLR ret pop rdx ret jmp read(0,put@GOT,8) ret pop rdi ret jmp system(“/bin/sh”) code stack high low !54 puts@GOT &/bin/sh rdi puts@GOT rsi 8 rdx pop rdx read@plt pop rdi Address of /bin/sh puts@plt 0x8 rsp
  • 55. Using ROP bypass ASLR ret pop rdx ret jmp read(0,put@GOT,8) ret pop rdi ret jmp system(“/bin/sh”) code stack high low !55 puts@GOT &/bin/sh rdi puts@GOT rsi 8 rdx pop rdx read@plt pop rdi Address of /bin/sh puts@plt 0x8 rsp GET SHELL
  • 56. Using ROP bypass ASLR !56 • Bypass PIE • 必須比平常多 leak ⼀一個 code 段的位置，藉由這個值算出 code base 進 ⽽而推出所有 GOT 等資訊 • 有了了 code base 之後其他就跟沒有 PIE 的情況下⼀一樣
  • 57. Using ROP bypass ASLR !57 • Bypass StackGuard • canary 只有在 function return 時做檢查 • 只檢查 canary 值時否⼀一樣 • 所以可以先想辦法 leak 出 canary 的值，塞⼀一模⼀一樣的內容就可 bypass，或是想辦法不要改到 canary 也可以
  • 58. Using ROP bypass ASLR !58 • Weakness in fork • canary and memory mappings are same as parent.
  • 59. Outline • ROP • Using ROP bypass ASLR • Stack migration
  • 60. Stack Migration • 將 ROP Chain 寫在已知固定位置上 • 再利利⽤用 leave 搬移 Stack 位置到已知位置 • 可無限接 ROP Chain • 必須注意到 Migration 之後 stack 要留留⼤大⼀一點，有些 function 可能會需要很 ⼤大的 stack frame ，太⼩小可能會存取到唯獨區域，導致 Segmentation Fault !60
  • 61. Stack Migration !61 return address rbp rbp/rsp push rbp mov rbp,rsp … leave ret high low
  • 62. Stack Migration !62 buf1 rbp push rbp mov rbp,rsp … leave ret aaaa aaaa rsp gets() buf1 high low buf1 leave_ret pop rdi
  • 63. Stack Migration !63 buf1 push rbp mov rbp,rsp … leave ret aaaa aaaa rsp gets() buf1 buf1 leave_ret leave = mov rsp,rbp ; pop rbp rbp pop rdi high low
  • 64. Stack Migration !64 buf1 rbp/rsp push rbp mov rbp,rsp … leave ret aaaa aaaa gets() buf1 buf1 leave_ret leave = mov rsp,rbp ; pop rbp pop rdi high low
  • 65. Stack Migration !65 buf1 rsp push rbp mov rbp,rsp … leave ret aaaa aaaa gets() buf1 buf1 leave_ret rbp pop rdi high low
  • 66. Stack Migration !66 buf1 rsp push rbp mov rbp,rsp … leave ret pop rdi
 ret aaaa aaaa gets() buf1 buf1 leave_ret pop rdi rdi 0 high low rbp
  • 67. Stack Migration !67 buf1 rsppush rbp mov rbp,rsp … leave ret pop rdi
 ret aaaa aaaa gets() buf1 buf1 leave_ret pop rdi rdi buf1 high low rbp
  • 68. Stack Migration !68 buf1 rsp push rbp mov rbp,rsp … leave ret pop rdi
 ret gets(buf1) aaaa aaaa gets() buf1 buf1 leave_ret pop rdi rdi buf1 high low rbp
  • 69. Stack Migration !69 buf1 rsp push rbp mov rbp,rsp … leave ret pop rdi
 ret gets(buf1) ret aaaa aaaa gets() buf1 buf1 leave_ret rbp pop rdi rdi buf1 buf2 pop rdi puts@GOT puts() pop rdi buf2 gets() high low leave_ret
  • 70. Stack Migration !70 buf1 rsp leave
 ret aaaa aaaa gets() buf1 buf1 leave_ret pop rdi rdi buf1 buf2 pop rdi puts@GOT puts() pop rdi buf2 gets() high low leave_ret leave = mov rsp,rbp ; pop rbp rbp
  • 72. Stack Migration !72 pop rdi
 ret buf1 rdi buf1 buf2 pop rdi puts@GOT puts() pop rdi buf2 gets() high low leave_ret rsp rbp buf2
  • 73. Stack Migration !73 pop rdi
 ret buf1 rdi puts@GOT buf2 pop rdi puts@GOT puts() pop rdi buf2 gets() high low leave_ret rbp buf2 rsp
  • 74. Stack Migration !74 pop rdi
 ret puts(puts@GOT) ret buf1 rdi puts@GOT buf2 pop rdi puts@GOT puts() pop rdi buf2 gets() high low leave_ret rsp rbp buf2 Information leakage
  • 75. Stack Migration !75 pop rdi
 ret puts(puts@GOT) ret buf1 rdi puts@GOT buf2 pop rdi puts@GOT puts() pop rdi buf2 gets() high low leave_ret rsp rbp buf2
  • 76. Stack Migration !76 pop rdi
 ret buf1 rdi puts@GOT buf2 pop rdi puts@GOT puts() pop rdi buf2 gets() high low leave_ret rsp rbp buf2
  • 77. Stack Migration !77 pop rdi
 ret buf1 rdi buf2 buf2 pop rdi puts@GOT puts() pop rdi buf2 gets() high low leave_ret rsp rbp buf2
  • 78. Stack Migration !78 pop rdi
 ret gets(buf2) ret buf1 rdi buf2 buf2 pop rdi puts@GOT puts() pop rdi buf2 gets() high low leave_retrsp rbp buf2
  • 79. Stack Migration !79 pop rdi
 ret gets(buf2) ret buf1 rdi buf2 buf2 pop rdi puts@GOT puts() pop rdi buf2 gets() high low leave_retrsp rbp buf2 buf1 pop rdi &/bin/sh /bin/sh system
  • 80. Stack Migration !80 pop rdi
 ret gets(buf2) ret leave ret buf1 rdi buf2 buf2 pop rdi puts@GOT puts() pop rdi buf2 gets() high low leave_retrsp rbp buf2 buf1 pop rdi &/bin/sh /bin/sh system leave = mov rsp,rbp ; pop rbp
  • 81. Stack Migration !81 pop rdi
 ret gets(buf2) ret leave ret buf1 rdi buf2 buf2 pop rdi puts@GOT puts() pop rdi buf2 gets() high low leave_ret rbp rsp buf2 buf1 pop rdi &/bin/sh /bin/sh system
  • 82. Stack Migration !82 pop rdi
 ret buf1 rdi buf2 buf2 pop rdi puts@GOT puts() pop rdi buf2 gets() high low leave_ret rbp rsp buf2 buf1 pop rdi &/bin/sh /bin/sh system
  • 83. Stack Migration !83 pop rdi
 ret buf1 rdi &/bin/sh buf2 pop rdi puts@GOT puts() pop rdi buf2 gets() high low leave_ret rbp rsp buf2 buf1 pop rdi &/bin/sh /bin/sh system
  • 84. Stack Migration !84 pop rdi ret system(“/bin/sh”) buf1 rdi &/bin/sh buf2 pop rdi puts@GOT puts() pop rdi buf2 gets() high low leave_ret rbp rsp buf2 buf1 pop rdi &/bin/sh /bin/sh system GET SHELL
  • 85. Stack Migration • 若若能妥善利利⽤用，在沒有 libc 的情況下，有機會將整個 libc 給 dump 出來來， 更更有機會直接找出 system 的位置 • 無限 ROP ，幾乎可以做出所有事情，但唯⼀一要注意的是 buf ⼤大⼩小要控制 好，盡量量選 bss 後半段位置，否則可能因為 stack 不夠⼤大⽽而 segfault !85
  • 86. Stack Migration • Other migration gadget • add rsp,0xNN ; ret • sub rsp,0xNN ; ret • ret 0xNN • xchg rsp,exx ; ret • partial overwrite rbp !86
  • 91. Q & A