Ret2libc (ﾉ◕ヮ◕)ﾉ*:･ﾟ✧ (day 38)

I have a lot of fun playing with protostar machine to pop a shell and getting a root privileges. But all of the executable in the machine is designed to be vulnerable, it doesn't contain NX or ASLR protection which is not depict a real world scenario. Time to go further and learn new things

In level 6 protostar, which goes like this:

#include <stdlib.h>
#include <unistd.h>
#include <stdio.h>
#include <string.h>

void getpath()
{
  char buffer[64];
  unsigned int ret;

  printf("input path please: "); fflush(stdout);

  gets(buffer);

  ret = __builtin_return_address(0);

  if((ret & 0xbf000000) == 0xbf000000) {
    printf("bzzzt (%p)\n", ret);
    _exit(1);
  }

  printf("got path %s\n", buffer);
}

int main(int argc, char **argv)
{
  getpath();
}

so the objective is still the same, we are expected to pop a shell from this program but if you take a look at the getpath function there is a if condition statement that goes like this:

 (ret & 0xbf000000) == 0xbf000000

the code is do an AND operation to "ret" variable that contain the program return address (__builtin_return_address(0) uses to provide you the return address of the program)

if its equal to 0xbf000000 it will exit the program, ok let's try to dig deep even more about what is the meaning of this if statement.

ok first of all the program still give us a segmentation fault and it need 80 bytes offset to replace the EIP register and if we try again by adding 4 bytes after the padding it will replace the EIP.

so let's analyze where we can put our shellcode in the stack by dumping the ESP register.

I'm going to use the address of 0xbffff6aa as the new EIP register. But something interesting happen to the program when we try to fill the EIP to that address.

It looks like we hit the if check in getpath function and if you try to replicate this program in python and use the value 0xbffff6aa it is actually going to return True.

So basically the if statement is a defense mechanism for the program if the EIP is return to the address of the stack it will exit the program


 This is really cool finally we are able to find some program that have defense mechanism on it.

so how do we beat this mechanism ?

well according to challenge

"This level can be done in a couple of ways, such as finding the duplicate of the payload ( objdump -s will help with this), or ret2libc , or even return orientated programming."

in this post we are going to use ret2libc

so what is ret2libc ?

it is abbreviation from return to libc. To all of you who like to program in C may be already familiar with libc library, this library provide all the fundamental C function (libc is known standard C library) when you create C program.

so the idea behind ret2libc is that why you want to writ shellcode when there is plenty of useful functions such as "system()" residing in C library already ? 

thus all we have to do know is to find the address of this three component:

1. system() function address to running shell command
2. exit() function to exit the function
3. "/bin/sh" to spawn a shell

the two first information can be obtained by using the "p" function inside the GDB. Don't worry about the difference of the address the location inside and outside of the GDB is still the same.

 cool ! we got the first two address really easy. Let's try to find the address of /bin/sh. 

to find the offset of the "/bin/sh" you can use strings utility in linux:

next try to dump the processor mapping in the program:

we can see that the list of address of the lib, I choose the 0xb7e90000 address since it's the start the address of the lib.

we need this two address to find out the location of "/bin/sh"

by gathering all this three components we can create a script like this:

cool we got a shell tho :D

Enjoy i hope you guys like this post