Reiterate the Concept of Ret2libc + defeating ASLR ◉_◉ (day 49)

In the previous post about ret2libc, we found out that attackers can bypass the NX protection by just combining their payload with other functions in libc library to able to gain control of the program.

but we are able to pop a shell because the ASLR is on, can we still do it if it's on ?

sure you can!

so in this post, I will show you how to escalate ret2libc into bypassing ASLR

note: the following binary is not protected with PIE, this means every time the code is loaded the instruction register is not changing

 

for the demonstration, I will use the binary split 32 bit from ROPemporium (https://ropemporium.com/)

from the figure above we can see that the binary is pretty simple, it asks you about input and it doesn't show anything yet, a classic BOF !

when we check all the functions we can see functions name "pwnme" this can be a clue to start our exploit.

when we disassemble the function we can see that the fgets functions set the buffer in the wrong size and we can prove it by putting a large buffer into the program

from crashing the program we can see that it takes 44 offsets to overwrite the EIP

In typical ret2libc exploit, from here you need to find system, exit and bin/sh location put it together and you will get a shell but you guys need to remember that the ASLR is on it means that the location of this function will surely change every time we run

so how do we make our code to adapt to the ASLR? we can use ret2puts approach the concept of it is merely the same as ret2libc but instead combine it with system function to pop a shell, we use puts function to dump the libc address

if you take a look at the main function there is plenty of puts function we can use but notice the call address is end up same which is in this case 0x8048420

when we analyze the function here we can see it is pointing to the GOT table which reveals the actual address of the function in the program.

note: you need to be able to distinguish PLT and GOT in ELF. GOT use for mapping the function address whereas PLT is just a stub function that pointing to the GOT table

from here we can craft our payload to be like this:

payload = puts@function + main@function + puts@GOT

• puts@function is the function that we will call
• main@function is the return function so after the puts execute its task it will be back to the main again
• puts@GOT is the param for function puts

when we run this payload this will dump the puts location in libc and we can use this value to be subtracted with the relative address of puts function in the program. The result of this calculation will give you the libc address in the OS

cool! so we got the "puts" function in libc in realtime, now all we have to do is to subtract this value with the relative address of "puts" in the function program like this.

to get the relative address of "puts" you can do it like the below picture.

cool now we can get the rest of the payload (system, exit, "/bin/sh")

combine with all of the information we get and we should update our script like this:

run the script and we got a shell :) cool! we able to bypass NX and ASLR at the same time :D