ARM buffer overflow: chapter 3 ಠ-ಠ (day 64)

 

 
In this post, we are going to take a look at how to do ret2libc in ARM architecture. As you guys are aware that in the previous blog, I already talk about how to approach this technique in x86 architecture by just reusing the libc library used by the program and to be honest the concept of the attack itself is unchanged despite different of architecture so you will not be having a problem implementing this.

The only thing that is different is how you set up the stack so it can jump to the right function.

ok let's begin

for this demonstration, I'm gonna use the source code of roplevel2 file from https://github.com/Billy-Ellis/Exploit-Challenges (you guys might also want to check it's youtube channel it's really great to learn more about IOS pentesting)

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>

char string[] = "date";

void change(){
   
    strcpy(string,"ls");
    printf("string changed.\n");

}

void secret(){

    printf("executing string...\n");
   
    system(string);
}

int main(){

    printf("Welcome to ROPLevel1 for ARM! Created by Billy Ellis (@bellis1000)\n");

    char buff[12];
    gets(buff);

    return 0;
}

Don't forget to turn off your ASLR and compile this source code with the following flag:

~# gcc roplevel2.c -o roplevel2 -fno-stack-protector --no-pie

if you guys curious about what kind of environment that I used for this post, I used the azeria labs vm. The following vm is already equipped with all of the necessary tools to aid your exploitation in ARM (link: https://azeria-labs.com/arm-lab-vm/)

First, we need to crash the program and determine how much of offset that we need to overwrite the $sp register, remember in ARM register that point to the current stack is $sp, not $eip

If you using the azeria labs vm you probably just straight away to use GEF to generate the string, you can do that but I prefer to use this (link: https://github.com/ickerwx/pattern)

why?

because sometimes the result is not really accurate and it drives me nut



open up the binary in GEF and enter the long string to crash the application. Eventually, it will crash and takes a look at the sp register it was overwritten with the string that we just input






cool! so we need 20 offsets to overwrite the sp register.

Now, this where we need to start crafting our payload. As you guys know we need two things in order to execute ret2libc the system function location and the string that is going to be executed.

for the system function address, there are two values that you can use, the first address as you notice from the source code that is already provided or you can search it from the binary using the following command:

~# p &system

the second is the string that we will represent as the command that we want to execute as you notice again from the source code provided at the beginning of the post there is three global variables that contains several bash commands. You can determine the location of this variable by using objdump utility:

~# objdump  -t roplevel2





the address of the global variable is at the most left column in the result above

so we have this two-component next is to set the stack. Unlike x86, we need to used ROPgadget to set up the stack in ARM. In ARM the parameter is set according to register r0-r3 (param1-param3)

since system function only need one function so we need to find the ropgadget that contains the following command:

~# pop{r0,pc}

by using this ROP gadget we can set the first parameter along with its function

to retrieve the gadget I used the ropgadget script inside the azeria-labs host

~# ROPGadget --binary roplevel2




so using this information we can craft the exploit with the following python script:



so we set the payload like this:

padding + ropgadget + "bash_command" + system function

the payload first overwrite the sp register and redirect it to our ROP gadget which is pop{r0,pc} when the program executes this command it will look at the two most top value at the stack and assign this two value to register r0 and pc, here you can see we set the next two instruction to hold the address of bash command string and system function address

so after the execution of the ROP gadget, the program will redirect it's execution to the system function with parameter "uname -a"



you can play with the parameter of course so it will give a different result like this:



cool! so in this tutorial, we successfully do a ret2libc exploitation

Hope this help :)

see you at the next arm buffer overflow series