Back again with another ARM buffer overflow, this post will pick up what we left in the previous post. Last time, we talk about how to bypass NX protection that changes stack region permission into non-executable by constructing ROP in our exploit and we can see that using one anti-exploit mechanism may not be really effective and we need to add a couple of additional protection to make it more reliable.
One of the additional protection that usually emphasizes in binary along with NX is ASLR that stands for Address Space Layout Randomization.
ASLR is responsible to make the address of used by the program to be randomized this could bring trouble for us since in the previous chapter we always hardcoded our ROP into the payload.
Although ASLR and NX is a pretty good combination in circumventing exploit we can still bypass this two protection together, by:
- Information leak, this is basically taking advantage of another vulnerability that let us have information about the current state of the memory. We are going to cover this approach in the next post
- Brute Force, we basically just guess the address until we got the right location. In this post, we are going to use brute force to bypass ASLR protection
#include <stdio.h>
#include <string.h>
#include <stdlib.h>
#include <unistd.h>
char find_me[] = "/bin/bash";
void gadget1(){
__asm__("pop {r0,pc}");
}
void crash_me(){
char name[16];
printf("Enter your name:\n");
scanf("%s",name);
printf("Welcome, %s!\n",name);
}
int main(){
printf("\x1B[35m================================================\n");
printf("Welcome to ROPLevel4 by williams\n");
printf("================================================\x1B[0m\n\n");
crash_me();
return 0;
if you follow the previous post, you can guess we can just basically chain the gadget in function gadget1() with the string "/bin/sh" in global variable named find_me as the r0 and for pc we can use the address of system in libc. But since the ASLR is on we cannot determine where exactly is the system function reside in the memory.
compile the code with this parameter:
~# gcc roplevel4.c -o roplevel4 -fno-stack-protector
and load into gef, run checksec to make sure is compiled the way we expected
the last thing we need to do is to turn on the ASLR module in the machine
to turn on the ASLR you need to have root privilege. Check if aslr is on by using this command:
take a look at the base address showed in libc.so.6 we can see that every time we execute the command the value is changed
we are set to go :)
First, we need to found out how many offsets we need to crash the program and to take control of the PC register.
attach gef to the program and put a long pattern of string and once it is crash we can see that it need 20 bytes of offset to crash the program
Next, we need to find the location of "/bin/bash" string and gadget address in the code. We don't need to worry about ASLR since it will not randomize the code from the program
From this information, we can continue to create python script to craft our exploit
Another important note, we don't need to worry about the \x00 character used by the address since scanf only stop to receive string if it encounters whitespace or newline character
so the last piece of the puzzle that we need to find out is what value we need to put in the system_function variable that will point to system address in the binary. As I mentioned earlier ASLR produce random memory that has low entropy we can analyze this by "set disable-randomization off" in gef and run it couple of time
from this result, we can see that ASLR only randomizes two bytes of the function this leads us to 1/256 possibility and that's not really big number.
we can just try to use one of these addresses and run a loop until we can execute a shell command.
run the script by ~# bash ex.sh and it may take a couple of seconds until it finds the right address
cool :) so we got the right after a couple of iteration.
That's all folks and I hope you enjoy this post wee you next time at the next arm buffer overflow series
Comments
Post a Comment