who doesn't like pwntools? it is a very versatile tool and can be customized according to our need using the python script but did you need to know that pwntools itself can help us to automatically craft a rop chain for us?
so in this post, I will show you how to make rop chain less painful and make pwntools do all the heavy lifting. To demonstrate this I will use the binary challenge callme 64 bit from ropemporium
link: https://ropemporium.com/challenge/callme.html
Crashing the app:
Like any other exploitation process, we need to crash the program by generating a long string pattern to determine the offset.
based on the information from the above figure we can see that we required to provide 40 bytes of offset
Fun stuff:
now this where the fun stuff beganwrite the following python script:
as in the guideline of the challenged said we need to chain the function call by first to call the callme_one function, callme_two function and then callme_three function in sequential order and then when calling each of the function we need to pass argument 1,2,3
so roughly the function call should be like this:
callme_one(1,2,3) -> callme_two(1,2,3) -> callme_three(1,2,3)
pwntools make it easier to search these functions by passing the binary as an ELF object and we can determine the location by using elf.sym function followed by the name of the function.
next in order to generate a rop chain we need to create a rop object from pwntools by passing the elf object that we just created earlier from the binary to ROP() function
the result of the python script will be like this:
cool so all we need to do is craft the rop chain
to craft the rop chain we can use the .call from pwntools function, the first parameter specify the function that we want to call and the second parameter which is the parameters of the function we need to passed the value with an array type. Then we can continue to chain it with multiple function by calling .call function again the next line
Don't worry about the rop gadget that used to pass the value into register, pwntools already take care of that. Please be aware, that we are exploiting 64-bit program all the parameter of the function is passed through a register (rdi,rsi,rdx...)
last is to combine the rop chain with padding to take control of the program execution.
let's try to debug the program execution to check if it's run as the way we expected.
here you can see in the stack section the pwntools automatically identify the right gadgets ( pop rdi, pop rsi, pop rdx) from usefulGadgets function to pass the parameters into the register and combine it with the rest of function that we craft.
now if you using ubuntu 18.04 or any newer version you will encounter vprintf segfault since the stack alignment is not quite right
in order to overcome this problem we just need to pass return gadget before rop chaining begun like this:
as you may notice 0x401ab3 address just contain "RETN" instruction
if you run it again you will get the flag :)
That's all folks and I hope you enjoy this post :)
Comments
Post a Comment