# Mbinu ya Msingi ya Uchunguzi wa Binary

<details>

<summary><strong>Jifunze kuhusu kudukua AWS kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)</strong></a><strong>!</strong></summary>

Njia nyingine za kusaidia HackTricks:

* Ikiwa unataka kuona **kampuni yako ikitangazwa kwenye HackTricks** au **kupakua HackTricks kwa PDF** Angalia [**MIPANGO YA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
* Pata [**bidhaa rasmi za PEASS & HackTricks**](https://peass.creator-spring.com)
* Gundua [**Familia ya PEASS**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa kipekee wa [**NFTs**](https://opensea.io/collection/the-peass-family)
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.

</details>

## Taarifa Msingi za ELF

Kabla ya kuanza kutumia mbinu yoyote ni muhimu kuelewa sehemu ya muundo wa binary ya ELF:

{% content-ref url="elf-tricks.md" %}
[elf-tricks.md](elf-tricks.md)
{% endcontent-ref %}

## Zana za Kudukua

{% content-ref url="tools/" %}
[zana](tools/)
{% endcontent-ref %}

## Mbinu ya Kujaza Stack

Kutokana na mbinu nyingi ni vizuri kuwa na mpango ambapo kila mbinu itakuwa na manufaa. Kumbuka kwamba kinga sawa zitaathiri mbinu tofauti. Unaweza kupata njia za kuzidi kinga kwenye kila sehemu ya kinga lakini sio katika mbinu hii.

## Kudhibiti Mzunguko

Kuna njia tofauti unaweza kumaliza kudhibiti mzunguko wa programu:

* [**Kujaza Stack**](../stack-overflow/) kwa kubadilisha kiashiria cha kurudi kutoka kwenye stack au EBP -> ESP -> EIP.
* Inaweza kuhitaji kutumia [**Kujaza Nambari**](../integer-overflow.md) kusababisha kujaa
* Au kupitia **Andika Nini Wapi hadi Utekelezaji**
* [**Vidokezo vya Format**](../format-strings/)**:** Tumia `printf` kuandika maudhui yoyote kwenye anwani za aina yoyote.
* [**Uainishaji wa Array**](../array-indexing.md): Tumia uainishaji uliopangwa vibaya kuweza kudhibiti baadhi ya mizunguko na kupata andika ya aina yoyote.
* Inaweza kuhitaji kutumia [**Kujaza Nambari**](../integer-overflow.md) kusababisha kujaa
* **bof hadi WWW kupitia ROP**: Tumia kujaza kijazo ili kujenga ROP na kuweza kupata WWW.

Unaweza kupata mbinu za **Andika Nini Wapi hadi Utekelezaji** katika:

{% content-ref url="../arbitrary-write-2-exec/" %}
[arbitrary-write-2-exec](../arbitrary-write-2-exec/)
{% endcontent-ref %}

## Mzunguko wa Milele

Jambo la kuzingatia ni kwamba kawaida **kudukua mara moja tu kwa udhaifu huenda isiwe ya kutosha** kutekeleza kudukua yenye mafanikio, hasa baadhi ya kinga zinahitaji kuzidiwa. Kwa hivyo, ni muhimu kujadili chaguzi kadhaa za **kufanya udhaifu mmoja uweze kudukuliwa mara kadhaa** katika utekelezaji huo wa binary:

* Andika kwenye mnyororo wa **ROP** anwani ya **`main` function** au kwenye anwani ambapo **udhaifu** unatokea.
* Kwa kudhibiti mnyororo sahihi wa ROP unaweza kufanya vitendo vyote katika mnyororo huo
* Andika anwani ya **`exit` kwenye GOT** (au kazi nyingine yoyote inayotumiwa na binary kabla ya kumaliza) anwani ya kurudi **nyuma kwa udhaifu**
* Kama ilivyoelezwa katika [**.fini\_array**](../arbitrary-write-2-exec/www2exec-.dtors-and-.fini\_array.md#eternal-loop)**,** hifadhi hapa 2 kazi, moja kuita tena udhaifu na nyingine kuita**`__libc_csu_fini`** ambayo itaita tena kazi kutoka `.fini_array`.

## Malengo ya Kudukua

### lengo: Piga simu kwa Kazi Iliyopo

* [**ret2win**](./#ret2win): Kuna kazi katika nambari unayohitaji kupiga simu (labda na baadhi ya parameta maalum) ili kupata bendera.
* Katika bof ya kawaida bila [**PIE**](../common-binary-protections-and-bypasses/pie/) **na** [**canary**](../common-binary-protections-and-bypasses/stack-canaries/) unahitaji tu kuandika anwani kwenye anwani ya kurudi iliyohifadhiwa kwenye stack.
* Katika bof na [**PIE**](../common-binary-protections-and-bypasses/pie/), utahitaji kuzidi kinga hiyo
* Katika bof na [**canary**](../common-binary-protections-and-bypasses/stack-canaries/), utahitaji kuzidi kinga hiyo
* Ikiwa unahitaji kuweka vigezo kadhaa kuita kazi ya **ret2win** kwa usahihi unaweza kutumia:
* Mnyororo wa [**ROP**](./#rop-and-ret2...-techniques) **ikiwa kuna vifaa vya kutosha** kuandaa vigezo vyote
* [**SROP**](../rop-return-oriented-programing/ret2esp-ret2reg/srop-sigreturn-oriented-programming.md) (ikiwa unaweza kupiga simu ya syscall hii) kudhibiti usajili mwingi
* Vifaa kutoka [**ret2csu**](../rop-return-oriented-programing/ret2csu.md) kudhibiti usajili kadhaa
* Kupitia [**Andika Nini Wapi hadi Utekelezaji**](../arbitrary-write-2-exec/) unaweza kutumia udhaifu mwingine (si bof) kuita kazi ya **`win`**.
* [**Kuongeza Viashiria**](../stack-overflow/pointer-redirecting.md): Ikiwa stack ina viashiria kwa kazi itakayoitwa au kwa herufi itakayotumiwa na kazi ya kuvutia (mfumo au printf), inawezekana kubadilisha anwani hiyo.
* [**ASLR**](../common-binary-protections-and-bypasses/aslr/) au [**PIE**](../common-binary-protections-and-bypasses/pie/) inaweza kuathiri anwani.
* [**Vigezo visivyoanzishwa**](../stack-overflow/uninitialized-variables.md): Kamwe hujui.

### lengo: RCE

#### Kupitia shellcode, ikiwa nx imelemazwa au kuchanganya shellcode na ROP:

* [**(Stack) Shellcode**](./#stack-shellcode): Hii ni muhimu kuhifadhi shellcode kwenye stack kabla au baada ya kubadilisha kiashiria cha kurudi na kisha **kuhamia kwake** kuitekeleza:
* **Katika kesi yoyote, ikiwa kuna** [**canary**](../common-binary-protections-and-bypasses/stack-canaries/)**,** katika bof ya kawaida utahitaji kuzidi (kuvuja) hiyo
* **Bila** [**ASLR**](../common-binary-protections-and-bypasses/aslr/) **na** [**nx**](../common-binary-protections-and-bypasses/no-exec-nx.md) ni rahisi kuhama kwenye anwani ya stack kwani haitabadilika kamwe
* **Na** [**ASLR**](../common-binary-protections-and-bypasses/aslr/) utahitaji mbinu kama [**ret2esp/ret2reg**](../rop-return-oriented-programing/ret2esp-ret2reg/) kuhama kwake
* **Na** [**nx**](../common-binary-protections-and-bypasses/no-exec-nx.md), utahitaji kutumia baadhi ya [**ROP**](../rop-return-oriented-programing/) **kupiga simu kwa `memprotect`** na kufanya ukurasa fulani uwe `rwx`, ili kisha **hifadhi shellcode hapo** (kupiga simu kwa kusoma kwa mfano) na kisha hama hapo.
* Hii itachanganya shellcode na mnyororo wa ROP.
#### Kupitia syscalls

* [**Ret2syscall**](../rop-return-oriented-programing/rop-syscall-execv.md): Inatumika kuita `execve` ili kukimbia amri za aina yoyote. Unahitaji kuweza kupata **gadgets za kuita syscall maalum na parameta**.
* Ikiwa [**ASLR**](../common-binary-protections-and-bypasses/aslr/) au [**PIE**](../common-binary-protections-and-bypasses/pie/) zimeanzishwa utahitaji kuzishinda **ili kutumia ROP gadgets** kutoka kwenye binary au maktaba.
* [**SROP**](../rop-return-oriented-programing/ret2esp-ret2reg/srop-sigreturn-oriented-programming.md) inaweza kuwa na manufaa kwa kujiandaa kwa **ret2execve**

#### Kupitia libc

* [**Ret2lib**](../rop-return-oriented-programing/ret2lib/): Inatumika kuita kazi kutoka kwenye maktaba (kawaida kutoka kwa **`libc`**) kama vile **`system`** na baadhi ya hoja zilizoandaliwa (k.m. `'/bin/sh'`). Unahitaji binary ili **ipakie maktaba** na kazi unayotaka kuita (kawaida libc).
* Ikiwa **imekompiliwa tuli na hakuna** [**PIE**](../common-binary-protections-and-bypasses/pie/), **anwani** ya `system` na `/bin/sh` haitabadilika, hivyo ni rahisi kuzitumia tuli.
* **Bila** [**ASLR**](../common-binary-protections-and-bypasses/aslr/) **na kujua toleo la libc** lililopakiwa, **anwani** ya `system` na `/bin/sh` haitabadilika, hivyo ni rahisi kuzitumia tuli.
* Pamoja na [**ASLR**](../common-binary-protections-and-bypasses/aslr/) **lakini bila** [**PIE**](../common-binary-protections-and-bypasses/pie/), kwa kujua libc na kwa binary kutumia kazi ya `system` ni rahisi **`ret` kwenye anwani ya system kwenye GOT** na anwani ya `'/bin/sh'` kwenye parameta (utahitaji kufikiria hili).
* Pamoja na [ASLR](../common-binary-protections-and-bypasses/aslr/) lakini bila [PIE](../common-binary-protections-and-bypasses/pie/), kwa kujua libc na **bila binary kutumia kazi ya `system`**:
* Tumia [**`ret2dlresolve`**](../rop-return-oriented-programing/ret2dlresolve.md) kutatua anwani ya `system` na kuipiga simu&#x20;
* **Zuia** [**ASLR**](../common-binary-protections-and-bypasses/aslr/) na kuhesabu anwani ya `system` na `'/bin/sh'` kwenye kumbukumbu.
* **Pamoja na** [**ASLR**](../common-binary-protections-and-bypasses/aslr/) **na** [**PIE**](../common-binary-protections-and-bypasses/pie/) **na bila kujua libc**: Unahitaji:
* Zuia [**PIE**](../common-binary-protections-and-bypasses/pie/)
* Pata **toleo la `libc`** lililotumiwa (vuja anwani kadhaa za kazi)
* Angalia **hali za awali za ASLR** ili kuendelea.

#### Kupitia EBP/RBP

* [**Stack Pivoting / EBP2Ret / EBP Chaining**](../stack-overflow/stack-pivoting-ebp2ret-ebp-chaining.md): Dhibiti ESP ili kudhibiti RET kupitia EBP iliyohifadhiwa kwenye stack.
* Ina manufaa kwa **kuzidi kidogo** kwenye stack
* Ina manufaa kama njia mbadala ya kumaliza kudhibiti EIP wakati wa kutumia EIP kujenga mzigo wa data kwenye kumbukumbu na kisha kuruka kwenda kwake kupitia EBP

#### Mambo Mengine

* [**Pointers Redirecting**](../stack-overflow/pointer-redirecting.md): Ikiwa stack ina pointa kwa kazi ambayo itaitwa au kwa herufi ambayo itatumika na kazi ya kuvutia (system au printf), inawezekana kubadilisha anwani hiyo.
* [**ASLR**](../common-binary-protections-and-bypasses/aslr/) au [**PIE**](../common-binary-protections-and-bypasses/pie/) inaweza kuathiri anwani.
* [**Variables zisizowekwa**](../stack-overflow/uninitialized-variables.md): Kamwe hujui

<details>

<summary><strong>Jifunze kuhusu kudukua AWS kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (HackTricks AWS Red Team Expert)</strong></a><strong>!</strong></summary>

Njia nyingine za kusaidia HackTricks:

* Ikiwa unataka kuona **kampuni yako ikitangazwa kwenye HackTricks** au **kupakua HackTricks kwa PDF** Angalia [**MIPANGO YA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
* Pata [**bidhaa rasmi za PEASS & HackTricks**](https://peass.creator-spring.com)
* Gundua [**Familia ya PEASS**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa [**NFTs**](https://opensea.io/collection/the-peass-family) za kipekee
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.

</details>