.. | ||
tools | ||
elf-tricks.md | ||
README.md |
Basic Binary Exploitation Methodology
{% hint style="success" %}
Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)
Support HackTricks
- Check the subscription plans!
- Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦 @hacktricks_live.
- Share hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.
ELF Basic Info
Before start exploiting anything it's interesting to understand part of the structure of an ELF binary:
{% content-ref url="elf-tricks.md" %} elf-tricks.md {% endcontent-ref %}
Exploiting Tools
{% content-ref url="tools/" %} tools {% endcontent-ref %}
Stack Overflow Methodology
With so many techniques it's good to have a scheme when each technique will be useful. Note that the same protections will affect different techniques. You can find ways to bypass the protections on each protection section but not in this methodology.
Controlling the Flow
There are different was you could end controlling the flow of a program:
- Stack Overflows overwriting the return pointer from the stack or the EBP -> ESP -> EIP.
- Might need to abuse an Integer Overflows to cause the overflow
- Or via Arbitrary Writes + Write What Where to Execution
- Format strings: Abuse
printf
to write arbitrary content in arbitrary addresses. - Array Indexing: Abuse a poorly designed indexing to be able to control some arrays and get an arbitrary write.
- Might need to abuse an Integer Overflows to cause the overflow
- bof to WWW via ROP: Abuse a buffer overflow to construct a ROP and be able to get a WWW.
- Format strings: Abuse
You can find the Write What Where to Execution techniques in:
{% content-ref url="../arbitrary-write-2-exec/" %} arbitrary-write-2-exec {% endcontent-ref %}
Eternal Loops
Something to take into account is that usually just one exploitation of a vulnerability might not be enough to execute a successful exploit, specially some protections need to be bypassed. Therefore, it's interesting discuss some options to make a single vulnerability exploitable several times in the same execution of the binary:
- Write in a ROP chain the address of the
main
function or to the address where the vulnerability is occurring.- Controlling a proper ROP chain you might be able to perform all the actions in that chain
- Write in the
exit
address in GOT (or any other function used by the binary before ending) the address to go back to the vulnerability - As explained in .fini_array, store 2 functions here, one to call the vuln again and another to call**
__libc_csu_fini
** which will call again the function from.fini_array
.
Exploitation Goals
Goal: Call an Existing function
- ret2win: There is a function in the code you need to call (maybe with some specific params) in order to get the flag.
- In a regular bof without PIE and canary you just need to write the address in the return address stored in the stack.
- In a bof with PIE, you will need to bypass it
- In a bof with canary, you will need to bypass it
- If you need to set several parameter to correctly call the ret2win function you can use:
- Via a Write What Where you could abuse other vulns (not bof) to call the
win
function.
- Pointers Redirecting: In case the stack contains pointers to a function that is going to be called or to a string that is going to be used by an interesting function (system or printf), it's possible to overwrite that address.
- Uninitialized vatiables: You never know.
Goal: RCE
Via shellcode, if nx disabled or mixing shellcode with ROP:
- (Stack) Shellcode: This is useful to store a shellcode in the stack before of after overwriting the return pointer and then jump to it to execute it:
- In any case, if there is a canary, in a regular bof you will need to bypass (leak) it
- Without ASLR and nx it's possible to jump to the address of the stack as it won't never change
- With ASLR you will need techniques such as ret2esp/ret2reg to jump to it
- With nx, you will need to use some ROP to call
memprotect
and make some pagerwx
, in order to then store the shellcode in there (calling read for example) and then jump there.- This will mix shellcode with a ROP chain.
Via syscalls
- Ret2syscall: Useful to call
execve
to run arbitrary commands. You need to be able to find the gadgets to call the specific syscall with the parameters.
Via libc
- Ret2lib: Useful to call a function from a library (usually from
libc
) likesystem
with some prepared arguments (e.g.'/bin/sh'
). You need the binary to load the library with the function you would like to call (libc usually).- If statically compiled and no PIE, the address of
system
and/bin/sh
are not going to change, so it's possible to use them statically. - Without ASLR and knowing the libc version loaded, the address of
system
and/bin/sh
are not going to change, so it's possible to use them statically. - With ASLR but no PIE, knowing the libc and with the binary using the
system
function it's possible toret
to the address of system in the GOT with the address of'/bin/sh'
in the param (you will need to figure this out). - With ASLR but no PIE, knowing the libc and without the binary using the
system
:- Use
ret2dlresolve
to resolve the address ofsystem
and call it - Bypass ASLR and calculate the address of
system
and'/bin/sh'
in memory.
- Use
- With ASLR and PIE and not knowing the libc: You need to:
- Bypass PIE
- Find the
libc
version used (leak a couple of function addresses) - Check the previous scenarios with ASLR to continue.
- If statically compiled and no PIE, the address of
Via EBP/RBP
- Stack Pivoting / EBP2Ret / EBP Chaining: Control the ESP to control RET through the stored EBP in the stack.
- Useful for off-by-one stack overflows
- Useful as an alternate way to end controlling EIP while abusing EIP to construct the payload in memory and then jumping to it via EBP
Misc
- Pointers Redirecting: In case the stack contains pointers to a function that is going to be called or to a string that is going to be used by an interesting function (system or printf), it's possible to overwrite that address.
- Uninitialized variables: You never know
{% hint style="success" %}
Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)
Support HackTricks
- Check the subscription plans!
- Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦 @hacktricks_live.
- Share hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.