Security Summer School

User Tools

Site Tools

session:solution:12
LDAP: couldn't connect to LDAP server

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revisionPrevious revision
Next revision		Previous revision
session:solution:12 [2015/07/23 12:24] – [Echo Service] Razvan Deaconescusession:solution:12 [2020/07/19 09:49] (current) – external edit 127.0.0.1
Line 1: Line 1:
-====== Session 12 Solutions ====== +====== 0x0B. Return Oriented Programming (part 2) (Solutions) ======
- +
-===== Gadget Tut ===== +
- +
-TODO +
- +
-===== Echo Service ===== +
- +
-<note> +
-The log file created with [[http://man7.org/linux/man-pages/man1/script.1.html|script]] is {{TODO|this}}. You may use ''cat'' over the script file to print it. +
-</note> +
- +
-By going through the ''echo_service.c'' file we see that in the ''echo_service()'' function we use ''read()'' for reading ''4096'' bytes when we only have ''1024'' available for a the ''buf'' buffer. We can use this to create a return-oriented programming (ROP) attack. +
- +
-Let's first consider our steps. +
-  - We will create a payload that overflows the ''buf'' buffer and rewrites the return address of the ''echo_service()'' function triggering the attack (the ROP chain). +
-  - We will update the payload issue the following calls through the ROP chain, as also indicated in the task: +
-    - ''dup2(sockfd, 1);'' +
-    - ''dup2(sockfd, 0);'' +
-    - ''system("/bin/sh");'' +
-  - We will start the server and then we will use ''netcat'' to send the payload to the server to trigger the attack. +
- +
-We aim for the stack to be the one below:<code> +
-0x00000000 +
-... +
-start address of buf +
-... +
-+--------------------------------+ +
-|   dup2() address               |   <--- return address for echo_service() +
-+--------------------------------+ +
-|   pop_pop_ret gadget address   | +
-+--------------------------------+ +
-|   4                            | +
-+--------------------------------+ +
-|   1                            | +
-+--------------------------------+ +
-|   dup2() address               | +
-+--------------------------------+ +
-|   pop_pop_ret gadget address   | +
-+--------------------------------+ +
-|   4                            | +
-+--------------------------------+ +
-|   0                            | +
-+--------------------------------+ +
-|   system() address             | +
-+--------------------------------+ +
-|   junk                         | +
-+--------------------------------+ +
-|   "/bin/sh" address            | +
-+--------------------------------+ +
- +
-... +
-0xFFFFFFFF +
-</code> +
- +
-In the above figure we will overflow the ''buf'' buffer and overwrite the return address for the ''echo_service()'' function with the first part of the ROP chain: the address of the ''dup2()'' function. Once the ''dup2()'' function returns it will call a ROP gadget that pops two values: the ''dup2()'' function arguments (''4'' is ''sockfd'' and ''0'' and ''1'' are standard input and standard output file descriptors respectively). Then another ''dup2()'' function gets called and then ''system("/bin/sh")''. Because this needs the address of the ''/bin/sh'' string it could only happen on non-ASLR enabled system; but we'll use some tricks to trick it into running on an ASLR-enabled system as well.+
  
 +[[http://security.cs.pub.ro/summer-school/res/arc/12-return-oriented-programming-advanced-sol.zip|Solutions archive]]
session/solution/12.1437654295.txt.gz · Last modified: by Razvan Deaconescu