Doing ret2libc with a Buffer Overflow because of restricted return pointer - bin 0x0F

Key Takeaways

in the last episode we've created our first full stack buffer overflow exploit by overriding the return pointer on the stack and jumping to Shell Code that we have placed on the stack as well in this episode we will look at stack level six which looks at what happens when you have restrictions on the return address to understand this video you must have understood how normal buffer overflow and jumping to Shell Code works I hope I explained it well enough in the past videos but if there are still open questions please post them on Reddit I really need you to have understood that stuff as a hint this level tells us that this level can be done in a couple of ways such as finding the duplicate of the pilad with object minus s or R toip C or even return oriented programming in this video we will not be able to explore return oriented programming but I will will show you a couple of other tricks that will eventually lead to return oriented programming so let's have a look at the source code and again it's very similar to the previous levels just some small changes instead of everything being in main main calls this function get path get path allocates a string buffer for 64 characters then reads A String with gets and we all know by now that with gets we can read arbitrarily many characters which we can use to overwrite the return point on the de but the next line is interesting built-in return address is a function from the compiler which you can use to read the current return address from the stack and this return address is checked if it starts with hex BF the ENT performs a bitwise end with the address after that only the part where they were same survives basically setting the remaining bits to zero and checking if the front is still hex BF if the return address starts with hex BF it prints this return address and exits when we use our exploit from last time and adjust the pading to account for the new unsigned INT in this function we see that it doesn't work it fails with okay so we cannot use addresses that start with hex BF the exit protects this function from being exploited that way because the exit is a CIS call that simply quits the program so even though we have smashed the return pointer this function will never return so you can see that even having a buffer overflow doesn't necessarily mean you can exploit it when you open this level now in GDB break it get path run it and then look at the memory with info proc map we can see that the only address that starts with BF are on the stack so basically we cannot return to a stack address this is crazy then how can we run our code if we cannot return to the stack where we place our Shell Code so first of all all we can still control the return pointer as long as it doesn't start with BF and now comes the sick idea of returning into known code let's think about this the return instruction just looks at the current address on top of the stack removes it and just jumps there what would happen if you return to the address hex 8484 F9 which is the return instruction itself think about this we override the return point of with hex 080 we reach the return instruction it will pop this address from the SEC and jump to it basically just jumping to itself and now it will read the next address on the stack and jump there now you could repeat that make the next address on the stack again 080 or place the address of the stack here and we can return into the stack again and in theory that should work because the original return address got overwritten with an address that starts with 08 zero okay let's try that let's modify our exploit code instead of the Shell Code let's use int three CC instruction again for a trap we all know that when we hit them we have code execution and we just have to find suitable Shell Code so let's focus on the interesting part set a break point at the return of get path and then run it with our exploit input we hit the break point and we got past the return point to check so let's look at this deck we can see that that the address on top of the deack is now the 08 address which is the return instruction so now single step forward this should pop this address from this deack and jump there and indeed we hit the break point again because we jump to itself when you now look at the stack the next address on the stack is the stack address and we will return into this address now so when we just continue we will return into the stack like in the previous exploit where we hit our traps boom arbitrary code execution by the way this address we jump to the 080 is a gadget when you read about return oriented programming you are looking for gadgets and that was a simple no operation Gadget it was just a return doing nothing and for full return oriented programming you look for gadgets that do some more stuff before returning to the next address now when we do this kind of stuff you hear me saying return into or jump to those become equivalent in this case because yes we execute a return instruction but we are not returning to the original function anymore we are returning into something else effectively just jumping somewhere else so I hope that doesn't confuse you maybe you ask yourself why the hell was the stack executable in the first place there's no valid reason why the stack should be executable that's why there exists a general memory policy nowadays write X or execute basically it means never have a memory page that is writable and executable because then an attacker cannot execute any Shell Code that he was able to write in the process memory so we would hope that today every modern system uses D data execution prevention and sets the NX bit the non-executable bit for memory Pages like the stick but reality is not so simple embedded devices are on the rise with the internet of things and often they don't support features like that almost on programming languages like JavaScript used jit just in time compiler so they have to compile code on the fly in memory when needed and execute that so they need writeable and executable memory regions but even if we had D we could use techniques like red toip C to never execute actual Shell Code but still Pon a system now one of the hints said you could look into red tulip C now that you are almost a pro in exploitation you understand what that means it's very similar to what we did in stack level four return into lip C like we just returned into some code we could just return into the huge Library lip C there must be something interesting that we could have used one interesting function from lip C is system which executes a shell command with print system we can find the address of it but simply returning into it will probably not work we need to make sure to control a couple of things let's create a simple C program that cause a lipy system for us in the end we want to somehow execute system with bins H because then we get a shell if we try that here that works well now let's look at this in GDB we can see that before the call to system the address of the command we want to execute is put on top of the stick and as we know a call to a function will push your return address on the stack as well so if we draw this this is how the stack will look like once we are at the start of system first the address of the command is placed on the stack and then the address we want to return to now imagine if we use our buffer overflow to return into a system first of all we didn't execute the call instruction thus there was no return address pushed but we fully control the stack so system expects the stack to look like this and we can build this by hand so first we have to put the return address for system on this deck but actually we don't care about this right now but that's still cool and important and remember that because you can chain those things together like we chain two returns after each other before we could chain multiple function calls or other gadgets after each other by always controlling the return pointer of The Next Step so in our case when system finishes we will return into a sec Vault because it will return into 4141 4141 so next add address on the deack has to be a string we want to execute preferably B AG there are many options how to get a reference to such a string one option would be to use a stack address because there are strings we control on environment variables because they are at the bottom of the stack and a bit easier to predict but as you remember the stack is a bit unreliable a more reliable technique is this here we can use find to search in the map memory of lip C for string cool apparently at this address we can find bin as H let's check if that is true examine memory as a string at this address what the frck GDB what the hell are you doing why do you say you found b h there if it's not there I have no idea why that's happening couldn't find anything online anyway ignore this here's another Technique we can use string to find all strings in lip C and with minus t we can print the offset inside this file as hex and then we can simply add this offset to the address lip C is loaded to and that is the real address of Bess H okay so let's copy this address into our exploit and then let's try it remember to use the trick from the previous video with the parenthesis and the cat because the exploit script will close the input again and cool it works what we just did was the technique called red to lip C and we never executed any code on the deck no [Music]