In this video, we are going to discuss a technique called jump to register, for example, jump to
audience register, remember to use the vulnerable binary with gets function.
Let's also ensure that we have the working payload that we used against the vulnerable binary which
gets function.
First, let's create a directory called Jump Dash RSX and let's navigate there.
We don't have any files inside.
Now let's copy everything from gets directly
into the current directorate.
There it is.
No, let's remove the files that we don't need.
One of them is called File.
Let's also remove the binary, which is vulnerable, and let's remove the payload and there it is,
we should have three files, exploit that final dogpile makefile and vulnerable dot.
See, let's first combine the program using make and let's make sure that they exploit is working fine.
So I'm going to do a simple test to see if they exploit is working fine.
So I'm just typing exploit Basche final RPN cat dot slash.
There it is, the exploit is working fine now.
What do you want to do is I want to change the makefile slightly.
I want to add.
Nash, now, Nash Pyi, I'm just adding no flag to D.C. and let's remove the one level binary and let's
try and make once again to compile the program and let's try to execute the exploit once again.
Know they exploit still works fine, just that we have added one more flag or makefile, we have changed
the makefile to have this flag because this is required for the next exploit that we are going to right
now.
Let's quickly generate the payload from this exploit.
And before understanding what this jump to register technique is, let's load the vulnerable program
using GDP, GDP that's vulnerable and let's set up a breakpoint at Main and let's run the program using
the payload that we have produced earlier.
There you go.
The breakpoint is hit.
Now, let's type this one, underscore Funt, and let's set up a breakpoint at this red address and
just setting a breakpoint here.
And let's continue our execution.
And if you notice, the second breakpoint is hit and we are currently at this read instruction now,
what I want to do is I want to check if any of the registers are pointing to our buffer.
So let's go to the registers section and let's take a look at the RSX register.
Here it is, Heartaches Register currently contains this value, which is an address that's pointing
to a knock sled.
So let's quickly go ahead and check where this address is.
If you remember, our sled is the beginning of our payload.
So let's quickly check for the beginning of a buffer by typing ex slash 56 arizpe minus 280.
There it is.
If you look at this, this is the beginning of our buffer.
So this confirms we're at the beginning of our buffer's and which is what exactly this address is pointing
to.
Now, if you notice, this is the same address that the oryx is currently holding and this address is
actually pointing to this buffer.
We can quickly check in four registers, IREX, if you see this this address and this address are the
same.
What it essentially means to us is if we can somehow execute an instruction like Jump X instead of hard
coding the address pointing to the novelette, we will still be landing on this.
Novoselic If it is confusing, let's go back to our slides and understand this earlier.
What we have done was we have written this IP address in a way that it redirects the execution to this
nozzle and now we are going to do the same thing, but in a different way.
Now that we know that X register is pointing to the bobsled.
If we can execute jump IREX instruction somehow we will still be able to land on this.
Moslehi so we need to find the address of this jump Arrigo's instruction and we will place that address
in this RHP.
That's the whole idea.
Now how do we do that?
We need to find a file or library which contains the instruction jump at X..
We will find out the address of this instruction and then we will load that address in this RHP register.
We can search for these instructions which are actually known as gadget's in our one binary itself.
Alternatively, one convenient file that almost always contains the gadgets we want is Lipsey.
Lipsey is a library that almost always loaded into a binary.
In this example, let's find out jump Artex instruction within the binary itself and redirect the execution
by overriding this RHP value with that entries, which eventually redirects the execution to this knob
sled and in turn the execution will land on the shelf code.
That's the idea behind Jump Artex Technik.
That's all for this video in the next video.
Let's do this practically.