Let's create a new file called Exploit One Dot Point and let's start with actually bang to slash user
slash mean slash pull.
Let's also write this line.
This line forces are flush after every right or print, so the output appears as soon as it is generated
rather than being buffered.
Right now, let's create a new variable called junk and let's give it two hundred and fifty six s,
which is the offset to our BP register.
So after filling in 256 is the will be all right.
Are BP registered using our exploit.
So this is offset to our BP.
All right.
So let's come it out.
And then let's append.
Eight Beest.
All right, so this is going to override our BP.
And after this, we are going to override in the same return address, which is IRAP.
So as I mentioned earlier, we need to use six bytes for this instead of eight.
All right.
So let's use six CS here, and this is going to be our saved return address.
All right.
So once this is done, we can just print the junk.
Now, our return to exploit code starts from here.
Let's update the exploit with the details that we have gathered so far.
Now, before doing that, let me quickly show you a picture of how the stack is going to look like with
the details that we have gathered so far.
Here it is.
Are going to fill in with the junk initially until we reach IAP.
And once we reach the RFP, we are going to fill that in with the address of the gadget, which contains
the instruction pop idea.
So that's going to be this, the Lipsy base, plus the offset of this gadget.
After that, we are going to place the address of businesses because when this pop, the instruction
gets executed, whatever the value that is on the top of the stack is going to be popped into our and
we want that top of the stack to be the address of BENCIC.
So that becomes an argument to system function.
So the next six minutes are going to be the address of business, which once again this has to be the
best address plus offset.
After that, we are going to place the address off system and once the system function executes, we
are going to get a shell because the argument is actually BENCIC.
And when we exit from the shell, the control is going to be returned to the next instruction, which
is going to be the address of exit function.
So when this instruction gets executed, we are going to exit gracefully.
So let's try to add these details to our exploit.
Let's switch to the virtual machine and let's replace these sequences with the address of our gadget.
Before that, let's create a variable called Lipsy and this core base.
I'm just going to copy the address of this Lipsey base, which is this and let's split it here.
So that's going to be Lipsy base.
Now we are going to overwrite this return address with Lipsey base, plus the address of the gadget
with the instruction pop idea.
So let's use back Q.
And Lipsey underscored base plus the offset, which is this let's copy this.
And let's start here, let's end it with a semicolon, we are using the option Q in the PAC function
because we want to convert 64 bit addresses to little Indian format in 32 a bit exploit development.
We typically use N, which is used for potato producers, but in case of 64 bit addresses, we will
have to use this option.
Q Right now the next line is going to contain the address of business edge.
So let's use junk and that's appended here using Paak once again with the option.
Q And let's use Lipsey underscore.
Base plus the offset of benefits.
Here it is.
This is the offset of benefits.
So let's quickly copy this and let's face here.
All right.
So the next line is going to contain the address of system.
So let's write that here.
I'm going to use Q and address of system function.
Is this as I mentioned earlier, it's not the offset.
So we don't have to added to the Lipsey mess.
We can just directly use this address.
I'm just going to the next line, which is going to be the address of exit function.
OK, so let's use pack with the same option and let's paste the address of exit here.
So I'm just copying the address of exit and let's face it here.
All right.
So we are pretty much done with our exploit.
We have written everything that we planned earlier.
Let's quickly and the comments this is the address of system and this is the address of the exit audit.
So we have pretty much everything we wanted.
We begin with the best address of the Lipsey Library here.
After that, we fill in some junk until we reach the AP register and we are adding the Lipsey base and
the offsets using Perl.
We don't want to do any manual calculations as Perl can do it for us.
Assigned to that, we have multiple addresses which have to be written in little alien format manually.
So to avoid writing these in little endian format manually, we are using Paak function with the option.
Q QE is used to convert 64 bit addresses to little alien format, so we are just passing these 64 bit
addresses to the back function using the option.
Q.
Now let's save the file and let's try to run this exploit and just going to give it executable permissions.
There it is, no, let's try not exploit one, not comma cat, and let's pipe it to our vulnerable program.
I'm just hitting enter, let's hit enter once again and let's check if we have got in a shell by typing
some command.
As we can notice, there is a segmentation fault.
Now let's try to understand what's causing this issue.
Let's run the vulnerable binary in GDP and see where the exploit is failing.
So I'm just going to clear the screen and let's produce the payload so that we can use it in GDP.
I'm just calling it payload one.
Now let's load the binary using Gleib.
Now, let's set up a breakpoint at Main and let's run the binary using payload one.
And let's use this as one function so we can set up a breakpoint at this red address and just copying
this and let's set up a breakpoint at this address.
Now, let's continue so that we can hit this break point.
Look at that.
We have hit the break point.
So the execution is now stopped.
And the next instruction that is to be executed is direct instruction, which is the last instruction
in one underscore Funt function.
Now, once after this instruction is executed, if you notice we are going to land on our gadget with
the instruction pop idea.
So once this idea is executed, whatever the value that is on the top of the stack is going to be popped
into our register, which is going to act as an argument for the system function.
Let's try typing and say, look at that.
Now we are about to execute this pop idea.
And currently the top of the stack is this, which is actually pointing to benefit, which is expected.
So everything is fine until here.
So let's take the PC and we have a read instruction type aside.
And after that it looks like we are only inside the system function.
So everything is working as expected.
Let's type see.
So the execution will continue and there is a problem.
There is a move, EPP's instruction here, which is actually causing this issue on some of the 64 bit
machines.
This seems to be a non-issue if the stack is not sixteen by a line while calling system function.
This might happen.
To fix this, we can simply add a read instruction before the idea gadget addressed by executing read
it will pop off eight bytes on top of the stack and return to that.
So it will realign the stack to 16 bytes.
This blog post and nicely explains this problem along with the basics of stack alignment.
So I would highly recommend you to go through this blog to better understand this stack alignment issue
that we have just faced.
All right.
So with that, I'm just going to fix this part by adding the address of reconstruction before the address
of the pop gadget.
So let's quickly go through how the stack is going to look like now.
Currently, this is how our stack is looking like.
Now we are going to add the address of reconstruction here instead of the address of this gadget.
So every other address will slide down accordingly.
So this is how it is going to look like.
We are going to find out the address of reconstruction and we are going to place that here and all the
previously placed addresses will slide down accordingly.
Right.
So let's go ahead and find out the address of reconstruction, using rubber and opening up a new domina.
So let's use the wrapper.
And instead of getting a shell and loading the binary, we can simply use that flash file and specify
the library here, which is Lipsey.
And we can use that flash search and we can specify red.
So this is another way we can search for gadgets, so we have got an output and if you look at this
address, there is a reconstruction and this seems like a good candidate for us.
So I'm just copying this offset.
And I'm going to post it here.
So this is the corporate address, just to have the full list of addresses at one place I have just
visited here, what we can just directly pasted in the explosion itself.
Right.
So let's go back to the exploit.
Let's exit from this judicial and let's use them, exploit one doctorial once again and let's add this
address here, junk.
Pack.
And let's use Lipsey underscore bass, because this is an offset that we have gotten, so we will have
to add it to the best interest of Lipsey.
Looks like there was a typo earlier.
It's part of the common thread.
And the current one that we have just gotten is basically correct.
All right.
So this should fix the problem that we have faced earlier.
So let's save the file and let's type.
This command and if it works, we should get a show.
Let's hit enter once again and let's take it.
And there you go.
They exploit looked.
Now, let's try to practically understand why this address of exit is needed here.
Now let's go back to the explode once again and let's type exit.
Let's take exit once again and look at that, it has gracefully exited.
Now, what do you want to do is I want to edit the exploit.
And I will remove this address of exit instead, I will just add some junk.
I am probably going to add six A's, which are 640 once.
That should do it.
So let's save the file and let's go back to the previous terminal and let's execute the exploit once
again.
Once again, we have gotten the shell.
Now let's fix it and look at that.
There is a segmentation fault when we are exiting.
The reason is after completing the system con when the control returns to the next instruction we have
specified, six is as the next instruction to be executed and these six A's are just junk and thus it's
causing a segmentation fault.
And that's the reason why we wanted to place the address of exit immediately after the address of the
system function.
So that brings us to an end of return to Lipsey attack.
Let's quickly take a recap of what we have done.
We have basically enabled an exhibit on our vulnerable binary and then we have built an exploit by not
placing any code on the stack.
But we have just made use of a few addresses in Lipsey Library and then we redirected execution to the
Lipsey functions.
And in turn we go to show this is a classic example of how a return to Lipsey exploits work.