Welcome to the module return oriented programming are, in short, Ropp.
Before we jump into to return related programming, let's try to understand the need for a return oriented
programming when compiling the vulnerable program, we have enabled IMEX, which made our stagnant executable.
To bypass this protection, we used the return to flimsy technique which allowed us to redirect the
program's execution flow into a function called system, which is available within Lipsey Library.
Wilders return to liberty is a classic technique that almost always works.
There is a problem.
We are pretty much limited to executing what functionalities the Lipsey Library has.
For example, we can get a cell by using system.
Similarly, we can only invoke the APIs that it has and we cannot write custom code and execute it.
That's the challenge.
If you want to execute shall code even when your stack is non-executive, all we can do that by using
return oriented programming.
Essentially, we are going to use some instructions that will turn our stack into executable once again
and then eventually we will execute our code.
That's the idea.
But how can we achieve that?
We need to find out certain gadgets that can be used to turn the stack into executable and then we will
need to chain them in a way that they work reliably.
For us, a gadget is simply a sequence of instructions.
Shortly we will understand how gadgets look like.
Don't worry, if you don't understand the terms, gadgets and gadget change, we are going to see them
practically and you will be able to clearly understand these concepts by the time we finished writing
the gadget chains.
So essentially using the buffer overflow vulnerability we have, we will have to execute and protect
function.
So it will change the memory predictions on our stack, meaning it will turn the non executable stack
into executable stack.
Now, in this case, since we are on a Linux machine, we can use a function called end product to change
the protections on the stack.
We are going to write this chain manually from scratch, although we can use some automated tools to
generate it.
We are not going to do that.
We are going to manually write this chain from scratch.
But before we get into the details of Emperor and how we are going to build the change, let's understand
some basics about chains.
We are going to use rubber, the same tool that we have been using to find gadgets.
And we will use rubber to first find gadgets and then we are going to construct the stack by strictly
following these conditions that are shown on the screen.
Rule number one, we will have to place the gadget chain on the stack in a way that it disables Anex
and then Jumpstart Encored.
Once an X is disabled by using our rope chain.
We will be able to execute Shell called rule number to each gadget.
Must transfer the control to the next gadget because we are going to pick individual gadgets and we
are chaining them together.
But how will control be passed from one gadget to another?
One that's possible by using the Thirroul.
So there comes rule number three.
We should only consider gadgets that are ending with a read instruction.
So the first gadget ends with read instruction, which eventually transfers the control to the next
instruction, which is placed immediately after the first gadget.
So we will make sure that each gadget contains read instruction at the end of it.
So the next gadget that is placed immediately after the first gadget will be executed when the first
gadget finishes its execution.
Once again, this may be confusing right now, I'm going to draw the stack visually while building this
option so you will get a sense of what I'm talking about when we write the gadget chain.
But before jumping into writing a gadget chain, I want to provide a bit of theory so you will be able
to easily understand what we are doing while riding the gadget chain.
Now, rule number four, all the required parameters are available in relevant registers in this case,
we are going to use a function called end product and it requires a bunch of arguments which we will
discuss shortly.
We will have to arrange the stack in a way that those arguments are available in appropriate registers
right now.
Rule number five, we are going to place a lot of bytes on the stack.
So space is a requirement.
Let's keep that in mind.
And the last rule, rule number six, if there are any instructions in the gadget that we do not need,
we will have to carefully handle them because we don't always get the gadget with only the instructions
that we want.
For instance, let's assume that you are looking for a gadget with the instruction pop RDX.
So essentially what you need is pop, RDX, rect.
So this is the gadget you need.
But it is also possible that this gadget may not be available.
So you may have to work with a gadget which has some additional instruction in between your required
instruction and the return address.
For instance, let's take this gadget as an example.
You have pop at 12 also, and you don't want to use this instruction in your gadget chain.
In this case, even this instruction has to be carefully handled to be able to reliably execute your
option.
So keep that in mind.
When we get into this kind of gadgets, we are going to practically see how to deal with such gadgets.
So keep these instructions in mind while I'm building that option, I'm going to make use of these conditions.
So keep a copy of these rules in your mind and make sure that we are following these while building
the gadget chain.
All right.
That's all for this video.
In the next video, we are going to see how empathetic works and the arguments required by end product.
Once that is done, we will start building our Rob chain.