In this video.
Let's try to understand how it works and what it requires in its arguments so that we can make our stack
executable.
To start with, let's first go through the main page of end product.
It basically requires three arguments.
The first argument should be kept in the register.
The second argument should be kept in the outside register, and the third argument should be kept in
the RDX register.
That's as for the calling conventions in Intel, 64 bit processors.
Now let's see what these arguments are and what values we should put into these registers.
Let's switch to the virtual machine and let's type.
Man two And protect, if you look at this and predict is a function which is used to set protection
on a region of memory, in our case, it's going to be stack and it requires three arguments an address
that is aligned to a page boundary size.
This is the size of the memory where we want to change the protection.
And the third argument is the protection value itself.
If you look at these options, the memory cannot be accessed at all.
If you set up prot underscore none.
If you want to make it read only you need to set plot underscore raid and if you use pro underscore
right, the memory can be modified.
And finally we can use prop underscore exec to make the memory executable.
We can also use the combinations of these three values.
We can use bitwise or of these three values and it produces the value seven.
So we can use the value seven to make our memory region readable, readable and executable.
So this is clear.
The third argument is going to contain the value seven.
Now, let's come back to the first and second arguments.
The second argument is going to contain the size of the memory region that we want to change the permissions
on.
In 32 meat processors.
The maximum number that we can put without worrying about null bytes is x01010101.
We are going to use the same value in our case even here in 64 bit exploitation as null bytes are not
bad characters in our target program.
Finally, the first argument, which is an address that must be aligned to our page boundary, this
can be the base address of our stack.
Now to put it in visual format, this is what we will have to do to start with.
M Protect requires three arguments.
The first argument goes into D and this can be the base address of the stack.
The second argument goes into RSI and as I mentioned, we are going to use this value 01010101.
The third argument goes into RDX.
The production value is going to be seven, which is basically a bitwise or of pro-trade prod, right,
and prod exec.
Finally, followed by these three values we will have to call and protect.
So m protect function will pick the values of these three registers as arguments and it will turn our
stack into executable before we actually try this in our exploit.
Let's test our theory by manually changing these values in GDB.
So let's switch to the virtual machine and test our theory.
Let's first navigate to x86 underscore 64.
Let's create a new directory called ROP.
Let's navigate there and let's copy everything from red to lib.
See directory.
And let's place them here.
All right.
Even though we have placed all of these things, we are only interested in the vulnerable binary.
So let's load it using gdb.
Let's set up a break point at Main.
And let's run the program.
Now let's make sure that the stack is not executable.
I'm just clearing the screen and let's type check sig.
And if you see this, the next bit is set.
Let's also check the output of VM map using this command VM map space stack and if you see this stack
is currently not executable.
Now, since we have typed this command, let's take a copy of the base address of stack.
So I'm just copying it here and let's paste it here in our notepad.
Now, what we want to do is we want to call and protect with the custom values as arguments to it.
What are those values going to be?
They're going to be the same values that we just discussed.
Argument one is going to have the base address of stack.
Argument two is going to have the size and argument three will have the value seven, which is going
to make the stack read right and executable.
But how do we do that?
We will have to somehow execute and protect in this GDB session.
One way to do it is to identify the address of and protect and then redirect our execution to and protect.
So let's find out the address of and protect by typing space and protect.
This is the address of protect.
I'm just copying it here and let's paste it here.
Another way to get the same address is to type this and protect.
If you see this, we have gotten the same address here, which is the beginning of protect function.
Now, let's set up a breakpoint here at this address by using the space star and the address.
Now we will have to redirect the execution to this address.
How do we do that?
We can actually set the value of the IP register to be this address.
But before doing that, let's first check the values of the registers R.D, RSI and ADX.
So I'm just using info registers.
There it is.
ADX currently contains this value.
RSI contains this value and RB contains this value.
Now let's set the values required in these registers and continue our execution.
I'm going to use set RB.
If you remember, this is supposed to be the base address of the stack because that's where we are going
to change the memory predictions on.
So let's copy the base address of the stack, which is this.
And let's set this idea.
Register to have the base address of the stack.
Now, let's also set up the register the with the value 0x01010101.
That's good enough to place our shell code.
Now, let's also set up.
RDX with the value of 0x7.
This is what we discussed earlier.
To have read, write, execute permissions on stack, we need to set up the value seven in RDX register.
Now, the last thing that we need to do is to redirect the execution to protect function so that these
arguments will be used with protect.
So let's copy that and predict address here.
And let's use set an IP and let's paste the address of and protect function.
Let's hit enter.
Now, if we continue the execution, we are going to redirect the execution to M product and we should
hit the breakpoint.
All right.
So let's type C and continue the execution.
Before that, let me quickly show you the stack once again.
Look at that.
It is still not executable.
So let's type C to continue the execution.
If you notice, we hit the breakpoint here on my protect function.
Let's quickly check the values of the registers that we have modified.
RDA contains the best address of the stack.
RSI contains this value and ADX contains this value which is seven.
Nice.
These registers have the values we needed.
Now let's do a single step until the stack turns executable.
Because with these values our theory is that the stack should become executable when RM product is called.
All right, let's keep executing, see?
So I'm just typing sy and hitting enter multiple times.
Let's also monitor the permissions on stack by using the map stack.
If you notice, the stack became executable now.
That means our theory is correct and we should be able to turn stack into an executable one by following
the theory that we have discussed so far.
Obviously we can't use GDB to change the instructions at runtime while running the exploit, so we will
have to somehow use our exploit to make these changes in a way that m protect picks the values that
we want.
That's all for this video.
In the next video, we will begin to write this exploit.