All right.
Let's start writing our exploit.
So in this video, we are going to create a drop chain manually from scratch.
First, let's make sure that we are inside the rope directory and let's create a file called Robert
Peel and let's start writing our exploit.
Let's begin by using a shebang user in Perl, and let's use this line as usual
for flashing the output and let's create a variable to have some junk.
So like we did earlier, we are going to use 256 is here.
This is the offset to reach our BP.
So we are going to
specify that here.
We are going to write comments in every line so that it will be clear of what we are doing once we finish
writing the exploit.
So this is offset to our BP.
Well, once this is done, we will be spending eight days, that is, to overwrite our BP
that it is now let's use six seas to start with and this is going to override R.I.P..
Now, let me show you the diagram of the stack at this point of time.
This is how it looks like we have filled in 256 days plus eight days, which equals to the junk here.
So after that, we are overwriting the saved return address with six C's.
If you remember, our plan is to call and protect function with appropriate arguments.
So we will need to set up the registers RBI, RC and RDX with appropriate values.
So let's begin by searching for those gadgets in Lipsey using wrapper.
So I'm switching to my virtual machine and let's open up a new tab.
Let's make sure that we have Lipsey Library available in the current directory.
Yes, we do have it.
Now let's launch wrapper and let's load.
Let's see.
So the first step is to set up the register RDA.
If you want to pop some value into the register RDA, we need to have a gadget with the instruction
pop RDA.
So let's search for pop RDA instructions in Lipsey.
Look at that.
We found one instruction here which meets our requirements.
It has the instruction pop radii and it ends with the read instruction.
So we are going to use this offset in our exploit.
I'm just opening the exploit once again and I'm going to replace these six C's with the address of Pop
DI.
So let's use PAC.
Q, let's see, underscore base plus the offset that we have just gotten, which is this.
So this is going to give us the address of pop the.
Let's also copy these instructions so we can use this in the comments.
So I'm just removing this rip here and let's use this as the comment.
Nice.
Now, if you notice, we do not have the lib base.
So let's quickly open up a new tab.
And let's load the vulnerable binary using GDB and let's set up a breakpoint at main and let's run the
binary and let's use VM map Lipsey.
That should give us the base address of lib.
So I'm just copying this here and I'm just going to create a new variable called Lib C base and I'm
going to use this here.
So that should give us the actual address of this gadget.
Right now, we are pretty much done with this.
Now, the next step that we need to do is we need to specify the value that we want to pop into our
register.
So that's going to be the base address of the stack.
If you remember, the first argument to protect is the address aligned on a page boundary and we are
going to use base address of stack for that and that should go into our register.
So let's go ahead and find out the base address of Stack and let's place that in our exploit.
All right.
Let's clear the screen and let's use the map stack.
This is going to be the base address of stack.
So I'm just copying this and let's open our exploit and let's use junk and let's use the same pack function
with Q 464 bit addresses
and let's paste the base address of the stack.
Let's quickly add a comment here,
base address of stack.
All right.
So we are done with the first argument.
Finally, let's print the variable junk so we can produce the payload.
I'm just printing junk here.
Now let's give it executable permissions and let's run Robert Peel and produce the payload and save
it as payload one.
Now let's load this binary using gdb
and let's set up a breakpoint at main and let's run the binary using the payload as input.
Now let's get the disassembly of one underscore function and let's set up a breakpoint at this thread
instruction.
We just want to check if everything is fine so far without exploit.
All right.
Let's quickly check if stack is executable.
As you can see, stack is not executable at this point of time.
Let's clear the screen and let's type continue so that the execution will continue and we will hit the
breakpoint.
If you notice, we are about to execute this red instruction which is actually pointing to the address
of pop die, which is actually our gadget.
So if you type C, we should land on this gadget and we are about to execute, pop, die.
And once this instruction gets executed, whatever the value that is placed on the top of the stack
is going to be popped into our die.
Currently the register contains something here.
Now let's type ACI before that.
Notice what we have on the top of the stack.
This is the base address of stack.
We can quickly double check that.
You can see this here.
This is the best address of the stack, and that's what we have here.
So let's type ACI and examine the register.
Look here, we do have the best address of stack in the register, so the first step of our exploit
is successfully completed.
Now let's quickly review what we have done so far.
We have placed 256 A's plus eight B's.
That's the offset to RFP.
And once we reached RFP, we have placed the address of a gadget which contained the RET instructions.
After placing that address here, we have placed the base address of stack and once this idea gets executed,
the value which is being pointed by RSP Register, which is here, which is the top of the stack is
going to be popped into our register.
So that's what we have done so far.
We have set up the first argument that we need for MX protect function.
Now let's go back and set up the second argument just to give you a recap.
Our site should contain the second argument and the value that we are going to use.
Is this right?
So let's go back to the virtual machine and find out a gadget that contains the instruction pop side.
Let's quit from this GDB session.
And let's search for gadgets with the instruction pop odyssey.
Here it is.
We found a gadget with pop outside red.
So let's copy this address and let's go back to our exploit.
Let's once again use junk pack.
Let's see, underscore base plus the offset that we have just gotten from rapper.
Like we did earlier.
Let's just copy this.
And let's use it as a comment.
So that's the address of Pop RC Red.
Remember, we don't have to worry about the base address of Lipsy.
It is going to be constant because we are only dealing with an and ASLA is disabled.
All right.
So we are done with this instruction now.
We will have to set up the value for this pop site instruction.
As we just discussed.
This value is going to be.
0601010101.
There is no hard rule that you should take this value.
I'm just taking this because I was just using this value in 32 bit exploit development because in 32
bit exploit development, this is the largest value that you can take without causing any null bytes.
So in this exploit, we are not going to deal with null bytes anyway.
So I'm just taking the same value and let's see if it works.
So I'm just commenting here.
Size of the memory region.
All right, now let's once again save this file, produce the payload, and let's save it as payload
to it is easier to debug while we are at the beginning once after completing the full exploit, if it
is failing somewhere in between, it will be slightly harder to debug it.
So it's a good practice to check as and when we are finishing something since we are done with setting
up the second argument, let's quickly make sure that everything is working fine.
So let's load the vulnerable binary using GDB and let's set up a breakpoint at main.
Let's run this binary using the payload that we have just generated and let's use this as one func.
There is a typo.
Let's quickly fix that.
There you go.
And let's set up a breakpoint at read instruction once again.
We are going to do this multiple times.
So you have to be patient enough while writing this exploit.
Now let's clear the screen and let's type C to continue execution so we will land on the breakpoint.
There you go.
Now, we have already seen this first gadget being executed earlier, so I'm just going to quickly type
C now.
This is going to pop the base address of stack into our die.
Once after executing the pop, the read is the next instruction that we are executing and this read
instruction is going to redirect the control to the instruction that is on the top of the stack.
If you notice, the address is ending with the D 5 to 9.
This is what we are going to execute next.
And if you check the top of the stack at this point of time, this is the same address.
So this read is redirecting the control to the address that is available on the top of the stack.
And if you remember, this is the address that we placed.
This is the address of Pop RC Gadget.
Here it is.
Right.
So and that's the reason why we are placing the addresses of these gadgets one after the other.
Now, if you execute this RET instruction, we should land on the next gadget which contains pop RSA
instruction.
So let's type C now we are about to execute pop RC instruction.
If we execute this pop RSA instruction, what are the value that is on the top of the stack should be
popped into RSA register.
If you notice, currently RSA Register contains the value zero and the top of the stack contains the
size that we specified earlier.
So if we type C RSA should contain this size, there it is.
You can see here RSA Register now contains this value.
So that completes our second step.
Once again, let's review the stack using a pictorial representation.
This is what we have done so far.
We have placed pop the red, we have placed the base address of the stack and then we have used pop
RSA, Red Gadget.
When it is executed, the value on the top of the stack, which is the size that we specified, is popped
into RSA Register.
Remember when this red instruction is executed, r.p is going to be pointing to the next instruction,
which is going to be here right when our app comes here, RSP comes here, remember that.
So that it will be easier for you to understand what RSP is pointing to.
All right.
Now let's start working on setting up the third argument for MW Protect.
Once again, to recap, the third argument is going to be placed in ADX register and it is going to
contain the value 0x7.
So that stack becomes executable.
Right?
Let's switch to the virtual machine and let's set it up.
Let's exit from this Jeff Shell
and let's edit Robert Peel and we will need a gadget with pop RDX instruction.
So let's go to Wrapper Shell.
Let's search for top RDX.
Unfortunately, we did not find gadgets of our interest.
So what we can do is we can increase the depth.
So let's specify two here and let's search for the gadgets once again.
Interesting.
We have gotten some gadgets.
This is what I'm going to go with, pop.
RDX is what we wanted and it has read instruction.
It has one additional instruction that we will have to deal with.
I'm going to show you how we can deal with that.
But you can actually go with this instruction or this instruction.
Both of them are looking simple, so I'm just going to go with this.
I'll copy this and let's edit the exploit junk pack
and let's use let's see, underscore base plus the offset.
Now let's copy the instructions.
And let's paste it here.
All right.
Now we will have to specify.
The value that is to be popped into the register.
So let's use pack.
And let's use 0x7.
It's as simple as that.
Now we can quickly add a comment here.
Permissions read, write, execute.
Now, if you notice, after pop is executed, this value is going to be popped into RDX.
After that, before executing this read instruction, pop art 12 is going to be executed.
What that means is we will have to place some junk value here so that that will be popped into our 12
register before we execute that instruction.
Now, the next step is to set up some dummy value for this pop art instruction, because when this pop
12 instruction gets executed, it expects some value to be popped into the register at 12.
So let's set up some junk value here
back and let's use zero x 41, 41, 41 six times.
And let's simply add a comment, dummy, for pop art.
So that should do it.
Now, let's save the file and let's, as usual, produce the payload.
Let's call it payload three and let's use gdb be vulnerable and let's load this binary and let's set
up a breakpoint at main.
Let's run this binary using this third payload which is payload three and let's use disassemble one
function and let's set up a breakpoint at this address
and let's type continue so that our breakpoint will hit.
Here it is.
We are once again about to execute our gadgets.
So let's type C, C, see, this is the second gadget.
Now we are at Pop RDX.
Let's quickly take a look at the contents of RDX register.
At this point of time, if you notice, it contains the value zero.
So let's type C so that this value seven will be popped into the register, RDX.
Let's quickly take a look at the contents of RDX.
There you go.
It now contains the value seven.
Now this is our extra instruction that we didn't want, but we have no choice.
We need to include this in our exploit.
So let's type C before that, let's take a look at the top of the stack.
This is what we placed on the top of the stack, six A's.
So this is going to be popped into the register at 12.
So let's type a, C and look what we have are 12 register here.
This is the value that we have just popped, right?
So that means we have set up everything that we want.
Now all we need to do is we need to call and protect function.
So let's go ahead and find out the address of protect function once again.
Here it is.
Let's quickly copy this.
And let's exit from the shell and let's edit the file.
Robert Peel
Junk Pack.
Q And the address of Protect.
Let's add it in the comments and Protect.
Now before we run this in GDB, let's take a quick look at our slides to understand the stack that we
have built so far.
So this is where we left off earlier.
Now, after this, our AP comes here and we have placed the address of this gadget as the next instruction
to be executed.
And we have set up two values for this.
RDX and RTL registers in the next two entries.
RDX is going to have this value seven and at 12 is going to have these six A's.
After doing this, we found the address of M Protect and we have placed that here.
Once M Protect gets executed with all these parameters, the stack is going to be executable and the
control will come here.
Here, we will have to place some address that points to the shell code.
Let's first check if M protect is turning the stack into an executable one.
Once that is done, we are going to place an address here so that we can redirect the execution to our
shell code.
Let's switch to the virtual machine and let's save this file.
Let's produce new payload.
Let's call it payload for let's use gdb dot slash vulnerable dash queue.
Let's set up a breakpoint at main.
Let's run this program using payload four.
Here you go.
Now let's once again find out the address of read instruction
and let's set up a breakpoint here.
We can simply use the up arrow to see the history of commands that we executed.
But I just want to get the disassembly every time I come here, because that gives you a clear picture
of why I'm doing something.
So I'm just copying this address.
Let's set up a breakpoint here and let's continue the execution.
Now, before we execute these instructions, let's quickly take a look at the output of the map stack
command.
If you notice, currently the stack is not executable.
Let's type C rather.
Let's probably find the address of and project and let's set up a breakpoint here.
There it is.
Now, if we type C to continue the execution, we should hit this breakpoint.
If our exploit is working, fine.
So let's hit enter.
There you go.
The breakpoint is hit and we are now inside the protect function.
Once again, if you check the output of the map stack, the stack is still not executable because we
are still in the beginning of m protect.
Once we execute some of the instructions in m protect, we should see the stack being executable.
Look at that.
Now the stack is executable.
This means once end product finishes its execution, it is going to return back and there we can start
executing our shell code.
So let's go back and add the shell code to our exploit and finalize it.
Let's quit and let's use dot PL and let's grab the shell code that we have written earlier.
So I'm just going to quit this wrapper and let's navigate to shell code directory.
And let's go to exit.
We.
And let's take a look at the contents of exploit dash final appeal.
If you remember, this is the excavation code that we have written earlier.
So let's copy this
and let's create a variable called shell code here with the shell code that we have created.
And let's also place some knobs in the beginning.
I'm just going to use about 30 knobs.
All right.
So we have knobs and shell code.
We will have to adjust this offset here by including the length of the knobs and shell code so we can
properly overwrite our BP and AP registers.
What I'll do is I will use 256 minus the length of the shell code, minus the length of knobs.
That should still give us 256 bytes, which is the offset to RVP.
Finally, we will have to print this knops shell code and junk.
So I'm just going to use knops dot.
So it will be appended.
Shell code dot junk.
So our payload contains 13 ops followed by the shell code and followed by the rest of the payload that
we have just created.
So let's save the file and let's produce the payload using file name payload five
and let's load the vulnerable binary using gdb.
And let's set up a breakpoint at main.
Let's run it using payload five.
And let's once again use this as one underscore funk and let's set up a breakpoint at this red instruction
and let's continue with the execution.
So it will hit the breakpoint.
Here it is.
Now we are about to execute this read instruction.
Now let's type C.
Let's type C until.
We reach and protect address.
Here it is.
Now we are at the right instruction and we are about to execute and protect function.
Now, at this point of time.
If you execute the entries on the stack, we should be able to see the shell code.
Here it is.
If you notice, here is our bobsled.
So let's just take this address.
And let's quit.
Let's open our exploit and let's use this address here.
So once the project finishes its execution, it will return to this address, which is actually pointing
to our ops.
And once the execution lands on the bobsled, it will eventually reaches the shell cord.
So once the control reaches the shell cord, we are going to get a shell.
Right.
So this is hardcoded address of bobsled.
All right.
So let's save the file and let's try to run this exploit drop dot pl and let's use cat
one.
Let's type it.
There is a segmentation fault.
Let's check if we have a code file.
There is no core file.
So let's use you limit dash see unlimited and let's run the file once again.
There is a segmentation fault and we have a core file.
Let's type gdb dash core and space core.
So this should allow us to analyze the code dump and looks like this is what is causing the segmentation
fault.
So let's copy this address and let's see what it is pointing to.
X slash 50 g x and let's use this address.
Ideally, this should be pointing to the knop slide which is here, but it is pointing to this null.
So that's the reason why the exploit failed.
So the address is slightly different outside gdb.
So let's copy this address and see if it helps.
I'm just copying it here.
It's quit
dot pl.
And let's replace this address with what we have just in place it here.
And let's save the file and let's run the exploit once again.
Let's hit enter once again.
Let's type some command and look at that.
The exploit worked.
So we've got a shell even when there is an X bit enabled and we got the shell using the custom shell
code that we have written.
So basically in this exploit, everything is written from scratch, including the shell code.
And if you have practically done everything that is shown in the course till now, that's a great achievement
and you should really appreciate yourself.
I hope you have enjoyed building this drop chain.
I know it is tiring to do it from scratch.
We can use some automated tools to generate this, but doing it manually gives you a clear picture of
how rope chains are built.
I hope you have enjoyed the journey of building rope chains, and that's the end of this video.