Welcome back to another video.
In this video, we are going to discuss a technique called Return to Play.
Using this technique, we can use the procedure in case table to bypass an X and a slot.
We will use the addresses of gadgets and functions from within the library.
So this particular technique has some prerequisites for the attack to work.
The binary should contain gadgets and functions that can be useful for our exploitation.
And the binary should be compiled using no p flag.
As I mentioned in the last lecture, now let's use the same binary that we have used to understand plt
and geode concepts since it meets all the requirements.
So let's switch to the virtual machine and let's begin writing this exploit.
Let's quit from this GDB session
and let's quickly take a look at the Makefile.
If you notice, we have no p flag set here.
So our binary is good.
And if you notice the vulnerable program, we have a system function being used within the program so
we can try to make use of the system function and we want a shell.
But this particular system function is just executing that command.
We don't want to execute that command as part of our exploit.
So we will have to find out the string SW edge and we will have to pass that as an argument to this
function.
So that's what we are going to do.
Now if you observe this binary also has the string S-H within the binary.
So we can try to find out the address of the string S-H and we can pass that as an argument to this
system function.
So let's see how we can do that.
As I mentioned earlier, this technique is going to bypass both an X as well as a slot.
So before we proceed further, let's quickly ensure that we have an X and a slot enabled.
If you notice, there is no dash z exec stack flag here.
That means by default the stack will not be executable.
And let's also go to the ASLA directory and let's quickly check if a slot is enabled.
Look at that.
A slot is enabled.
Let's once again go back to this red to play directory
and let's load the binary using gdb.
Now let's quickly run check seq.
And if you notice even check seq shows that an x is enabled.
Now let's quickly check what functions are available within the binary.
I'm just going to type in four functions before starting the binary.
Here it is.
If you notice, we have a system at PLT.
If you notice, as we have seen earlier, the binary has a call to system at PLT.
We can make use of this address and invoke it using appropriate arguments in order to execute system
commands like I mentioned earlier.
This defeats both SLA as well as an ex because we are not relying on the addresses from Lipsey and thus
we are not bothered.
Even if SLA is enabled, we are not executing any shell code on the stack and thus we are not worried
even if an X is enabled for this binary.
Now there is another way to obtain the address of this system at PLT.
We can just open up a new tab and type obj dump dash the vulnerable type grep
system
and we are just dumping three instructions after this address.
If you notice, 401070 is what we have gotten here.
This is the system function from GPC.
So this is the address of system function.
If you notice, we have the same address here.
401070.
And if you go back 401070 is what we have gotten even earlier.
So once again, we have gotten the same address using object dump.
Now the next goal is to find out an appropriate argument to system function so that we can get a shell.
Let's check if the binary has any references to the string.
So I'm just going to run the binary by setting up a breakpoint at main.
Now let's use Jeff's search pattern command and let's search for the pattern.
If you notice, there is a large output, so let's scroll up.
We want to look for the references within the binary so that we don't need to deal with an X and Aslan.
Here it is.
If you notice, there is one reference here.
This is the first reference that we have gotten and S.H. is actually available at 402029 address.
So we have gotten a reference to the string S-H.
Now we need to find a gadget that can place this address in Register D so we can call system function,
which will take S-H available in D as its argument.
So let's load the binary into rapper to be able to search for the gadgets.
I'm just going to the next tab and let's use wrapper.
Let's type file vulnerable.
Now let's search for the instructions for our D.I.
There you go.
Looks like we are lucky because we have gotten a useful gadget within the binary itself.
So basically we need three addresses.
The address of this gadget, the address of S-H string and the address of system function.
Right.
So let's begin writing our exploit and just opening up a new tab and let's type exploit dot p l, I
mean space exploit dot peel and let's once again write our regular lines of our exploit the shebang
this line.
And like we usually do, let's specify 256 characters, which is going to be the offset to our BP register.
We are using the same vulnerable function with 256 bytes of input.
So we are just going to use the same exploit template here and let's append a base and this is going
to be our BP.
And right after this, we should be able to override the saved return address, which is going to be
stored in our IP.
Now, this is where we want to specify the address of pop gadget.
So let's use junk and let's append pack
and let's specify the address of the gadget with the instruction pop, which is this.
So I'm just copying this.
And let's face it here, remember, we are just using the addresses within the binary itself so we do
not need to add it to the base address.
Let's also add a comment here with the instructions that we have gotten from the gadget.
Here it is.
We can just copy this.
Let's just paste it here.
So if you notice, this is pop the instruction.
So when pop the instruction gets executed, something which is on the top of the stack is going to be
popped into the register.
In this case, we want that something that is available on the top of the stack to be the reference
to asset string.
So let's use junk append pack with the option Q and let's specify the address of the string S-H.
So let's go back to the Jeff Shell.
And let's copy this.
402029.
And let's just play straight here once again, let's add this in the comments here,
S-H from Binary.
Okay.
Now we are done with setting up the argument for system function.
Now all we have to do is invoke system function.
So let's quickly grab the address of system function.
I'm just going to execute this once again here so we can just grab the address of system function.
PAC
q.
And we're just pasting it here.
Let's add Xerox in the beginning and let's use a semicolon.
And let's comment it out as system add pulled from binary.
And let's also add this as from binary.
There it is.
Now, once this is done, we can just print junk and let's see if this exploit works.
I'm just saving the file.
Let's give it executable permissions and let's quickly test it by using dot slash exploit pl cat and
let's pipe it to vulnerable.
Let's hit enter.
Let's type some command.
Oops.
There is a segmentation fault and the exploit failed.
We will have to delegate using gdb and understand what happened.
So let's first generate the payload using exploit pm and let's save the payload in the file payload.
Now let's use gdb dot slash vulnerable space dash queue.
Let's use this as one underscore function to get the address of this RET instruction as usual.
And let's set up a breakpoint here and let's run the binary using the payload that we have just generated.
There it is.
We have hit the breakpoint and we are now about to execute pop die, which is expected.
So let's type C.
Yes, we are about to place the address of the string S-H, which is looking fine.
So let's type C and we are now about to execute this red instruction which is going to take us to this
system at PLT.
Once again, this is expected, so let's type C now we are within this system at PLT, so let's type
continue.
There it is.
We encountered a segmentation fault at this instruction.
If you remember, we discussed this problem earlier.
This is a stack alignment issue, so we need to ensure that the stack is 16 byte aligned to fix this
like we did earlier.
We can add an address of read instruction in the beginning of our gadget chain.
So once again, let's go back and use our ROPPER tool to find out a gadget with the instruction read.
So I'm just going to use search slash one red.
Here it is.
We found one gadget.
Let's copy this.
And let's go back to our exploit.
Let's quit this shell.
Let's use vim, exploit, dot, peel, and let's place it right before this gadget pack.
And let's face it here.
Right.
All right.
Once again, this is from binary itself.
Let's save the file and let's try to execute the exploit once again.
Let's hit enter and let's type some command.
And there it is.
The exploit worked and we have successfully circumvented an X and a slot protections just by using the
addresses within the binary.
Remember we disabled P which stands for position independent executable and thus we are able to use
the addresses that we have used in our exploit.
So this is how a red two field technique works.
We need to have certain gadgets and functions available within the binary and P should be disabled within
the binary.
If these conditions meet, we can easily exploit a binary, even when an x and slot are enabled.