build/blog/rop-on-arm/index.html (view raw)
1<!DOCTYPE html>
2<html lang=en>
3<link rel="stylesheet" href="/static/style.css" type="text/css">
4<link rel="stylesheet" href="/static/syntax.css" type="text/css">
5<link rel="shortcut icon" type="images/x-icon" href="/static/favicon.ico">
6<meta name="description" content="Making stack-based exploitation great again!">
7<meta name="viewport" content="initial-scale=1">
8<meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1">
9<meta content="#021012" name="theme-color">
10<meta name="HandheldFriendly" content="true">
11<meta name="twitter:card" content="summary_large_image">
12<meta name="twitter:site" content="@icyphox">
13<meta name="twitter:title" content="Return Oriented Programming on ARM (32-bit)">
14<meta name="twitter:description" content="Making stack-based exploitation great again!">
15<meta name="twitter:image" content="/static/icyphox.png">
16<meta property="og:title" content="Return Oriented Programming on ARM (32-bit)">
17<meta property="og:type" content="website">
18<meta property="og:description" content="Making stack-based exploitation great again!">
19<meta property="og:url" content="https://icyphox.sh">
20<meta property="og:image" content="/static/icyphox.png">
21<html>
22 <title>
23 Return Oriented Programming on ARM (32-bit)
24 </title>
25<script src="//instant.page/1.1.0" type="module" integrity="sha384-EwBObn5QAxP8f09iemwAJljc+sU+eUXeL9vSBw1eNmVarwhKk2F9vBEpaN9rsrtp"></script>
26<div class="container-text">
27 <header class="header">
28
29 <a href="/">home</a>
30 <a href="/blog">blog</a>
31 <a href="/reading">reading</a>
32 <a href="https://twitter.com/icyphox">twitter</a>
33 <a href="/about">about</a>
34
35 </header>
36<body>
37 <div class="content">
38 <div align="left">
39 <p> 2019-06-06 </p>
40 <h1 id="return-oriented-programming-on-arm-32-bit">Return Oriented Programming on ARM (32-bit)</h1>
41
42<h2 id="making-stack-based-exploitation-great-again">Making stack-based exploitation great again!</h2>
43
44<p>Before we start <em>anything</em>, you’re expected to know the basics of ARM
45assembly to follow along. I highly recommend
46<a href="https://twitter.com/fox0x01">Azeria’s</a> series on <a href="https://azeria-labs.com/writing-arm-assembly-part-1/">ARM Assembly
47Basics</a>. Once you’re
48comfortable with it, proceed with the next bit — environment setup.</p>
49
50<h3 id="setup">Setup</h3>
51
52<p>Since we’re working with the ARM architecture, there are two options to go
53forth with: </p>
54
55<ol>
56<li>Emulate — head over to <a href="https://www.qemu.org/download/">qemu.org/download</a> and install QEMU.
57And then download and extract the ARMv6 Debian Stretch image from one of the links <a href="https://blahcat.github.io/qemu/">here</a>.
58The scripts found inside should be self-explanatory.</li>
59<li>Use actual ARM hardware, like an RPi.</li>
60</ol>
61
62<p>For debugging and disassembling, we’ll be using plain old <code>gdb</code>, but you
63may use <code>radare2</code>, IDA or anything else, really. All of which can be
64trivially installed.</p>
65
66<p>And for the sake of simplicity, disable ASLR:</p>
67
68<div class="codehilite"><pre><span></span><code>$ <span class="nb">echo</span> <span class="m">0</span> > /proc/sys/kernel/randomize_va_space
69</code></pre></div>
70
71<p>Finally, the binary we’ll be using in this exercise is <a href="https://twitter.com/bellis1000">Billy Ellis’</a>
72<a href="/static/files/roplevel2.c">roplevel2</a>. </p>
73
74<p>Compile it:</p>
75
76<div class="codehilite"><pre><span></span><code>$ gcc roplevel2.c -o rop2
77</code></pre></div>
78
79<p>With that out of the way, here’s a quick run down of what ROP actually is.</p>
80
81<h3 id="a-primer-on-rop">A primer on ROP</h3>
82
83<p>ROP or Return Oriented Programming is a modern exploitation technique that’s
84used to bypass protections like the <strong>NX bit</strong> (no-execute bit) and <strong>code sigining</strong>.
85In essence, no code in the binary is actually modified and the entire exploit
86is crafted out of pre-existing artifacts within the binary, known as <strong>gadgets</strong>.</p>
87
88<p>A gadget is essentially a small sequence of code (instructions), ending with
89a <code>ret</code>, or a return instruction. In our case, since we’re dealing with ARM
90code, there is no <code>ret</code> instruction but rather a <code>pop {pc}</code> or a <code>bx lr</code>.
91These gadgets are <em>chained</em> together by jumping (returning) from one onto the other
92to form what’s called as a <strong>ropchain</strong>. At the end of a ropchain,
93there’s generally a call to <code>system()</code>, to acheive code execution.</p>
94
95<p>In practice, the process of executing a ropchain is something like this:</p>
96
97<ul>
98<li>confirm the existence of a stack-based buffer overflow</li>
99<li>identify the offset at which the instruction pointer gets overwritten</li>
100<li>locate the addresses of the gadgets you wish to use</li>
101<li>craft your input keeping in mind the stack’s layout, and chain the addresses
102of your gadgets</li>
103</ul>
104
105<p><a href="https://twitter.com/LiveOverflow">LiveOverflow</a> has a <a href="https://www.youtube.com/watch?v=zaQVNM3or7k&list=PLhixgUqwRTjxglIswKp9mpkfPNfHkzyeN&index=46&t=0s">beautiful video</a> where he explains ROP using “weird machines”.
106Check it out, it might be just what you needed for that “aha!” moment :)</p>
107
108<p>Still don’t get it? Don’t fret, we’ll look at <em>actual</em> exploit code in a bit and hopefully
109that should put things into perspective.</p>
110
111<h3 id="exploring-our-binary">Exploring our binary</h3>
112
113<p>Start by running it, and entering any arbitrary string. On entering a fairly
114large string, say, “A” × 20, we
115see a segmentation fault occur.</p>
116
117<p><img src="/static/img/string_segfault.png" alt="string and segfault" /></p>
118
119<p>Now, open it up in <code>gdb</code> and look at the functions inside it.</p>
120
121<p><img src="/static/img/gdb_functions.png" alt="gdb functions" /></p>
122
123<p>There are three functions that are of importance here, <code>main</code>, <code>winner</code> and
124<code>gadget</code>. Disassembling the <code>main</code> function:</p>
125
126<p><img src="/static/img/gdb_main_disas.png" alt="gdb main disassembly" /></p>
127
128<p>We see a buffer of 16 bytes being created (<code>sub sp, sp, #16</code>), and some calls
129to <code>puts()</code>/<code>printf()</code> and <code>scanf()</code>. Looks like <code>winner</code> and <code>gadget</code> are
130never actually called.</p>
131
132<p>Disassembling the <code>gadget</code> function:</p>
133
134<p><img src="/static/img/gdb_gadget_disas.png" alt="gdb gadget disassembly" /></p>
135
136<p>This is fairly simple, the stack is being initialized by <code>push</code>ing <code>{r11}</code>,
137which is also the frame pointer (<code>fp</code>). What’s interesting is the <code>pop {r0, pc}</code>
138instruction in the middle. This is a <strong>gadget</strong>.</p>
139
140<p>We can use this to control what goes into <code>r0</code> and <code>pc</code>. Unlike in x86 where
141arguments to functions are passed on the stack, in ARM the registers <code>r0</code> to <code>r3</code>
142are used for this. So this gadget effectively allows us to pass arguments to
143functions using <code>r0</code>, and subsequently jumping to them by passing its address
144in <code>pc</code>. Neat.</p>
145
146<p>Moving on to the disassembly of the <code>winner</code> function:</p>
147
148<p><img src="/static/img/gdb_disas_winner.png" alt="gdb winner disassembly" /></p>
149
150<p>Here, we see a calls to <code>puts()</code>, <code>system()</code> and finally, <code>exit()</code>.
151So our end goal here is to, quite obviously, execute code via the <code>system()</code>
152function.</p>
153
154<p>Now that we have an overview of what’s in the binary, let’s formulate a method
155of exploitation by messing around with inputs.</p>
156
157<h3 id="messing-around-with-inputs">Messing around with inputs :^)</h3>
158
159<p>Back to <code>gdb</code>, hit <code>r</code> to run and pass in a patterned input, like in the
160screenshot.</p>
161
162<p><img src="/static/img/gdb_info_reg_segfault.png" alt="gdb info reg post segfault" /></p>
163
164<p>We hit a segfault because of invalid memory at address <code>0x46464646</code>. Notice
165the <code>pc</code> has been overwritten with our input.
166So we smashed the stack alright, but more importantly, it’s at the letter ‘F’.</p>
167
168<p>Since we know the offset at which the <code>pc</code> gets overwritten, we can now
169control program execution flow. Let’s try jumping to the <code>winner</code> function.</p>
170
171<p>Disassemble <code>winner</code> again using <code>disas winner</code> and note down the offset
172of the second instruction — <code>add r11, sp, #4</code>.
173For this, we’ll use Python to print our input string replacing <code>FFFF</code> with
174the address of <code>winner</code>. Note the endianness.</p>
175
176<div class="codehilite"><pre><span></span><code>$ python -c <span class="s1">'print("AAAABBBBCCCCDDDDEEEE\x28\x05\x01\x00")'</span> <span class="p">|</span> ./rop2
177</code></pre></div>
178
179<p><img src="/static/img/python_winner_jump.png" alt="jump to winner" /></p>
180
181<p>The reason we don’t jump to the first instruction is because we want to control the stack
182ourselves. If we allow <code>push {rll, lr}</code> (first instruction) to occur, the program will <code>pop</code>
183those out after <code>winner</code> is done executing and we will no longer control
184where it jumps to.</p>
185
186<p>So that didn’t do much, just prints out a string “Nothing much here…”.
187But it <em>does</em> however, contain <code>system()</code>. Which somehow needs to be populated with an argument
188to do what we want (run a command, execute a shell, etc.).</p>
189
190<p>To do that, we’ll follow a multi-step process: </p>
191
192<ol>
193<li>Jump to the address of <code>gadget</code>, again the 2nd instruction. This will <code>pop</code> <code>r0</code> and <code>pc</code>.</li>
194<li>Push our command to be executed, say “<code>/bin/sh</code>” onto the stack. This will go into
195<code>r0</code>.</li>
196<li>Then, push the address of <code>system()</code>. And this will go into <code>pc</code>.</li>
197</ol>
198
199<p>The pseudo-code is something like this:</p>
200
201<pre><code>string = AAAABBBBCCCCDDDDEEEE
202gadget = # addr of gadget
203binsh = # addr of /bin/sh
204system = # addr of system()
205
206print(string + gadget + binsh + system)
207</code></pre>
208
209<p>Clean and mean.</p>
210
211<h3 id="the-exploit">The exploit</h3>
212
213<p>To write the exploit, we’ll use Python and the absolute godsend of a library — <code>struct</code>.
214It allows us to pack the bytes of addresses to the endianness of our choice.
215It probably does a lot more, but who cares.</p>
216
217<p>Let’s start by fetching the address of <code>/bin/sh</code>. In <code>gdb</code>, set a breakpoint
218at <code>main</code>, hit <code>r</code> to run, and search the entire address space for the string “<code>/bin/sh</code>”:</p>
219
220<pre><code>(gdb) find &system, +9999999, "/bin/sh"
221</code></pre>
222
223<p><img src="/static/img/gdb_find_binsh.png" alt="gdb finding /bin/sh" /></p>
224
225<p>One hit at <code>0xb6f85588</code>. The addresses of <code>gadget</code> and <code>system()</code> can be
226found from the disassmblies from earlier. Here’s the final exploit code:</p>
227
228<div class="codehilite"><pre><span></span><code><span class="kn">import</span> <span class="nn">struct</span>
229
230<span class="n">binsh</span> <span class="o">=</span> <span class="n">struct</span><span class="o">.</span><span class="n">pack</span><span class="p">(</span><span class="s2">"I"</span><span class="p">,</span> <span class="mh">0xb6f85588</span><span class="p">)</span>
231<span class="n">string</span> <span class="o">=</span> <span class="s2">"AAAABBBBCCCCDDDDEEEE"</span>
232<span class="n">gadget</span> <span class="o">=</span> <span class="n">struct</span><span class="o">.</span><span class="n">pack</span><span class="p">(</span><span class="s2">"I"</span><span class="p">,</span> <span class="mh">0x00010550</span><span class="p">)</span>
233<span class="n">system</span> <span class="o">=</span> <span class="n">struct</span><span class="o">.</span><span class="n">pack</span><span class="p">(</span><span class="s2">"I"</span><span class="p">,</span> <span class="mh">0x00010538</span><span class="p">)</span>
234
235<span class="k">print</span><span class="p">(</span><span class="n">string</span> <span class="o">+</span> <span class="n">gadget</span> <span class="o">+</span> <span class="n">binsh</span> <span class="o">+</span> <span class="n">system</span><span class="p">)</span>
236</code></pre></div>
237
238<p>Honestly, not too far off from our pseudo-code :)</p>
239
240<p>Let’s see it in action:</p>
241
242<p><img src="/static/img/the_shell.png" alt="the shell!" /></p>
243
244<p>Notice that it doesn’t work the first time, and this is because <code>/bin/sh</code> terminates
245when the pipe closes, since there’s no input coming in from STDIN.
246To get around this, we use <code>cat(1)</code> which allows us to relay input through it
247to the shell. Nifty trick.</p>
248
249<h3 id="conclusion">Conclusion</h3>
250
251<p>This was a fairly basic challenge, with everything laid out conveniently.
252Actual ropchaining is a little more involved, with a lot more gadgets to be chained
253to acheive code execution.</p>
254
255<p>Hopefully, I’ll get around to writing about heap exploitation on ARM too. That’s all for now.</p>
256
257 </div>
258 <hr />
259 <p class="muted">Questions or comments? Open an issue at <a href="https://github.com/icyphox/site">this repo</a>, or send a plain-text email to <a href="mailto:icyph0x@pm.me">icyph0x@pm.me</a>.</p>
260 <footer>
261 <a href="https://creativecommons.org/licenses/by-nc-sa/4.0/"><img src="https://licensebuttons.net/l/by-nc-sa/4.0/80x15.png"></a>
262 </footer>
263 </body>
264 </div>
265 </html>