ROP Exploit

ROP Return Oriented Programming (ROP): is a hacking exploit technique where you exploit buffer overflow to inject a chain of gadgets. Each gadget returns to the next gadget until hacker program is eventually executed. Gadgets: a set of useful instructions terminated by a “return” instruction (ret binary instruction code is c3). Usually, they are not part of a function bodies, so they do not have a “leave” instruction.

Overview Idea: In our exploit, we intelligently modify the return address so that it executes our Gadgets. For our exploit to work, we need a vulnerable application and a set of gadgets.

Vulnerable Code

Our aim is to spawn a shell using EXECVE function.

Execve Function Syntax: execve(const char *path, char *const argv[], char *const envp[]) Functionality: The execve function executes the program pointed to by filename. Arguments: argv is an array of argument strings passed to the new program. envp is an array of strings, conventionally of the form key=value, which are passed as environment to the new program. %eax shall have: execve identifier0x0b (or 11) %ebx shall have: const char *pathA pointer to “/bin/sh” %ecx shall have: char *const argv[]A pointer to “/bin/sh” pointer array %edx shall have: char *const envp[]NULL

Execve Function When the %eax is configured as 11 in our ROP exploit it invokes the execve function since the system call number of the execve function is 11. The objective of our exploit is to invoke this execve function for /bin/sh. /bin/sh is passed as an argv argument to the main and its pointer is stored in %ebx register through the gadgets. Pointer to/bin/sh pointer array is stored in %ecx register through the gadgets. Remember, it does not have to be /bin/sh. It could be telnet ! Since /bin/sh can run with no environment variables, NULL is stored in %edx register through the gadgets as well. A total of more than 400 gadgets!

Gadgets For the purpose of our project, we have utilized 9 gadgets. Gadgets are loaded with the vulnerable Code. Real hackers have gadget scanning tools to find and list useful gadgets as per their preference.

Gadget1 This particular gadget will Initialize %eax to 0.

Gadget2 This Gadget will initialize %eax to 1.

Gadget3 This Gadget will increment %eax by 1.

Gadget4 This Gadget will multiply %eax by 2.

Gadgets 5, 6 and 7 This Gadget will move %eax to %ebx, %ecx and %edx.

Gadget 8 This Gadget will add %eax to %edx and then move %edx to %eax.

Gadget9 This gadget will Interrupt for system call.

Exploit Compiling Options: gcc –o ROP ROP.c -mpreferred-stack-boundary=2 –fno-stack-protector –ggdb – std=c99 Exploit Input: ….$./ROP `cat payload1` `cat payload2` /bin/sh./ROP: vulnerable executable. payload1: input1 to the first string copy redirecting the pointer of input2 to return address location. payload2: gadget chain to spawn the shell (execve as /bin/sh) bin/sh/: passed to main as argv[3] since there is no boundary to argv entries!

Before first strcpy RETURN EBP POINTER FOR input2 input1 (16 BYTES)  Our first string copy fills the input buffer with A’s and the pointer of the second input with our return address pointer.

After first strcpy RETURN EBP POINTER OF input2 CONTAINS RETURN ADDRESS POINTER input1 (16 BYTES) FILLED WITH A’s  Our input = 16A’s + Return Address Pointer  After first string copy our input buffer will be filled with A’s and the pointer now contains the return address pointer.

After Second strcpy.... GADGET 5 GADGET 4 GADGET 3 GADGET 2 GADGET 1 EBP POINTER (WILL BE FILLED BY RETURN ADDRESS POINTER) INPUT(16 BYTES)  Our second string consists of gadget address chain.  After second string copy all the gadgets will be placed on the stack starting from return address.  When main completes its execution and performs ret, our gadget chain will be executed.

Screenshots of Demo

Pointer is filled with the return address

Gadgets

Demo Recording Time!

Exploit Evolution Firstly, we used the concept of ROP to perform exit(1) using our gadgets. Then, we used the concept of ROP to perform exit(5) using our gadgets. Next, we redesigned the exploit to spawn a hardcoded “/bin/sh” shell. Finally, we redesigned it to spark flexible system calls.

Things to Avoid Return address pointer or gadget address that have 0x00. Null byte will terminate strcpy function. Return address pointer or gadget addresses that have 0x20. Space will terminate an argv string.

Task Assignment Ali Qahtani Himanavanth Reddy Manobiram Vangeepuram Harshil Pandya Reading and Brainstorming ×××× Vulnerable Code Design ×× Gadget design×× Exploit Design×× Verification and Testing ×××× Exploit Evolution×× Slides and Demo Development ××× ×

Thank you !