Hey.
So welcome back to Introduction to Exploit and Zero Day Discovery and Development.
This is going to be the final section of our summer 2022 remastering.
There will be more content coming after winter 2022 so after December.
But right now we're going to cover 64 bit Linux.
SLR Bypasses.
So briefly, SLR was not even optimized or even used for almost half a decade when it first came out
and there's actually a multiple implementations of SLR.
They may randomize the first two bytes of a Windows application for 32 bit Windows operating system.
They might randomize the last four bytes for our Linux 64 bit system.
Implementation of outer space layout randomization really differ between the time the operating system
platform and architecture, but for some time, outer space layout randomization was not fully utilized
because it was causing performance applications and to bypass ASLA, it was as simple as basically loading
or picking out functions or sections of the buffer of dynamic link libraries or shared object libraries
that do not have asleep protection compiled with it.
However, while that was the norm a decade ago, many binaries now have ASL are enabled by default being
able to bypass adverse base layout randomization, non executable data, execution prevention, stack
coronaries and buffer overflow protection is essential for modern user mode exploit development.
So in this section of the course, we have four bypasses using shell code lists drop chains not normally
I don't distinctive phi.
The difference between shell code lists and shell code involved rope chains, except that a shell code
of all rob chain actually puts your shell code right on the stack and then has Rob Chain point to it.
But we can do shell code lists, so it's just an entirely Turing complete function.
That means as Turing as an Alan Turing, the man who created what he called the the automatic machine
or the Turing machine.
So when we take over the instruction pointer, we're going to use a drop chain first to abuse a unused
shell function call, then a misconfigured CIS call to a binary, and then a more advanced overwrite
to that data segment with a CIS call.
And finally, which where I'm going to cover a lot more detail in this lecture is our RET to attack
our most advanced subject, which will be the focus of this section of the course.
So a plot stands for procedure linkage table and the got is called the Global Offset Table.
So if you read the documentation, I'm going to put in the resources for you in this lecture.
Basically when you compile a language with ASL are enabled, compile a C program that's dynamically
linked.
It does not have a global offset table entry.
You actually have to run the program first so that the linker for your operating system can actually
get the offset for the function that you're trying to do.
So here we are trying to figure out how to call print F to print a string.
We don't have a global offset table entry yet.
However, it's going to call the linker is going to linkers and provide an offset and then the global
offset table is going to be populated with the offset of the function to print up from the standard
C library.
So you have to run the program at least once, debugger or attach or not to have the global offset table
populated.
So I also notice this is that the red plot technique can also result in different offsets between whichever
operating system that you're attacking.
So be aware of that.
I've tested this in Linux as well as Ubuntu,
so the goal of the RET to plot attack is to overwrite and alter the value of our print f function's
global offset table entry to no longer print a print f but as system instead the offset is known beforehand
by calculating the disk between system and print.
F.
After the application is first run, we will walk through the steps of the wrap chain in the following
screenshots.
Okay, so now let's start with our rock chain that we have talked about before by altering the global
offset table entry.
So this right here on the left is where we hit our return at the end of.
At any function in our Rob chain begins.
So right now the instruction pointer is pointing to a pop RTI.
It's going to pop the print f address into the RTI register.
A further note you probably want to take note that the hardcoded shell function is actually located
right here.
We are now going to pop the value of the return stack pointer into the return base pointer, which is
going to be on our next slide.
And right now, remember that the RTI Register is actually holding the value of print f.
So because we do a terrific calculation, we're actually going to subtract the value of the return base
pointer, which holds the offset between print, F minus system, and then we're going to restore it
as a quad eight byte quadrant into the return location of the RTI Register.
And if you watch closely right here where my mouse cursor does that in the next slide.
It now becomes a system call.
So.
Oh, I should have went back.
The next instruction was to pop another valley into the RTI register, and the valley that I was popping
in was the variable shell.
So right now it's going to execute system with the first variable shell because that's your 64 bit calling
convention.
And if you were to delete all the breakpoints and then continue debugging and set another breakpoint
at B star system and then continue execution, it would stop right here with a call to Shell, which
was normally print f.