All right, let's check if I'm recording.
Yes, I am.
All right.
So welcome back.
And we're now going to do something more advance.
We have yet to do the RET to plot attack, but we're going to create a shell string by abusing stir
copy.
Before we do that, let's cover what calling conventions are for Linux x86.
So the way that Linux x x 64 I'm sorry, I just have a lot of people annoying me right now.
So how it happens is that in Linux use function, RTI register RC Register, RTX, register RC X register
R eight and R nine and anything else pass the six argument is actually going to be a distance from the
return stack pointer.
So we're actually going to be using a hardcoded star copy function or string copy function to pop a
shell on this vulnerable binary.
And we're going to be copying the words S and H into the right data segment and then calling system
on the RTI register to invoke our root level shell.
So this is where it's going to get a little bit more difficult.
So we're going to go back to our session and then we're going to do GDB three vol dash queue.
Then press r let's just x out of control.
See the map.
Oh, my God.
No, sorry.
Just somebody on discord to load the.
The address range of our binary.
We only care about what starts here and what starts stops here.
So we're going to do set start and then click on the end, set, end.
And we're going to search for our strings, which is basically the characters S and H.
So what you do, debug or Jeff, is search pattern s, start dash and so make sure you put the C variables.
I'm just going to stop discord right now.
Oh, my God.
Okay.
Quit Discord.
Finally.
And then we're going to enter the binary three volume.
So we have the character SE in this memory address.
So we're going to put this and we're going to save in our script.
So from home import star.
Let's see a temp three pi.
This address equals this, and then we're going to do it again for the H character.
So we've found an H right here somewhere, right?
H address equals this.
Once again, we're going to go back into our function.
So we're going to go into our debugger and we're going to do disassemble show date.
And when I disassemble this memory address, you notice that is different.
And I just want to point out that the so called right here.
All right.
This address may be different depending on what kind of virtual machine, an app that you're running
this on.
So just take note that this address right here could be different.
But in our case, the this call is actually the same address.
So we're going to do this call equals this.
And finally we need a section to read or to write our SE and H into our rock chain.
So let's go back.
We're going to split the screen.
We're going to read L.
s/3 vol.
Selfie.
All I did was press control Z, by the way, Control Z and it zooms.
So notice that the data section right here, which starts at this memory address, is writable.
So we can actually use this and insert our shell function or our shell variable.
So we can call this a write two equals number hex that.
And we also have a unused stored copy function.
So we're going to go back, disassemble on, used
and of course, store copy.
Now make sure to disassemble this memory address, which is disassemble here.
And note that a copy is called at this memory address, which is actually exactly the same.
But like I said before, depending on your compiler version, this could be a different address.
So be wary of that.
So of use stir copy func equals this.
And we're also going to have like an issue of ROPPER because when we search for our gadgets in ROPPER,
so control be shift five ROPPER, three ROPPER file three bones.
We're not going to find like a proper pop RSI instruction, but we will find a proper pop RTI instruction.
So first we want to go search for search def one return.
This would be nice to use rat equals.
We're also look for search pop RTI.
Pop RTI and search pop.
RC So this is the issue I'm talking about is that we have an additional instruction.
AR 15 We do not have any other ways of having a pop or a side instruction alone, but we will have a
workaround for that.
So let's just copy this memory address.
Pop our CI pop AR 15 return.
With these gadgets in hand.
What you want to do is that you need to write a dummy address because a 64 bit register can hold eight
bytes or 64 bits.
So 64 divided by eight is eight bytes.
So we're going to write a dummy address, turn it to bytes.
Multiply by eight characters.
We're going to use the same buffer overflow vulnerability that we have before.
Remember this one overwrites the return base pointer above plus equals B.
Ex 42 or if it are just loops x 42
times eight overwrites return a stack pointer and now we're going to copy the character s to the data
section.
Sort of add to our buffer or rock chain tack 64 return.
Remember this is what's happened is struct pack pack little Indian 64 bit return address from here.
So buff again plus equals P60 for top RTI return above plus equals P 6 to 4.
Right two.
That's our location instead of the data segment of the data segment to write the characters.
sh2.
Above plus equals p capacity for se address.
Write the character s data buff plus equals dummy.
Above plus equals p64.
Stir copy func.
Now we're going to copy the Chapter two data to the data segment.
So we're going to repeat it.
So maybe I did not explain this enough in ROP training, but you can reuse your gadgets as much as you
want, as long as you can fulfill the correct calling conventions.
So what we're going to do is.
Both plus equals taxi for pop rti ret buff plus equals P 64.
Right.
Two plus hex one.
Now, the reason why we're doing this is we are seeking plus one fight because we don't want to overwrite
our s character in the data segment.
So we're going to move past the right to location.
So we're just adding one to this character right here so we can put our H right there.
Finally we're going to use our P 64 pop RC Pop R 15 return.
And then we're finally pushing our h character
plus plus equals dummy buff plus equals p62 for coffee.
And now we have to call our shell.
Well, if the system functions.
So now we're going to call system RTI.
So it's going to be five plus equals attack 64 pop RTI ret buff plus equals.
Is the floor.
Right to.
Above plus equals p 64 system.
And then we're just the standard standard in standard out.
BUFFER Right.
Buff Which means it just writes to the screen and the re directs it.
So let's see if this exploit works.
I may have made a mistake somewhere.
Let's go back.
Let's control B split.
Nano attempt three pi.
Let's see.
Python three, three.
Oh, we do have a mistake.
Cisco.
And attempt three.
This won't work.
It's less clear.
So Python three.
Let's see.
Attempt three.
Pi semicolon cat semicolon type dot three phone.
We ask you to a date time function.
Press enter again.
ID okay, we have a sec.
Let's see what's going on.