x86_64 linux 中的 ROP 开发

逆向工程 开发 缓冲区溢出 x64
2021-07-05 10:50:44

我正在 x86_64 Linux 上进行面向返回的编程开发。然而,我的研究导致在 64 位 Linux 机器上不可能利用 ROP,因为所有代码段都加载在空字节前导地址中。这是真的吗?

Gdb,Sections:
(gdb) i file
    `/home/******/Desktop/BOF/lib64', file type elf64-x86-64.
    Entry point: 0x400ffc
    0x0000000000400190 - 0x00000000004001b0 is .note.ABI-tag
    0x00000000004001b0 - 0x00000000004001d4 is .note.gnu.build-id
    0x00000000004001d8 - 0x00000000004002f8 is .rela.plt
    0x00000000004002f8 - 0x0000000000400312 is .init
    0x0000000000400320 - 0x00000000004003e0 is .plt
    0x00000000004003e0 - 0x0000000000494808 is .text
    0x0000000000494810 - 0x000000000049614c is __libc_freeres_fn
    0x0000000000496150 - 0x00000000004961f8 is __libc_thread_freeres_fn
    0x00000000004961f8 - 0x0000000000496201 is .fini
    0x0000000000496220 - 0x00000000004b6224 is .rodata
    0x00000000004b6228 - 0x00000000004b6230 is __libc_atexit
    0x00000000004b6230 - 0x00000000004b6288 is __libc_subfreeres
    0x00000000004b6288 - 0x00000000004b6290 is __libc_thread_subfreeres
    0x00000000004b6290 - 0x00000000004c32ac is .eh_frame
    0x00000000004c32ac - 0x00000000004c33b9 is .gcc_except_table
    0x00000000006c3ea0 - 0x00000000006c3ec0 is .tdata
    0x00000000006c3ec0 - 0x00000000006c3ef8 is .tbss
    0x00000000006c3ec0 - 0x00000000006c3ed0 is .init_array
    0x00000000006c3ed0 - 0x00000000006c3ee0 is .fini_array
    0x00000000006c3ee0 - 0x00000000006c3ee8 is .jcr
    0x00000000006c3f00 - 0x00000000006c3ff0 is .data.rel.ro
    0x00000000006c3ff0 - 0x00000000006c4000 is .got
    0x00000000006c4000 - 0x00000000006c4078 is .got.plt
    0x00000000006c4080 - 0x00000000006c56f0 is .data
    0x00000000006c5700 - 0x00000000006c8308 is .bss
    0x00000000006c8308 - 0x00000000006c8338 is __libc_freeres_ptrs

    0x0000000000400190 - 0x00000000004001b0 is .note.ABI-tag
    0x00000000004001b0 - 0x00000000004001d4 is .note.gnu.build-id
    0x00000000004001d8 - 0x00000000004002f8 is .rela.plt
    0x00000000004002f8 - 0x0000000000400312 is .init
    0x0000000000400320 - 0x00000000004003e0 is .plt
    0x00000000004003e0 - 0x0000000000494808 is .text
    0x0000000000494810 - 0x000000000049614c is __libc_freeres_fn
    0x0000000000496150 - 0x00000000004961f8 is __libc_thread_freeres_fn
    0x00000000004961f8 - 0x0000000000496201 is .fini
    0x0000000000496220 - 0x00000000004b6224 is .rodata
    0x00000000004b6228 - 0x00000000004b6230 is __libc_atexit
    0x00000000004b6230 - 0x00000000004b6288 is __libc_subfreeres
    0x00000000004b6288 - 0x00000000004b6290 is __libc_thread_subfreeres
    0x00000000004b6290 - 0x00000000004c32ac is .eh_frame
    0x00000000004c32ac - 0x00000000004c33b9 is .gcc_except_table
    0x00000000006c3ea0 - 0x00000000006c3ec0 is .tdata
    0x00000000006c3ec0 - 0x00000000006c3ef8 is .tbss
    0x00000000006c3ec0 - 0x00000000006c3ed0 is .init_array
    0x00000000006c3ed0 - 0x00000000006c3ee0 is .fini_array
    0x00000000006c3ee0 - 0x00000000006c3ee8 is .jcr
    0x00000000006c3f00 - 0x00000000006c3ff0 is .data.rel.ro
    0x00000000006c3ff0 - 0x00000000006c4000 is .got
    0x00000000006c4000 - 0x00000000006c4078 is .got.plt
    0x00000000006c4080 - 0x00000000006c56f0 is .data
    0x00000000006c5700 - 0x00000000006c8308 is .bss
    0x00000000006c8308 - 0x00000000006c8338 is __libc_freeres_ptrs
1个回答

这归结为您正在利用的错误类型。如果您的有效负载不能包含空字节(易受攻击的 strcpy),这可能会成为一个问题,但并非所有错误都有此限制。以文件类型解析方式的错误为例,它允许空字节。

也有可能使用一系列错误,例如堆喷射的想法。一般来说,你喷堆做其他“合法”的东西,如在此写了由corelancoder。他的 shell 代码,也就是你的 ROP 链,是他连续加载以“喷射堆”的部分位图文件,而该错误实际上是由 javascript 触发的,实际上并不包含 shellcode。

如果您只想在 ROP 上工作,而不必担心字节限制,我建议您编写一个简单的工具来测试您的 shellcode。

编辑对不起错误的线束。这显然是 64 位特定的。

#include <stdio.h>
#include <stdlib.h>

int data[10000000];

void start_rop(char * rop)
{
        __asm("mov (%rax),%rsp"); //move contents of first argument into the stack pointer
}

int main(int argc, char * argv)
{

        char  code[] = "AAAAAAAA";
        char * malloc_code = (char *)malloc(sizeof(code));
        memcpy(malloc_code,&code,sizeof(code));

        start_rop(malloc_code);

        free(malloc_code);
        return 0;
}