Linux (x86) Exploit development Series 5: Using the RET2LIBC chain to bypass NX

A simple-to-chain multiple libc functions is-to-place one libc function address after another in the stack, but its no T possible because of function arguments.

Chaining Seteuid, system and exit would allows us to exploit the vulnerable code ' VULN '. But was not a straight forward task because of below the problems:

1 Only one function can be overridden on the return address

2 The Seteuid parameter is 0,strcpy truncated

problem 1: To address the problem Nergal talks about the brilliant techniques

1. ESP Lifting
2. Frame faking

Here lets see only on frame faking since to apply ESP lifting technique binary should be compiled without frame pointer (-fomit-frame-pointer) Support. But since our binary (VULN) contains frame pointers, we need to apply frame faking technique.

Frame faking?

In this technique instead of overwriting return address directly with libc function address (seteuid on this example), we Overwrite it with "leave ret" instruction. This allows the attacker to store function arguments in stacks without any overlap and thus allowing its corresponding libc function to be invoked

How a leave RET instruction invokes a libc function above it?

To know the answer for the above question, first we need to know about "leave". A "Leave" instruction translates to:

mov ebp,esp            //esp = Ebppop ebp                //ebp = *esp

problem 2: In We case Seteuid_arg should is zero. But since zero being a bad character, how to write the zero at stack address 0xbffff210? There is a simple solution to it, which are discussed by Nergal in the same article. While chaining libc functions, first few calls should is strcpy which copies a NULL byte into Seteuid_arg ' s stack location .

Note: But unfortunately in my libc.so.6 strcpy's function address is 0xb7ea6200–ie) libc function Address Itsel F contains a NULL byte (Bad character!!). Hence strcpy cant is used to successfully exploit the vulnerable code. sprintf (whose function address is 0xb7e6e8d0) are used as a replacement for strcpy IE) using sprintf NULL byte is copied I N to Seteuid_arg's stack location.

Thus following libc functions is chained to solve the above both problems and to successfully obtain root shell:

sprintf | sprintf | sprintf | sprintf | Seteuid | System | Exit

Linux (x86) Exploit development Series 5: Using the RET2LIBC chain to bypass NX