RET2LIBC Exercises (1)--zwsetinformationprocess

It took two half nights to get the 0day security of this book's first experiment around DEP done, here to make some notes.

RET2LIBC my own understanding now is that in the case of DEP protection, the other executable location of the program can be found to meet the requirements of my command, to form an executable sequence of instructions to achieve the purpose of successful execution of Shellcode.

So the first way to take advantage of RET2LIBC is through the zwsetinformationprocess function, which can shut down DEP protection directly in the process and execute shellcode.

The first thing to know is that the DEP identifier for a process is in the _kexecute_options of the kprocess structure, and the concrete structure of _kexecute_options is this:

　　

The first 4bit of the identity bit is related to DEP, when DEP turns on Pos0 1,dep off POS1 1,pos3 1 indicates that the identity bit cannot be modified, so the first 2 bits that affect the DEP state are only required to be set to 00000010.

Next is the Zwsetinformationprocess function:

　　

The first parameter of the Zwsetinformationprocess function is clearly the handle of the process, set to 1 when the current process is identified, the 3rd parameter is used to set the _kexecute_options, only the binary value of this parameter the last two bits is 01, The fourth parameter is the length of the third parameter.

The next step is the specific experimental steps:

According to the instructions in the book, with Ollyfindaddr this plugin, Disable DEP, Disable dep<==xp SP3 Search, It's not clear why this is starting here instead of jumping directly to the entrance to the zwsetinformationprocess function, leaving a question here, using the plugin od to search for an address that is also 0x7c93cd24, and the assembly instruction that points to CMP AL, 1, so in order to satisfy this judging condition, the first step is to find the Al assignment to 1 of the instructions, all MOV eax,0x1; MOV al,1 Theoretically can, here I used the ID of the Mona plugin, find the corresponding instruction address on OK, in order to secure, choose the same address as the book, so my ROP chain is now:

" \x52\xe2\x92\x7c " // MOV al,1 " \x24\xcd\x93\x7c " // turn off the start address for DEP

Of course, the ROP chain will be adjusted according to the situation, and then as the same as written in the same book, run to the address of the EBP-4 to write data when the exception, because the previous bytes overwrite the address of the EBP-4, so the program wrote an invalid address, need to fix EBP, Then run to this to view the values of each register, and find that the value of ESP is appropriate for the EBP, so find the push esp; POP EBP; RETN's instructions to correct ROP are as follows:

" \x52\xe2\x92\x7c " " \x85\x8b\x1d\x5d "//correction EBP " \x24\xcd\x93\x7c "

Continue to run, the breakpoint at call Zwsetinformationprocess, observe the zwsetinformationprocess parameters, that is, note zwsetinformationprocess used to set the _kexecute _options's third parameter, which is just good for 0x22 (00100010), the last two bits is 01 and does not need to be modified. Continue down, go to 0x7c93cd6f, RETN 4 This place, this time the value of the ESP point to the address is 0x00000004, which is the result of the previous zwsetinformationprocess function of the parameters of the stack, so after the revision of EBP, The ESP should be amended to prevent the impact of ROP.

Then according to the method found in the book Retn 0x28 the address of this command, so now the ROP is this:

" \x52\xe2\x92\x7c " " \x85\x8b\x1d\x5d " " \x19\x4a\x97\x7c " // Increase ESP " \x24\xcd\x93\x7c "

However, the problem is that the stack is caused by the offset of the RETN 0x4:

　　

ESP should point to 0x7c93cd24 skip to the code that turns off DEP but points to the next stack, so ROP is modified to:

" \x52\xe2\x92\x7c " " \x85\x8b\x1d\x5d " " \x19\x4a\x97\x7c " " \x90\x90\x90\x90 " " \x24\xcd\x93\x7c "

This ensures that the program enters the process of shutting down the DEP code after the ESP is increased.

Then the program will go smoothly into the shutdown DEP code, and then go down to 0x7c93cd6f this place, this time found that ESP points to the previous 4 90 filled stack, it is clear that after the execution of 0X0013FEBC this command address, ESP jumps to the 0X0013FEC4 stack address, obviously, 0X0013FEBC we can put in jmp ESP's instruction address, then the code jumps to 0X0013FEC4, When we look at the stack carefully, we can see that there are 176 bytes of shellcode from the 0X0013FEC4 This place has 200 bytes far away, so finally in 0x0013fec4 this place to jump back 200 bytes of instruction, because this time DEP has been closed, So the stack can be put on executable code.

The last ROP chain:

" \x52\xe2\x92\x7c " " \x85\x8b\x1d\x5d " " \x19\x4a\x97\x7c " " \xc7\x31\x5a\x7d " " \x24\xcd\x93\x7c " " \xe9\x33\xff\xff " " \xff\x90\x90\x90 "

Few tips:

1. The leave instruction in the assembly is equivalent to MOV esp,ebp; Pop EBP

2. The last bounce instruction extracts the machine code of 200 bytes back in VC6

2015/9/21

23:41

RET2LIBC Exercises (1)--zwsetinformationprocess