ineedcodes 1.6.0 → 1.7.0

package/skills/binary-protection-bypass/PROTECTION_BYPASS_MATRIX.md

@@ -0,0 +1,168 @@
+# Protection Bypass Matrix — Comprehensive Cross-Reference
+
+> **AI LOAD INSTRUCTION**: Load this for a systematic lookup of which bypass technique works against which protection, and what primitive is required. Assumes [SKILL.md](./SKILL.md) is loaded for individual protection details.
+
+---
+
+## 1. PROTECTION × BYPASS × PRIMITIVE MATRIX
+
+### ASLR Bypass
+
+| Bypass Technique | Required Primitive | Success Rate | Architecture | Notes |
+|---|---|---|---|---|
+| Format string leak | `printf(user_input)` | 100% (deterministic) | Any | `%p` leak stack/libc/heap addresses |
+| OOB read | Array bounds violation | 100% | Any | Read adjacent pointers |
+| UAF read | Use-after-free | 100% | Any | Read freed chunk fd/bk → libc/heap |
+| Brute force | Ability to retry | ~1/4096 (32-bit) | x86 only | Infeasible on 64-bit (28-bit entropy) |
+| Partial overwrite | 1-2 byte write | 1/16 per nibble | Any | Page offset (12 bits) is fixed |
+| ret2dlresolve | Stack overflow + writable area | 100% | Any | No ASLR knowledge needed |
+| SROP | Stack overflow + sigreturn gadget | 100% | Any | Set all registers without knowledge |
+| Return-to-PLT | Stack overflow | 100% | No PIE | PLT addresses fixed without PIE |
+| Stack reading | Fork server + crash oracle | 100% | Any | Byte-by-byte in child process |
+| stdout FILE abuse | Write to stdout structure | 100% | Any | Partial overwrite `_IO_write_base` |
+
+### PIE Bypass
+
+| Bypass Technique | Required Primitive | Success Rate | Notes |
+|---|---|---|---|
+| Leak .text pointer | Read from stack (return addr) | 100% | PIE base = addr - offset |
+| Partial overwrite | 1-2 byte overflow | 1/16 | Last 12 bits fixed |
+| BROP | Fork server, crash probing | ~100% | Blind discovery without binary |
+| Relative addressing | Known offset between objects | 100% | Intra-binary references |
+
+### NX Bypass
+
+| Bypass Technique | Required Primitive | Gadget Requirement | Notes |
+|---|---|---|---|
+| ROP chain | Stack overflow | `pop reg; ret` gadgets | Standard approach |
+| ret2libc | Stack overflow | `pop rdi; ret` (64-bit) | Call system/execve |
+| ret2csu | Stack overflow | `__libc_csu_init` | 3 args without `pop rdx` |
+| SROP | Stack overflow | `syscall; ret` + sigreturn | Set all registers |
+| mprotect chain | Stack overflow + known address | `pop rdi/rsi/rdx; ret` | Make page RWX |
+| JIT spray | JIT engine present | None | Plant code in JIT pages |
+
+### Canary Bypass
+
+| Bypass Technique | Required Primitive | Condition | Notes |
+|---|---|---|---|
+| Format string leak | `printf(user_input)` | Canary on stack before return addr | `%N$p` reads canary |
+| Brute force | Fork server | Canary same in child | 256 × 7 attempts (64-bit) |
+| Stack reading | One-byte write/read | Overwrite null byte, read error | Output-based oracle |
+| Thread TLS overwrite | Large overflow | Overflow reaches `fs:[0x28]` | Overwrite canary source |
+| `__stack_chk_fail` GOT | Partial RELRO + write | GOT writable | Replace with no-op |
+| Avoid stack entirely | Heap vulnerability | No canary on heap | Heap exploitation path |
+
+### RELRO Bypass
+
+| RELRO Level | Writable Targets | Bypass |
+|---|---|---|
+| None | `.got`, `.got.plt`, `.dynamic` | Direct GOT overwrite |
+| Partial | `.got.plt` (lazy binding entries) | GOT overwrite on lazy-bound functions |
+| Full | Nothing in GOT | `__malloc_hook` (pre-2.34), `_IO_FILE`, `exit_funcs`, stack, `.fini_array` |
+
+### Full RELRO Alternative Target Matrix
+
+| Target | glibc Version | Required Knowledge | Overwrite Size | Trigger |
+|---|---|---|---|---|
+| `__malloc_hook` | < 2.34 | libc base | 8 bytes | Any malloc (printf with large fmt) |
+| `__free_hook` | < 2.34 | libc base | 8 bytes | Any free |
+| `__realloc_hook` | < 2.34 | libc base | 8 bytes | Any realloc |
+| `_IO_list_all` | Any | libc base | 8 bytes | exit / abort |
+| `_IO_FILE vtable` | Any (bypass varies) | libc base + heap | 8 bytes + fake vtable | I/O operation or exit |
+| `__exit_funcs` | Any | libc base + pointer guard | 8 bytes (mangled) | exit() |
+| `TLS_dtor_list` | ≥ 2.34 | TLS addr + pointer guard | 8 bytes (mangled) | Thread exit / exit() |
+| `.fini_array` | If writable | Binary base | 8 bytes | Normal program exit |
+| `_dl_fini` link_map | Any | ld.so base | Multiple fields | exit() |
+| Stack return address | Always | Stack address | 8 bytes | Function return |
+
+---
+
+## 2. COMBINED PROTECTION SCENARIOS
+
+### Scenario: NX + ASLR + Canary + Partial RELRO (Typical CTF)
+
+```
+1. Leak canary via format string or info disclosure
+2. Leak libc address via format string or PLT leak (puts@GOT)
+3. Craft ROP chain: pop_rdi → "/bin/sh" → system (ret2libc)
+4. Overflow: [padding][canary][saved_rbp][ROP chain]
+```
+
+### Scenario: NX + ASLR + Canary + Full RELRO + PIE
+
+```
+1. Format string (multi-shot): leak canary + PIE base + libc base
+2. Cannot overwrite GOT (Full RELRO) → target __malloc_hook or _IO_FILE
+3. Second format string or overflow: write target address
+4. Trigger: call malloc (for __malloc_hook) or exit (for _IO_FILE)
+```
+
+### Scenario: NX + ASLR + No Canary + No PIE + Partial RELRO (Beginner CTF)
+
+```
+1. No canary → direct overflow to return address
+2. No PIE → binary addresses known → PLT/GOT addresses fixed
+3. Leak libc: overflow → puts@plt(puts@GOT) → leak → main
+4. Second overflow: system("/bin/sh") or one_gadget
+```
+
+### Scenario: Static Binary + NX + Canary + ASLR
+
+```
+1. No libc (static) → cannot ret2libc
+2. Need canary bypass → leak via available primitive
+3. SROP: sigreturn to set all registers → execve("/bin/sh", NULL, NULL)
+4. Or: ret2dlresolve not applicable (static) → rely on ROP gadgets from large binary
+```
+
+---
+
+## 3. COMPILATION FLAGS REFERENCE
+
+| Protection | Enable Flag | Disable Flag |
+|---|---|---|
+| Canary | `-fstack-protector-all` | `-fno-stack-protector` |
+| NX | Default on (`-z noexecstack`) | `-z execstack` |
+| PIE | `-pie` (default on modern gcc) | `-no-pie` |
+| Partial RELRO | `-Wl,-z,relro` (default) | `-Wl,-z,norelro` |
+| Full RELRO | `-Wl,-z,relro,-z,now` | Omit `-z,now` |
+| FORTIFY | `-D_FORTIFY_SOURCE=2 -O2` | Omit flag |
+| ASLR | Kernel: `echo 2 > /proc/sys/kernel/randomize_va_space` | `echo 0 > ...` |
+
+### QEMU/GDB Testing Flags
+
+```bash
+# Disable all protections for testing
+gcc -fno-stack-protector -z execstack -no-pie -Wl,-z,norelro -o vuln vuln.c
+# Disable ASLR for debugging
+echo 0 | sudo tee /proc/sys/kernel/randomize_va_space
+# Or per-process:
+setarch $(uname -m) -R ./vuln
+```
+
+---
+
+## 4. PROTECTION INTERACTION EFFECTS
+
+| Protection A | Protection B | Combined Effect |
+|---|---|---|
+| ASLR | PIE | Both code AND data randomized → need two leaks (or relative offset) |
+| Full RELRO | glibc ≥ 2.34 | GOT + hooks both unavailable → _IO_FILE or exit_funcs only targets |
+| Canary | ASLR | Must leak canary AND libc base before exploitation |
+| NX | ASLR | ROP chain needed, but gadget addresses unknown → leak first |
+| CET | Full RELRO | ROP blocked + GOT blocked → data-only attacks |
+| FORTIFY | Canary | Format string restricted + stack overflow detected → heap path preferred |
+
+---
+
+## 5. QUICK LOOKUP: "I HAVE X, I NEED Y"
+
+| I Have | I Need | Path |
+|---|---|---|
+| Format string only | RCE | Leak canary + libc → overwrite GOT(printf→system) or hook |
+| Stack overflow only (no leak) | RCE | ret2dlresolve or SROP (no ASLR knowledge needed) |
+| Stack overflow + format string | RCE | Leak everything → classic ROP chain |
+| Heap overflow only | RCE | Heap exploitation → leak libc → overwrite hook/_IO_FILE → trigger |
+| OOB read only | Leak | Read GOT entries → libc base; read stack → canary + PIE |
+| Arbitrary write (no leak) | RCE | Partial overwrite: .got.plt low bytes to redirect to win function |
+| Arbitrary write + libc leak | RCE | Write one_gadget to hook (pre-2.34) or FSOP (any version) |

package/skills/binary-protection-bypass/SKILL.md

@@ -0,0 +1,295 @@
+---
+name: binary-protection-bypass
+description: >-
+  Binary protection bypass playbook. Use when identifying and bypassing ASLR, PIE, NX/DEP, stack canary, RELRO, FORTIFY_SOURCE, CET, and MTE protections in ELF binaries to enable exploitation.gated: true
+---
+
+# SKILL: Binary Protection Bypass — Expert Attack Playbook
+
+> **AI LOAD INSTRUCTION**: Expert binary protection identification and bypass techniques. Covers ASLR, PIE, NX, RELRO, canary, FORTIFY_SOURCE, stack clash, CET shadow stack, and ARM MTE. Each protection is paired with its bypass methods and required primitives. Distilled from ctf-wiki mitigation sections and real-world exploitation. Base models often confuse which protections block which attacks and miss the combinatorial effect of multiple protections.
+
+## 0. RELATED ROUTING
+
+- [stack-overflow-and-rop](../stack-overflow-and-rop/SKILL.md) — ROP chains to bypass NX, ret2libc for ASLR bypass
+- [format-string-exploitation](../format-string-exploitation/SKILL.md) — primary method for leaking canary, PIE, libc addresses
+- [heap-exploitation](../heap-exploitation/SKILL.md) — heap attacks for RELRO bypass (when GOT is read-only)
+- [arbitrary-write-to-rce](../arbitrary-write-to-rce/SKILL.md) — what to overwrite when GOT is protected by RELRO
+
+### Advanced Reference
+
+Load [PROTECTION_BYPASS_MATRIX.md](./PROTECTION_BYPASS_MATRIX.md) for comprehensive protection × bypass × primitive matrix.
+
+---
+
+## 1. PROTECTION IDENTIFICATION
+
+```bash
+$ checksec ./binary
+[*] '/path/to/binary'
+    Arch:     amd64-64-little
+    RELRO:    Full RELRO          ← GOT read-only
+    Stack:    Canary found        ← stack canary enabled
+    NX:       NX enabled          ← stack not executable
+    PIE:      PIE enabled         ← position-independent code
+    FORTIFY:  Enabled             ← fortified libc functions
+```
+
+### Quick Identification Table
+
+| Protection | Check Command | Binary Indicator |
+|---|---|---|
+| ASLR | `cat /proc/sys/kernel/randomize_va_space` | OS-level (0=off, 1=partial, 2=full) |
+| PIE | `checksec` or `readelf -h` (Type: DYN) | Binary compiled with `-pie` |
+| NX | `checksec` or `readelf -l` (no RWE segment) | `gcc -z noexecstack` (default on) |
+| Canary | `checksec` or look for `__stack_chk_fail@plt` | `gcc -fstack-protector-all` |
+| Partial RELRO | `readelf -l` (GNU_RELRO segment, `.got.plt` writable) | `gcc -Wl,-z,relro` |
+| Full RELRO | `readelf -l` + `.got` section read-only | `gcc -Wl,-z,relro,-z,now` |
+| FORTIFY | Presence of `__printf_chk`, `__memcpy_chk` etc. | `gcc -D_FORTIFY_SOURCE=2` |
+
+---
+
+## 2. ASLR BYPASS
+
+ASLR randomizes base addresses of stack, heap, libc, and mmap regions at each execution.
+
+| Bypass Method | Required Primitive | Notes |
+|---|---|---|
+| Information leak | Any read primitive (format string, OOB read, UAF) | Leak libc/stack/heap address → calculate base |
+| Partial overwrite | Write primitive (limited length) | Overwrite last 1-2 bytes (page offset fixed) |
+| Brute force (32-bit) | Ability to reconnect/retry | ~256–4096 attempts (8-12 bits entropy) |
+| Return-to-PLT | Stack overflow | PLT addresses are at fixed offset from binary base (if no PIE) |
+| ret2dlresolve | Stack overflow + write primitive | Resolve arbitrary function without knowing libc base |
+| Format string leak | Format string vulnerability | `%N$p` for stack/libc/heap addresses |
+| Stack reading | Byte-by-byte (fork server) | Read stack byte-by-byte via crash oracle |
+
+### ASLR Entropy (x86-64 Linux)
+
+| Region | Entropy (bits) | Positions |
+|---|---|---|
+| Stack | 22 | ~4M |
+| mmap / libc | 28 | ~256M |
+| Heap (brk) | 13 | ~8K |
+| PIE binary | 28 | ~256M |
+
+---
+
+## 3. PIE BYPASS
+
+PIE (Position Independent Executable) randomizes the binary's own code/data base address.
+
+| Bypass Method | Required Primitive | Notes |
+|---|---|---|
+| Information leak | Read return address from stack | PIE base = leaked_addr - known_offset |
+| Partial overwrite | One-byte or two-byte write | Last 12 bits of page offset are fixed |
+| Format string leak | Format string vulnerability | `%N$p` where N points to .text return address |
+| Relative addressing | Knowledge of binary layout | If you know relative offsets, only need one leak |
+
+### Partial Overwrite Details
+
+```
+PIE binary loaded at: 0x555555554000 (example)
+Function at offset 0x1234: 0x555555555234
+
+Overwrite return address last 2 bytes: 0x?234 → 0x?XXX
+Unknown: bits 12-15 (one nibble = 4 bits = 16 possibilities)
+Success rate: 1/16 per attempt
+```
+
+---
+
+## 4. NX / DEP BYPASS
+
+NX (No-eXecute) / DEP (Data Execution Prevention) prevents execution of code on the stack/heap.
+
+| Bypass Method | Detail |
+|---|---|
+| ROP (Return-Oriented Programming) | Chain existing code gadgets ending in `ret` |
+| ret2libc | Call libc functions (system, execve) directly |
+| ret2csu | Use `__libc_csu_init` gadgets for controlled function calls |
+| ret2dlresolve | Forge dynamic linker structures to resolve arbitrary functions |
+| SROP | Use sigreturn to set all registers from fake signal frame |
+| mprotect ROP | Chain mprotect(addr, size, PROT_RWX) → make page executable → jump to shellcode |
+| JIT spray | In JIT environments (V8, etc.), create executable code via JIT compiler |
+
+### mprotect Chain
+
+```python
+# Make stack executable, then jump to shellcode
+rop = b'A' * offset
+rop += p64(pop_rdi) + p64(stack_page)     # page-aligned address
+rop += p64(pop_rsi) + p64(0x1000)         # size
+rop += p64(pop_rdx) + p64(7)              # PROT_READ|PROT_WRITE|PROT_EXEC
+rop += p64(mprotect_addr)
+rop += p64(shellcode_addr)                 # jump to shellcode on now-executable stack
+```
+
+---
+
+## 5. RELRO BYPASS
+
+| RELRO Level | GOT Status | Bypass |
+|---|---|---|
+| No RELRO | GOT fully writable | Direct GOT overwrite |
+| Partial RELRO | `.got.plt` writable (lazy binding) | GOT overwrite still works |
+| Full RELRO | All GOT entries resolved at load, GOT read-only | Cannot write GOT → target other structures |
+
+### Full RELRO Alternative Targets
+
+| Target | When | How |
+|---|---|---|
+| `__malloc_hook` | glibc < 2.34 | Overwrite with one_gadget |
+| `__free_hook` | glibc < 2.34 | Overwrite with `system`, trigger `free("/bin/sh")` |
+| `_IO_FILE vtable` | Any glibc | FSOP / vtable hijack |
+| `__exit_funcs` | Any glibc | Overwrite exit handler list |
+| `TLS_dtor_list` | glibc ≥ 2.34 | Thread-local destructor list (needs pointer guard) |
+| `.fini_array` | If writable | Overwrite destructor function pointers |
+| Stack return address | Direct stack write | Overwrite return address for ROP |
+
+See [arbitrary-write-to-rce](../arbitrary-write-to-rce/SKILL.md) for comprehensive target list.
+
+---
+
+## 6. CANARY BYPASS
+
+| Method | Condition | Detail |
+|---|---|---|
+| Format string leak | printf(user_input) | `%N$p` to read canary from stack |
+| Brute-force | fork() server (canary persists in child) | Byte-by-byte: 256 × (canary_size-1) attempts |
+| Stack reading | Partial overwrite / info leak | Overwrite canary's null byte, leak via output |
+| Thread canary overwrite | Overflow reaches TLS | Canary at `fs:[0x28]`; overflow past buffer to TLS → overwrite canary with known value |
+| Canary-relative overwrite | Overflow after canary but before return addr | Skip canary, only overwrite return address (rare layout) |
+| Heap-based | Vulnerability is on heap, not stack | Canary only protects stack |
+| __stack_chk_fail GOT overwrite | Partial RELRO | Overwrite `__stack_chk_fail@GOT` to point to harmless function → canary check passes |
+
+### Canary Format
+
+```
+x86:    0x00XXXXXX (4 bytes, leading null byte)
+x86-64: 0x00XXXXXXXXXXXXXX (8 bytes, leading null byte)
+```
+
+The leading `\x00` prevents string operations from accidentally reading the canary.
+
+---
+
+## 7. FORTIFY_SOURCE BYPASS
+
+`_FORTIFY_SOURCE=2` adds buffer size checking and restricts format string operations.
+
+| Fortified Function | Restriction | Bypass |
+|---|---|---|
+| `__printf_chk` | `%n` with positional args (`%N$n`) forbidden | Use non-positional `%n` or `%hn` chain |
+| `__memcpy_chk` | Destination buffer size checked | Use heap overflow instead of stack |
+| `__strcpy_chk` | Same | |
+| `__read_chk` | Read size checked against buffer | |
+
+### Format String with FORTIFY_SOURCE
+
+```python
+# %1$n is blocked by __printf_chk
+# But sequential (non-positional) %n may still work:
+# Print exact byte count, then %hn — must be very precise
+# Or: find unfortified printf in binary/libc via ROP
+```
+
+---
+
+## 8. CET (Control-flow Enforcement Technology)
+
+Intel CET adds two mechanisms:
+
+### Shadow Stack
+
+- Hardware-maintained copy of return addresses
+- On `ret`, CPU checks shadow stack matches actual stack
+- Mismatch → `#CP` fault (control protection exception)
+
+| Impact | Detail |
+|---|---|
+| ROP blocked | Return address overwrite detected on `ret` |
+| JOP possible | `jmp [reg]` not checked by shadow stack |
+| COP possible | `call [reg]` pushes to shadow stack but target validated by IBT |
+
+### Indirect Branch Tracking (IBT)
+
+- Indirect `jmp`/`call` must land on `ENDBR64` instruction
+- Non-ENDBR landing → `#CP` fault
+
+**Bypass**: 
+- Data-only attacks (don't change control flow)
+- Find valid ENDBR gadgets that chain into useful operations
+- JOP with ENDBR-prefixed gadgets
+- Target structures outside CFI scope (modprobe_path, function pointer arrays)
+
+---
+
+## 9. MTE (Memory Tagging Extension, ARM)
+
+ARM MTE assigns 4-bit tags to memory pointers and allocations. Tag mismatch = fault.
+
+| Aspect | Detail |
+|---|---|
+| Tag bits | 4 bits in pointer (bits 56-59) = 16 possible tags |
+| Granule | 16 bytes (each 16-byte granule has one tag) |
+| Check | Load/store: pointer tag must match memory tag |
+| Probabilistic | Random tag → 1/16 chance attacker guesses correctly |
+
+### Bypass Approaches
+
+| Method | Success Rate |
+|---|---|
+| Brute-force | 1/16 per attempt (6.25%) |
+| Tag oracle | Side-channel to determine tag (timing, error messages) |
+| In-bounds exploit | Stay within same tagged region (use relative offsets) |
+| Tag bypass gadget | Use `LDGM`/`STGM` instructions if accessible |
+| Speculative execution | Spectre-style bypass of tag check |
+
+---
+
+## 10. DECISION TREE
+
+```
+Binary analysis: checksec output
+├── NX disabled?
+│   └── Shellcode on stack/heap (simplest path)
+│
+├── NX enabled (standard modern binary)?
+│   ├── Need code execution → ROP/ret2libc
+│   │
+│   ├── Canary enabled?
+│   │   ├── fork server? → byte-by-byte brute-force
+│   │   ├── Format string? → leak canary via %p
+│   │   ├── Heap vuln? → canary doesn't protect heap
+│   │   └── Partial RELRO? → overwrite __stack_chk_fail@GOT
+│   │
+│   ├── PIE enabled?
+│   │   ├── Format string? → leak .text address → PIE base
+│   │   ├── Partial overwrite → last 12 bits fixed (1/16 brute-force)
+│   │   └── OOB read? → leak code pointer
+│   │
+│   ├── ASLR enabled?
+│   │   ├── Info leak available → leak libc base
+│   │   ├── No leak → ret2dlresolve or SROP
+│   │   ├── 32-bit? → brute-force feasible (~4096 attempts)
+│   │   └── Return-to-PLT (no libc base needed for PLT calls)
+│   │
+│   ├── RELRO level?
+│   │   ├── None/Partial → GOT overwrite
+│   │   └── Full → alternative targets:
+│   │       ├── glibc < 2.34 → __malloc_hook / __free_hook
+│   │       ├── glibc ≥ 2.34 → _IO_FILE / exit_funcs / TLS_dtor_list
+│   │       ├── .fini_array (if writable)
+│   │       └── Stack return address
+│   │
+│   └── FORTIFY_SOURCE?
+│       ├── Blocks positional %n → use sequential %n or heap exploit
+│       └── Blocks buffer overflows in fortified functions → use unfortified paths
+│
+├── CET (shadow stack)?
+│   ├── ROP blocked → data-only attack or JOP
+│   └── ENDBR-gadget chaining
+│
+└── MTE (ARM)?
+    ├── 1/16 brute-force
+    └── Stay in-bounds for relative corruption
+```