0

I am in the middle of a binary crackme (ELF-64) on a remote server which communicates via simple socket server in C.

I have the source code, locally. After overflowing the buffer (socket buffer is 2000, password buffer is less), overwriting the RIP, filling with NOP sled (512 nops), inserting a reverse bind shellcode on the top of that, finding out a perfect address (without \x00) in middle of nop sled which after sliding it will execute the shellcode.

  • Remote server ASLR is off;

  • Binary compiled without canary and can execute code from stack.

I want to brute force the remote server to find the NOP-sled address. Any good practice for that ? Because, the last 5K attempts did not work at all.

My local address when I turn off ASLR is 0x7fffffffd292.

The following code pops a shell (not interactive) locally :

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect((h, p))

s.send(("hello " + "A" * 100).encode() + struct.pack("L", 0x7fffffffcccc) + (b'\x90'*512) + shell_code)
print(s.recv(2048))
  • Correct me if I'm wrong but, I don't think brute-forcing memory addresses on remote server -especially for 64-bit address space- is not feasible. Maybe restricting searching space to certain stack addresses or leaking addresses someway could help your problem. I don't heard any other intelligent search method for this type of problem. – de6f Dec 26 '17 at 9:07
  • take a look github.com/Naetw/CTF-pwn-tips#leak-stack-address – Iddo Dec 26 '17 at 13:21
4

Brute force is not the way you should look to in anything unless its your last resort. The address space of x64 is too large to get brute force to work. Look up on this technique called ROP(Return Oriented Programming). Currently you're bruteforcing the RIP, what if there's some code in the binary that will help you jump to your shellcode without bruteforcing and plus no PIE means that address is constant. When your control is getting transferred at ret, look at what other registers contain. You might find code such as call eax in the binary.

  • I can share the ROPgadget output, I have stack pivot but no rop chain, I do have "call rax" gadget but how do I populate rax to jump to nop sled ? – Iddo Dec 25 '17 at 14:53
  • What are the contents of the registers? Do they refer to the buffer? – sudhackar Dec 25 '17 at 15:10
  • registers & stack hastebin.com/raw/axalohimur if you like I can edit the main question with the content – Iddo Dec 25 '17 at 16:44
  • Can you share ROPgadget's output too? – sudhackar Dec 26 '17 at 8:57
  • ROPgadget & ropper output hastebin.com/raw/ehadepohod – Iddo Dec 26 '17 at 13:17

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.