Binary Exploitation
Binary exploitation, also known as pwn, is the art of exploiting vulnerable programs. This means that given a program, often running on a remote server, an attacker is able to take control of the execution flow of the program only using limited user input. The goal of the attacker is usually to get a shell on the remote server, but it sometimes not necessary to compromise the server.
Exploit types
Different types of exploit exists, the most common are:
| Name | Description |
|---|---|
| Format String | Exploits format string functions to read and write in the program memory |
| Overwriting stack variables | Change the value of a variable on the stack. |
| ret2win | Overwrite the return address to point to an interesting function of the program |
| Shellcode | Inject shellcode in the program memory and execute it |
| ret2libc | Overwrite the return address to point to an interesting function in libc |
| Overwriting GOT | Overwrite the address of a function in the GOT to point to an interesting function |
Exploit mitigations
But some security techniques exists and can make exploitation harder:
ASLR Randomization of the memory addresses of the program and the libraries. Solution: Leak an address and calculate the offset between the leaked address and the address of the function you want to call.
NX No execution of the stack.
Stack canaries A random value is stored on the stack and checked before returning from a function. Solution: Leak the canary and overwrite it with the correct value.
PIE Randomization of the memory addresses of the program. Solution: Leak an address
Tools
Common tools to exploit binaries:
gdb- WikipediaMost popular debugger for dynamic analysis. See Reverse Engineering for more info.
Ghidra- WebsiteDecompiler for binary files, useful for static analysis. See Reverse Engineering for more info.
Common attacks
---x--x--x root rootTo exfiltrate or read a binary when you only have execution rights, you can load it with a library and use the library to read it.
This needs that the binary is dynamically linked, and is easier if you know the name of the function you want to extract.
Code for this library is provided here.