# ROP

Return Oriented Programming: Execute code already present in the program.

* Each snippet is composed of some instructions + RET.
* RET pops `RIP` from the stack.

Program flow is controlled by values in the stack.

* The attacker puts values in a stack pointing to gadgets.
* When a gadget ends, the code jumps to the next gadget.

Any program can be constructed as long as there are gadgets available.

* When Good Instructions Go Bad: Generalizing Return-Oriented Programming to RISC \[1] - Buchanan, E.; Roemer, R.; Shacham, H.; Savage, S.
* Return-Oriented Programming: Exploits Without Code Injection \[2] - Shacham, Hovav; Buchanan, Erik; Roemer, Ryan; Savage, Stefan.

ROP Attacks: Chain gadgets to execute malicious code.

A gadget is a suite of instructions that end by the branch instruction ret (Intel) or the equivalent on ARM.

* Intel examples:
  * `pop eax ; ret`\
    `xor ebx, ebx ; ret`
* ARM examples:
  * `pop {r4, pc}`\
    `str r1, [r0] ; bx lr`

Objective: Use gadgets instead of classical shellcodes.

Because x86 instructions aren't aligned, a gadget can contain another gadget.

```
f7c7070000000f9545c3 → test edi, 0x7 ; setnz byte ptr [rbp-0x3d] ;
  c7070000000f9545c3 → mov dword ptr [rdi], 0xf000000 ; xchg ebp, eax ; ret
```

Doesn't work on RISC architectures like ARM, MIPS, SPARC...

<figure><img src="https://3744219775-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FUaTnynVhA2CYjsGJT14j%2Fuploads%2FJCcyH3RC6PZSJia8Pz0i%2FScreenshot%20from%202024-01-11%2017-40-35.png?alt=media&#x26;token=9e9fb1bc-5301-4138-bfb1-98d5fd14bf5c" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3744219775-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FUaTnynVhA2CYjsGJT14j%2Fuploads%2FFXnLSIrb7s5hog3h8NtA%2FScreenshot%20from%202024-01-11%2018-21-35.png?alt=media&#x26;token=a2b6d49c-9a4a-4cf4-b1b0-77d82174b8a6" alt=""><figcaption></figcaption></figure>

Using ROP, the stack is subverted to create a jump sequence. It contains:

* Values to be loaded;
* Addresses to other gadgets;
* May also contain arguments to functions called.

Gadgets are present in program code and loaded libraries.

* Each function available provides one gadget;
* Plus misaligned access.

Why?

* It can bypass several security mechanisms.

<figure><img src="https://3744219775-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FUaTnynVhA2CYjsGJT14j%2Fuploads%2FftBtbEd8n78dKruL8B3R%2FScreenshot%20from%202024-01-11%2018-21-35.png?alt=media&#x26;token=9d935325-622e-46f6-aba0-f33fd4a8e2ff" alt=""><figcaption></figcaption></figure>

## Practical Example: return\_to\_libc.c (x86\_64)

<figure><img src="https://3744219775-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FUaTnynVhA2CYjsGJT14j%2Fuploads%2FrNytsTSyOeO0yRPeHgCk%2FScreenshot%20from%202024-01-11%2018-21-35.png?alt=media&#x26;token=e6f0429b-8225-4a01-9857-52db2aef4f55" alt=""><figcaption></figcaption></figure>

Payload strategy:

* All addresses are 8 bytes;
* Buffer: padding with 16 bytes (buffer + RBP);
* Gadget address: ?? -> `rop --search “pop rdi; ret”`
  * pop RDI: load command address into RDI;
  * ret: load system address into RIP;
* Command address: ?? -> `grep /bin/sh`
  * Approaches: Find a string already in RAM (better); add the payload after the system address (if required);
* System address: ?? -> `print system`

<figure><img src="https://3744219775-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FUaTnynVhA2CYjsGJT14j%2Fuploads%2FA78XIpb9pupq8as0KRZp%2FScreenshot%20from%202024-01-11%2018-27-26.png?alt=media&#x26;token=08c25429-77fd-4b61-a2c9-98db05507514" alt=""><figcaption></figcaption></figure>
