hacktricks/src/binary-exploitation/basic-stack-binary-exploitation-methodology/README.md

# Msingi wa Mbinu za Ukatili wa Binafsi

{{#include ../../banners/hacktricks-training.md}}

## Taarifa za Msingi za ELF

Kabla ya kuanza kutumia chochote, ni muhimu kuelewa sehemu ya muundo wa **ELF binary**:

{{#ref}}
elf-tricks.md
{{#endref}}

## Zana za Ukatili

{{#ref}}
tools/
{{#endref}}

## Mbinu ya Stack Overflow

Kwa mbinu nyingi, ni vizuri kuwa na mpango wa wakati mbinu kila moja itakuwa na manufaa. Kumbuka kwamba ulinzi sawa utaathiri mbinu tofauti. Unaweza kupata njia za kupita ulinzi katika kila sehemu ya ulinzi lakini si katika mbinu hii.

## Kudhibiti Mchakato

Kuna njia tofauti ambazo unaweza kumaliza kudhibiti mchakato wa programu:

- [**Stack Overflows**](../stack-overflow/index.html) kuandika upya kiashiria cha kurudi kutoka kwenye stack au EBP -> ESP -> EIP.
- Inaweza kuhitaji kutumia [**Integer Overflows**](../integer-overflow.md) ili kusababisha overflow
- Au kupitia **Arbitrary Writes + Write What Where to Execution**
- [**Format strings**](../format-strings/index.html)**:** Tumia `printf` kuandika maudhui yasiyo na mipaka katika anwani zisizo na mipaka.
- [**Array Indexing**](../array-indexing.md): Tumia mbinu mbaya ya indexing ili uweze kudhibiti baadhi ya arrays na kupata kuandika yasiyo na mipaka.
- Inaweza kuhitaji kutumia [**Integer Overflows**](../integer-overflow.md) ili kusababisha overflow
- **bof to WWW via ROP**: Tumia overflow ya buffer kujenga ROP na uweze kupata WWW.

Unaweza kupata mbinu za **Write What Where to Execution** katika:

{{#ref}}
../arbitrary-write-2-exec/
{{#endref}}

## Mizunguko ya Milele

Kitu cha kuzingatia ni kwamba kawaida **ku exploit udhaifu mmoja hakutoshi** kutekeleza exploit yenye mafanikio, hasa baadhi ya ulinzi zinahitaji kupitishwa. Kwa hivyo, ni muhimu kujadili baadhi ya chaguzi za **kufanya udhaifu mmoja uweze kutumika mara kadhaa** katika utekelezaji mmoja wa binary:

- Andika katika mnyororo wa **ROP** anwani ya **`main` function** au anwani ambapo **udhaifu** unafanyika.
- Kwa kudhibiti mnyororo sahihi wa ROP unaweza kuwa na uwezo wa kutekeleza vitendo vyote katika mnyororo huo
- Andika katika anwani ya **`exit` katika GOT** (au kazi nyingine yoyote inayotumiwa na binary kabla ya kumaliza) anwani ya kurudi **kwenye udhaifu**
- Kama ilivyoelezwa katika [**.fini_array**](../arbitrary-write-2-exec/www2exec-.dtors-and-.fini_array.md#eternal-loop)**,** hifadhi kazi 2 hapa, moja ya kuita udhaifu tena na nyingine ya kuita **`__libc_csu_fini`** ambayo itaita tena kazi kutoka `.fini_array`.

## Malengo ya Ukatili

### Lengo: Kuita kazi iliyopo

- [**ret2win**](#ret2win): Kuna kazi katika msimbo unahitaji kuitwa (labda na baadhi ya parameta maalum) ili kupata bendera.
- Katika **bof ya kawaida bila** [**PIE**](../common-binary-protections-and-bypasses/pie/index.html) **na** [**canary**](../common-binary-protections-and-bypasses/stack-canaries/index.html) unahitaji tu kuandika anwani katika anwani ya kurudi iliyohifadhiwa kwenye stack.
- Katika bof yenye [**PIE**](../common-binary-protections-and-bypasses/pie/index.html), utahitaji kupita
- Katika bof yenye [**canary**](../common-binary-protections-and-bypasses/stack-canaries/index.html), utahitaji kupita
- Ikiwa unahitaji kuweka parameta kadhaa ili kuitisha kazi ya **ret2win** kwa usahihi unaweza kutumia:
- Mnyororo wa [**ROP**](#rop-and-ret2...-techniques) ikiwa kuna vifaa vya kutosha kuandaa parameta zote
- [**SROP**](../rop-return-oriented-programing/srop-sigreturn-oriented-programming/index.html) (ikiwa unaweza kuita syscall hii) ili kudhibiti register nyingi
- Vifaa kutoka [**ret2csu**](../rop-return-oriented-programing/ret2csu.md) na [**ret2vdso**](../rop-return-oriented-programing/ret2vdso.md) ili kudhibiti register kadhaa
- Kupitia [**Write What Where**](../arbitrary-write-2-exec/index.html) unaweza kutumia udhaifu mwingine (sio bof) ili kuita kazi ya **`win`**.
- [**Pointers Redirecting**](../stack-overflow/pointer-redirecting.md): Ikiwa stack ina viashiria vya kazi ambavyo vitaitwa au kwa string ambayo itatumika na kazi ya kuvutia (system au printf), inawezekana kuandika upya anwani hiyo.
- [**ASLR**](../common-binary-protections-and-bypasses/aslr/index.html) au [**PIE**](../common-binary-protections-and-bypasses/pie/index.html) inaweza kuathiri anwani.
- [**Uninitialized variables**](../stack-overflow/uninitialized-variables.md): Hujui kamwe.

### Lengo: RCE

#### Kupitia shellcode, ikiwa nx imezimwa au kuchanganya shellcode na ROP:

- [**(Stack) Shellcode**](#stack-shellcode): Hii ni muhimu kuhifadhi shellcode kwenye stack kabla au baada ya kuandika upya kiashiria cha kurudi na kisha **kuruka kwake** ili kuitekeleza:
- **Katika hali yoyote, ikiwa kuna** [**canary**](../common-binary-protections-and-bypasses/stack-canaries/index.html)**,** katika bof ya kawaida utahitaji kupita (leak) hiyo
- **Bila** [**ASLR**](../common-binary-protections-and-bypasses/aslr/index.html) **na** [**nx**](../common-binary-protections-and-bypasses/no-exec-nx.md) inawezekana kuruka kwenye anwani ya stack kwani haitabadilika kamwe
- **Na** [**ASLR**](../common-binary-protections-and-bypasses/aslr/index.html) utahitaji mbinu kama [**ret2esp/ret2reg**](../rop-return-oriented-programing/ret2esp-ret2reg.md) ili kuruka huko
- **Na** [**nx**](../common-binary-protections-and-bypasses/no-exec-nx.md), utahitaji kutumia baadhi ya [**ROP**](../rop-return-oriented-programing/index.html) **kuita `memprotect`** na kufanya ukurasa `rwx`, ili kisha **kuhifadhi shellcode huko** (kuita kusoma kwa mfano) na kisha kuruka huko.
- Hii itachanganya shellcode na mnyororo wa ROP.

#### Kupitia syscalls

- [**Ret2syscall**](../rop-return-oriented-programing/rop-syscall-execv/index.html): Inatumika kuita `execve` ili kuendesha amri zisizo na mipaka. Unahitaji kuwa na uwezo wa kupata **vifaa vya kuita syscall maalum na parameta**.
- Ikiwa [**ASLR**](../common-binary-protections-and-bypasses/aslr/index.html) au [**PIE**](../common-binary-protections-and-bypasses/pie/index.html) zimewezeshwa utahitaji kuzishinda **ili kutumia vifaa vya ROP** kutoka kwa binary au maktaba.
- [**SROP**](../rop-return-oriented-programing/srop-sigreturn-oriented-programming/index.html) inaweza kuwa muhimu kuandaa **ret2execve**
- Vifaa kutoka [**ret2csu**](../rop-return-oriented-programing/ret2csu.md) na [**ret2vdso**](../rop-return-oriented-programing/ret2vdso.md) ili kudhibiti register kadhaa

#### Kupitia libc

- [**Ret2lib**](../rop-return-oriented-programing/ret2lib/index.html): Inatumika kuita kazi kutoka maktaba (kawaida kutoka **`libc`**) kama **`system`** na baadhi ya hoja zilizopangwa (kwa mfano, `'/bin/sh'`). Unahitaji binary ili **kupakia maktaba** na kazi unayotaka kuita (libc kawaida).
- Ikiwa **imeandikwa kwa statically na hakuna** [**PIE**](../common-binary-protections-and-bypasses/pie/index.html), **anwani** ya `system` na `/bin/sh` haitabadilika, hivyo inawezekana kuzitumia kwa statically.
- **Bila** [**ASLR**](../common-binary-protections-and-bypasses/aslr/index.html) **na kujua toleo la libc** lililopakiwa, **anwani** ya `system` na `/bin/sh` haitabadilika, hivyo inawezekana kuzitumia kwa statically.
- Na [**ASLR**](../common-binary-protections-and-bypasses/aslr/index.html) **lakini hakuna** [**PIE**](../common-binary-protections-and-bypasses/pie/index.html)**, kujua libc na binary ikitumia kazi ya `system`** inawezekana **`ret` kwa anwani ya system katika GOT** na anwani ya `'/bin/sh'` katika param (utahitaji kufahamu hili).
- Na [ASLR](../common-binary-protections-and-bypasses/aslr/index.html) lakini hakuna [PIE](../common-binary-protections-and-bypasses/pie/index.html), kujua libc na **bila binary ikitumia `system`**:
- Tumia [**`ret2dlresolve`**](../rop-return-oriented-programing/ret2dlresolve.md) kutatua anwani ya `system` na kuitisha
- **Pitisha** [**ASLR**](../common-binary-protections-and-bypasses/aslr/index.html) na kuhesabu anwani ya `system` na `'/bin/sh'` katika kumbukumbu.
- **Na** [**ASLR**](../common-binary-protections-and-bypasses/aslr/index.html) **na** [**PIE**](../common-binary-protections-and-bypasses/pie/index.html) **na bila kujua libc**: Unahitaji:
- Pitisha [**PIE**](../common-binary-protections-and-bypasses/pie/index.html)
- Pata **`libc` version** iliyotumika (leak anwani kadhaa za kazi)
- Angalia **hali za awali na ASLR** ili kuendelea.

#### Kupitia EBP/RBP

- [**Stack Pivoting / EBP2Ret / EBP Chaining**](../stack-overflow/stack-pivoting-ebp2ret-ebp-chaining.md): Kudhibiti ESP ili kudhibiti RET kupitia EBP iliyohifadhiwa kwenye stack.
- Inatumika kwa **off-by-one** stack overflows
- Inatumika kama njia mbadala ya kumaliza kudhibiti EIP wakati unatumia EIP kujenga payload katika kumbukumbu na kisha kuruka kwake kupitia EBP

#### Mambo Mengine

- [**Pointers Redirecting**](../stack-overflow/pointer-redirecting.md): Ikiwa stack ina viashiria vya kazi ambavyo vitaitwa au kwa string ambayo itatumika na kazi ya kuvutia (system au printf), inawezekana kuandika upya anwani hiyo.
- [**ASLR**](../common-binary-protections-and-bypasses/aslr/index.html) au [**PIE**](../common-binary-protections-and-bypasses/pie/index.html) inaweza kuathiri anwani.
- [**Uninitialized variables**](../stack-overflow/uninitialized-variables.md): Hujui kamwe.

{{#include ../../banners/hacktricks-training.md}}