mirror of
https://github.com/HackTricks-wiki/hacktricks.git
synced 2025-10-10 18:36:50 +00:00
60 lines
3.0 KiB
Markdown
60 lines
3.0 KiB
Markdown
# WWW2Exec - .dtors & .fini_array
|
|
|
|
{{#include ../../banners/hacktricks-training.md}}
|
|
|
|
## .dtors
|
|
|
|
> [!CAUTION]
|
|
> Nowadays is very **weird to find a binary with a .dtors section!**
|
|
|
|
The destructors are functions that are **executed before program finishes** (after the `main` function returns).\
|
|
The addresses to these functions are stored inside the **`.dtors`** section of the binary and therefore, if you manage to **write** the **address** to a **shellcode** in **`__DTOR_END__`** , that will be **executed** before the programs ends.
|
|
|
|
Get the address of this section with:
|
|
|
|
```bash
|
|
objdump -s -j .dtors /exec
|
|
rabin -s /exec | grep “__DTOR”
|
|
```
|
|
|
|
Usually you will find the **DTOR** markers **between** the values `ffffffff` and `00000000`. So if you just see those values, it means that there **isn't any function registered**. So **overwrite** the **`00000000`** with the **address** to the **shellcode** to execute it.
|
|
|
|
> [!WARNING]
|
|
> Ofc, you first need to find a **place to store the shellcode** in order to later call it.
|
|
|
|
## **.fini_array**
|
|
|
|
Essentially this is a structure with **functions that will be called** before the program finishes, like **`.dtors`**. This is interesting if you can call your **shellcode just jumping to an address**, or in cases where you need to go **back to `main`** again to **exploit the vulnerability a second time**.
|
|
|
|
```bash
|
|
objdump -s -j .fini_array ./greeting
|
|
|
|
./greeting: file format elf32-i386
|
|
|
|
Contents of section .fini_array:
|
|
8049934 a0850408
|
|
|
|
#Put your address in 0x8049934
|
|
```
|
|
|
|
Note that when a function from the **`.fini_array`** is executed it moves to the next one, so it won't be executed several time (preventing eternal loops), but also it'll only give you 1 **execution of the function** placed here.
|
|
|
|
Note that entries in `.fini_array` are called in **reverse** order, so you probably wants to start writing from the last one.
|
|
|
|
#### Eternal loop
|
|
|
|
In order to abuse **`.fini_array`** to get an eternal loop you can [**check what was done here**](https://guyinatuxedo.github.io/17-stack_pivot/insomnihack18_onewrite/index.html)**:** If you have at least 2 entries in **`.fini_array`**, you can:
|
|
|
|
- Use your first write to **call the vulnerable arbitrary write function** again
|
|
- Then, calculate the return address in the stack stored by **`__libc_csu_fini`** (the function that is calling all the `.fini_array` functions) and put there the **address of `__libc_csu_fini`**
|
|
- This will make **`__libc_csu_fini`** call himself again executing the **`.fini_array`** functions again which will call the vulnerable WWW function 2 times: one for **arbitrary write** and another one to overwrite again the **return address of `__libc_csu_fini`** on the stack to call itself again.
|
|
|
|
> [!CAUTION]
|
|
> Note that with [**Full RELRO**](../common-binary-protections-and-bypasses/relro.md)**,** the section **`.fini_array`** is made **read-only**.
|
|
> In newer versions, even with [**Partial RELRO**] the section **`.fini_array`** is made **read-only** also.
|
|
|
|
{{#include ../../banners/hacktricks-training.md}}
|
|
|
|
|
|
|