x64 DEP/PIE Lina support / x64 Lina support

Are you working on supporting anything after 9.2.4?

The finder fails on 9.6.1

root@host:~# python2 lina-offsets.py lina961
{u'after': 0, u'name': u'JMPESP', u'oneshot': True, 'found': [{'operation': 'mov    WORD PTR [rbp-0x100],0x10e4', 'bytes': '66 c7 85 00 ff ff ff e4 10', 'address': 'df2223'}], u'type': u'EXACT', u'find': [u'ff e4'], u'match': u'ff e4', u'before': 0}
Usage: lina-offsets.py lina_file

@d091fccc62e2d24ab101dbe01ce844f6 that looks like a catastrophic failure, as none of the useful offsets were found (JMPESP is a freebie).

It will take some manual reversing to patch the finder. The finder is kind of strict. I can't give any estimate right now, but I will try to look into it sometime this week.

But yes, the goal is to support all vulnerable versions.

@d091fccc62e2d24ab101dbe01ce844f6 I didn't realize these files are 64-bit ELFs. Supporting them will require an x64 shellcode payload. Because offset sizes are twice the size, we'll probably need to send two packets. That's no big deal though, the other problem is I don't think we have hardware available to test on. @Aleph-Naught- is out of town this week, but maybe next week we will try to get a virtualized lab and work on it. I should be able to track down offsets in the meantime, but the stack frame cleanup will require some work with a debugger.

@d091fccc62e2d24ab101dbe01ce844f6 this version of Lina appears to also be a PIE and have DEP. Denial of service is about the best that can be done without a lot of luck/effort.

zerosum0x0@localhost:~$ hardening-check lina961 | grep Position
 Position Independent Executable: yes

zerosum0x0@localhost:~$ readelf -e lina961 | grep STACK -A 1
  GNU_STACK      0x0000000000000000 0x0000000000000000 0x0000000000000000
                 0x0000000000000000 0x0000000000000000  RW     8

Note stack is RW and not RWE.

Going to mark this as "wontfix". :( I will add a --mode option to run a generic DoS though.

9.4.1 doesn't have PIE and has an executable stack

You should be able to get a copy that is easily deployable from a qcow2.

root@ubuntu:~# readelf -e lina941
ELF Header:
  Magic:   7f 45 4c 46 02 01 01 00 00 00 00 00 00 00 00 00
  Class:                             ELF64
  Data:                              2's complement, little endian
  Version:                           1 (current)
  OS/ABI:                            UNIX - System V
  ABI Version:                       0
  Type:                              EXEC (Executable file)
  Machine:                           Advanced Micro Devices X86-64
  Version:                           0x1
  Entry point address:               0x424a64
  Start of program headers:          64 (bytes into file)
  Start of section headers:          63824072 (bytes into file)
  Flags:                             0x0
  Size of this header:               64 (bytes)
  Size of program headers:           56 (bytes)
  Number of program headers:         9
  Size of section headers:           64 (bytes)
  Number of section headers:         32
  Section header string table index: 30

Section Headers:
  [Nr] Name              Type             Address           Offset
       Size              EntSize          Flags  Link  Info  Align
  [ 0]                   NULL             0000000000000000  00000000
       0000000000000000  0000000000000000           0     0     0
  [ 1] .interp           PROGBITS         0000000000400238  00000238
       000000000000001c  0000000000000000   A       0     0     1
  [ 2] .note.ABI-tag     NOTE             0000000000400254  00000254
       0000000000000020  0000000000000000   A       0     0     4
  [ 3] .gnu.hash         GNU_HASH         0000000000400278  00000278
       00000000000000d8  0000000000000000   A       4     0     8
  [ 4] .dynsym           DYNSYM           0000000000400350  00000350
       0000000000002ad8  0000000000000018   A       5     1     8
  [ 5] .dynstr           STRTAB           0000000000402e28  00002e28
       0000000000001984  0000000000000000   A       0     0     1
  [ 6] .gnu.version      VERSYM           00000000004047ac  000047ac
       0000000000000392  0000000000000002   A       4     0     2
  [ 7] .gnu.version_r    VERNEED          0000000000404b40  00004b40
       00000000000001f0  0000000000000000   A       5     9     8
  [ 8] .rela.dyn         RELA             0000000000404d30  00004d30
       0000000000000108  0000000000000018   A       4     0     8
  [ 9] .rela.plt         RELA             0000000000404e38  00004e38
       00000000000028c8  0000000000000018   A       4    11     8
  [10] .init             PROGBITS         0000000000407700  00007700
       0000000000000029  0000000000000000  AX       0     0     4
  [11] .plt              PROGBITS         0000000000407730  00007730
       0000000000001b40  0000000000000010  AX       0     0     16
  [12] .text             PROGBITS         0000000000409280  00009280
       0000000002411978  0000000000000000  AX       0     0     64
  [13] dp_text           PROGBITS         000000000281ac00  0241ac00
       000000000000b472  0000000000000000  AX       0     0     16
  [14] .fini             PROGBITS         0000000002826074  02426074
       000000000000000e  0000000000000000  AX       0     0     4
  [15] .rodata           PROGBITS         00000000028260a0  024260a0
       000000000098c53c  0000000000000000   A       0     0     32
  [16] .eh_frame_hdr     PROGBITS         00000000031b25dc  02db25dc
       00000000000b3cbc  0000000000000000   A       0     0     4
  [17] .eh_frame         PROGBITS         0000000003266298  02e66298
       00000000003a9a0c  0000000000000000   A       0     0     8
  [18] .gcc_except_table PROGBITS         000000000360fca4  0320fca4
       00000000000002e4  0000000000000000   A       0     0     4
  [19] .tdata            PROGBITS         0000000003810000  03210000
       0000000000002068  0000000000000000 WAT       0     0     16
  [20] .ctors            PROGBITS         0000000003812068  03212068
       0000000000000918  0000000000000000  WA       0     0     8
  [21] .dtors            PROGBITS         0000000003812980  03212980
       0000000000000018  0000000000000000  WA       0     0     8
  [22] .jcr              PROGBITS         0000000003812998  03212998
       0000000000000008  0000000000000000  WA       0     0     8
  [23] .dynamic          DYNAMIC          00000000038129a0  032129a0
       0000000000000260  0000000000000010  WA       5     0     8
  [24] .got              PROGBITS         0000000003812c00  03212c00
       0000000000000018  0000000000000008  WA       0     0     8
  [25] .got.plt          PROGBITS         0000000003812c18  03212c18
       0000000000000db0  0000000000000008  WA       0     0     8
  [26] .data             PROGBITS         00000000038139e0  032139e0
       0000000000aca578  0000000000000000  WA       0     0     32
  [27] freq_data_section PROGBITS         00000000042ddf80  03cddf80
       0000000000000020  0000000000000000  WA       0     0     64
  [28] .bss              NOBITS           00000000042ddfc0  03cddfa0
       00000000037aa1a8  0000000000000000  WA       0     0     64
  [29] .gnu_debuglink    PROGBITS         0000000000000000  03cddfa0
       0000000000000010  0000000000000000           0     0     1
  [30] .shstrtab         STRTAB           0000000000000000  03cddfb0
       0000000000000114  0000000000000000           0     0     1
  [31]                   NOTE             0000000000000000  03cde8c8
       00000000000001a0  0000000000000000           0     0     4
Key to Flags:
  W (write), A (alloc), X (execute), M (merge), S (strings), l (large)
  I (info), L (link order), G (group), T (TLS), E (exclude), x (unknown)
  O (extra OS processing required) o (OS specific), p (processor specific)

Program Headers:
  Type           Offset             VirtAddr           PhysAddr
                 FileSiz            MemSiz              Flags  Align
  PHDR           0x0000000000000040 0x0000000000400040 0x0000000000400040
                 0x0000000003cdea68 0x00000000000001f8  R E    8
  INTERP         0x0000000000000238 0x0000000000400238 0x0000000000400238
                 0x000000000000001c 0x000000000000001c  R      1
      [Requesting program interpreter: /lib64/ld-linux-x86-64.so.2]
  LOAD           0x0000000000000000 0x0000000000400000 0x0000000000400000
                 0x000000000320ff88 0x000000000320ff88  R E    200000
  LOAD           0x0000000003210000 0x0000000003810000 0x0000000003810000
                 0x0000000000acdfa0 0x0000000004278168  RW     200000
  DYNAMIC        0x00000000032129a0 0x00000000038129a0 0x00000000038129a0
                 0x0000000000000260 0x0000000000000260  RW     8
  NOTE           0x0000000000000254 0x0000000000400254 0x0000000000400254
                 0x0000000000000020 0x0000000000000020  R      4
  TLS            0x0000000003210000 0x0000000003810000 0x0000000003810000
                 0x0000000000002068 0x0000000000002068  R      10
  GNU_EH_FRAME   0x0000000002db25dc 0x00000000031b25dc 0x00000000031b25dc
                 0x00000000000b3cbc 0x00000000000b3cbc  R      4
  GNU_STACK      0x0000000000000000 0x0000000000000000 0x0000000000000000
                 0x0000000000000000 0x0000000000000000  RWE    8

 Section to Segment mapping:
  Segment Sections...
   00
   01     .interp
   02     .interp .note.ABI-tag .gnu.hash .dynsym .dynstr .gnu.version .gnu.vers                                                                                                                                    ion_r .rela.dyn .rela.plt .init .plt .text dp_text .fini .rodata .eh_frame_hdr .                                                                                                                                    eh_frame .gcc_except_table
   03     .tdata .ctors .dtors .jcr .dynamic .got .got.plt .data freq_data_secti                                                                                                                                    on .bss
   04     .dynamic
   05     .note.ABI-tag
   06     .tdata
   07     .eh_frame_hdr
   08
root@ubuntu:~# hardening-check lina941
lina941:
 Position Independent Executable: no, normal executable!
 Stack protected: no, not found!
 Fortify Source functions: no, only unprotected functions found!
 Read-only relocations: no, not found!
 Immediate binding: no, not found!