\documentclass{beamer}

\usepackage[english]{ babel }
\usepackage[T1]{ fontenc }
\usepackage[utf8]{ inputenc }
\usepackage{ graphicx }
\graphicspath{ {./pix/} }
\usepackage{ lmodern }
\usepackage{ color }
\usepackage{ hyperref }
\usepackage{ amssymb }
\usepackage{ pifont }
\usepackage{ drawstack }

\usetheme{Median}

\title{Radare2 workshop}
\author{Exploitation}
\date{hack.lu}
\institute{Hack.lu 2014}

\begin{document}

\maketitle

\begin{frame}{Agenda}
	\tableofcontents
\end{frame}

\begin{frame}{whoami}
	\begin{block}{Julien (jvoisin) Voisin}
	\begin{itemize}
		\item French
		\item Student
		\item I suck at exploitation
		\item I'm looking for an internship ;)
	\end{itemize}
	\end{block}
\end{frame}

% This was the evaluate the level of the attendees
\begin{frame}{Quizz}
	\begin{itemize}[<+->]
		\item ASLR/PIE/NX/Canary
		\item GOT/PLT
		\item mona.py/peda
		\item CTF
		\item \#io
	\end{itemize}
\end{frame}

% Put the clever people on io and overthewire
\begin{frame}{1337-hackerz}
	Radare2 is available on \alert{io}\footnote{http://io.smashthestack.org/}
	and \alert{overthewire}\footnote{http://overthewire.org/wargames/}.

	\begin{center}
		\pause So \emph{take off your hats and go corrupt some memor-y-ies}.
	\end{center}
\end{frame}

\section{Crash course}
\begin{frame}{Exploitation}
	\begin{block}{Exploitation}
		An exploit is a piece of software [\dots] that takes advantage of [\dots] vulnerability in order to [\dots] gain control of a computer system.
	\end{block}
	\begin{center}
		This workshop is (mostly) about memory corruption.
	\end{center}
\end{frame}

% Show what is a program
\begin{frame}{Our playground}
	\begin{center}
		\includegraphics[height=6.5cm,width=\textwidth,trim = 0mm 12cm 0mm 0mm, clip]{regstacklisting.png}
	\end{center}
\end{frame}

% What is a stack
\begin{frame}{Stack}
	\begin{center}
	\begin{tikzpicture}[scale=0.75]
		\small
		\stacktop{}
		\startframe
		\padding{1}{...}
		\padding{1}{...}
		\padding{1}{...}
		\finishframe{stack frame 1}
		\startframe
		\padding{1}{...}
		\padding{1}{...}
		\padding{1}{...}
		\finishframe{stack frame 2}
		\stackbottom{}
	\end{tikzpicture}
	\end{center}
\end{frame}

% Mention Aleph One
\begin{frame}{Stack smashing}
	\begin{center}
		\begin{columns}
			\begin{column}{.5\textwidth}
				\includegraphics[height=6.5cm]{overflow1.png}
			\end{column}
			\begin{column}{.5\textwidth}
				\only<1>{\includegraphics[height=6.5cm]{overflow2.png}}
				\only<2>{\includegraphics[height=6.5cm]{overflow3.png}}
			\end{column}
		\end{columns}
	\end{center}
\end{frame}

% This is needed later for system-wide ASLR bypass
\begin{frame}{ASLR and GOT}
	\begin{center}
	\only<1>{\includegraphics[height=6cm]{got.png}}
	\only<2>{
		\begin{columns}
			\begin{column}{.5\textwidth}
				\includegraphics[width=\textwidth]{plt_before.png}
			\end{column}
			\begin{column}{.5\textwidth}
				\includegraphics[width=\textwidth]{plt_after.png}
			\end{column}
		\end{columns}
	}
	\end{center}
\end{frame}

\section{Pwn1}
\begin{frame}{Pwn1}
	\begin{itemize}
		\item Written for this workshop
		\item Oldschool \emph{classic} example
		\item You'll write the final exploit
	\end{itemize}
\end{frame}

\begin{frame}{Hu-ho.}
	\includegraphics[width=\textwidth,height=6.5cm]{segfault_pwn1.png}
\end{frame}

% Explain what a De Bruijn pattern is
\begin{frame}{De Bruijn patterns}
	\includegraphics[width=\textwidth,height=6.5cm]{bruijn.png}
\end{frame}

\begin{frame}{Exploit!}
	\begin{columns}
		\begin{column}{.3\textwidth}
			\begin{itemize}
				\item No ALSR
				\item No NX
				\item No Canary
			\end{itemize}
		\end{column}
		\begin{column}{.7\textwidth}
			\includegraphics[width=\textwidth,height=2cm]{pwn1_shellcode.png}
		\end{column}
	\end{columns}
\end{frame}

\begin{frame}{Generate shellcode}
	\includegraphics[width=\textwidth]{binsh.png}
	\vskip.5cm
	\includegraphics[width=\textwidth]{rop_pwn1.png}
\end{frame}

\begin{frame}{Your turn!}
	\begin{center}
		Write a working exploit!
	\end{center}
\end{frame}

\begin{frame}{Show me yours, I'll show you mine}
	\includegraphics[width=1.05\textwidth,height=4.5cm]{exploit_pwn1.png}
\end{frame}

\section{Pwn2}
\begin{frame}{Pwn2}
	\begin{itemize}
		\item Written for this workshop
		\item Gentle introduction to ROP
		\item You'll write the final exploit
	\end{itemize}
\end{frame}

\begin{frame}{Huho.}
	\includegraphics[width=1.05\textwidth]{pwn2.png}
\end{frame}

\begin{frame}{Mitigations?}
	\only<1>{
	\begin{itemize}
		\item[?] NX
		\item[?] ASLR
		\item[?] Canary
		\item[\ding{51}] System-wide ASLR
	\end{itemize}
}
	\only<2>{
	\begin{itemize}
		\item[\ding{51}] NX
		\item[\ding{55}] ASLR
		\item[\ding{55}] Canary
		\item[\ding{51}] System-wide ASLR
	\end{itemize}
}
\end{frame}

\begin{frame}{ROP}
	\includegraphics[width=\textwidth]{rop.png}
\end{frame}

\begin{frame}{Rop chain}
	\begin{tikzpicture}[scale=0.75]
		\small
		\stacktop{}
		\startframe
		\cell{Function to call}
		\cell{Return address}
		\cell{Parameter 1}
		\cell{Parameter 2}
		\finishframe{frame1}
		\startframe
		\padding{2}{...}
		\finishframe{frame2}
		\stackbottom{}
	\end{tikzpicture}
\end{frame}

\begin{frame}{Huho.}
	\includegraphics[width=1.05\textwidth]{pwn2.png}
\end{frame}

\begin{frame}{Thinking the ROP chain}
	\begin{tikzpicture}[scale=0.75]
		\small
		\stacktop{}
		\startframe
		\cell{system\_}
		\cell{0x41414141}
		\cell{???}
		\finishframe{frame1}
		\stackbottom{}
	\end{tikzpicture}
\end{frame}

\begin{frame}{Payload}
	\includegraphics[width=1.05\textwidth]{you.png}
\end{frame}

\begin{frame}{Thinking the ROP chain}
	\begin{tikzpicture}[scale=0.75]
		\small
		\stacktop{}
		\startframe
		\padding{2}{...}
		\finishframe{padding}
		\startframe
		\cell{system\_}
		\cell{0x41414141}
		\cell{0x08048637}
		\finishframe{frame1}
		\stackbottom{}
	\end{tikzpicture}
\end{frame}

\begin{frame}{Your turn!}
	\begin{center}
		Write a working exploit!
	\end{center}
\end{frame}

\begin{frame}{Show me yours, I'll show you mine}
	\includegraphics[width=1.05\textwidth,height=4.5cm]{exploit_pwn2.png}
\end{frame}

\section{Ropasaurus Rex}
\begin{frame}{radiff2}
	\includegraphics[width=1.05\textwidth]{radiff2.png}
\end{frame}

\begin{frame}{radiff2}
	\includegraphics[width=1\textwidth,height=6.5cm]{diff.png}
\end{frame}

\begin{frame}{Wat.}
	\begin{columns}
		\begin{column}{.3\textwidth}
			\includegraphics[width=\textwidth]{ppp.png}
		\end{column}
		\begin{column}{.7\textwidth}
			\begin{itemize}
				\item PlaidCTF 2013
				\item By the PPP (defcon ctf winners)
				\item \href{https://ctftime.org/ctfs}{ctftime} says it's a hard CTF
				\item We'll do it together, step by step.
			\end{itemize}
		\end{column}
	\end{columns}
\end{frame}

% This was a remote exploit
\begin{frame}{Socat}
	\includegraphics[width=\textwidth]{socat.png}
\end{frame}

\begin{frame}{Vulnerability}
	\begin{center}Find the vuln!\end{center}
\end{frame}

\begin{frame}{Source code}
	\includegraphics[width=\textwidth]{code.png}
\end{frame}

\begin{frame}{Mitigations?}
	\begin{itemize}
		\item[\ding{51}] NX
		\item[\ding{55}] ASLR
		\item[\ding{55}] Canary
		\item[\ding{51}] System-wide ASLR
	\end{itemize}
\end{frame}

\begin{frame}{Find the offset}
	\vskip2cm
	\begin{itemize}
		\item Static analysis
		\item De Bruijn Pattern
	\end{itemize}
	\vskip2cm
	\begin{center}
		\only<2>{\alert{140} bytes before overwriting EIP}
	\end{center}
\end{frame}

\begin{frame}{Rop chain}
	\begin{tikzpicture}[scale=0.75]
		\small
		\stacktop{}
		\startframe
		\cell{Function to call}
		\cell{Unstacking gadget}
		\cell{Parameter 1}
		\cell{Parameter 2}
		\cell{Parameter 3}
		\finishframe{frame1}
		\startframe
		\padding{2}{...}
		\finishframe{frame2}
		\stackbottom{}
	\end{tikzpicture}
\end{frame}

\begin{frame}{Thinking the ROP chain}
	\begin{enumerate}[<+->]
		\item Leak libc address of \alert{read(1)} and return to the vulnerable function
		\item Compute the offset of \alert{system(2)}
		\item Read our command, and write it \emph{somewhere}
		\item Call \alert{system(3)} on it
		\item Send our command
	\end{enumerate}
\end{frame}

\begin{frame}{Offsets}
	\includegraphics[width=\textwidth]{GOT.png}
	\begin{center}
		\begin{description}
			\item \alert{0x0804832c} plt.read
			\item \alert{0x0804830c} plt.write
			\item \alert{0x0804961c} got.read
		\end{description}
	\end{center}
\end{frame}

\begin{frame}{System}
	\only<1>{ \includegraphics[width=\textwidth]{libc.png} }
	\only<2>{ \includegraphics[width=\textwidth]{system_offset.png} }
\end{frame}

\begin{frame}{Gadgets}
	\includegraphics[width=\textwidth]{pppr.png}
\end{frame}

\begin{frame}{Writeable}
	\includegraphics[width=\textwidth]{writable.png}

	\begin{center}
		Let's use \alert{0x08049530}
	\end{center}
\end{frame}

\begin{frame}{Rop chain}
	\vskip.5cm
	\begin{columns}
		\begin{column}{.5\textwidth}
			\begin{center}STAGE1\end{center}

			\hskip-1.25cm
			\begin{tikzpicture}[scale=0.65]
				\small
				\stacktop{}
				\startframe
				\cell{write@plt}
				\cell{pop;pop;pop;ret}
				\cell{STDOUT}
				\cell{read@got}
				\cell{4}
				\finishframe{frame1}
				\startframe
				\cell{0x80483f4}
				\finishframe{frame2}
				\stackbottom{}
			\end{tikzpicture}
		\end{column}
		\begin{column}{.5\textwidth}
			\begin{center}STAGE2\end{center}

			\hskip-1.25cm
			\begin{tikzpicture}[scale=0.65]
				\small
				\stacktop{}
				\startframe
				\cell{read@plt}
				\cell{pop;pop;pop;ret}
				\cell{STDIN}
				\cell{\$WRITE\_ADDR}
				\cell{512}
				\finishframe{frame1}
				\startframe
				\cell{system}
				\cell{exit}
				\cell{writeaddr}
				\finishframe{frame2}
				\stackbottom{}
			\end{tikzpicture}
		\end{column}
	\end{columns}
\end{frame}

\begin{frame}{Your turn!}
	\begin{center}
		Write a working exploit!
	\end{center}
\end{frame}

\section*{Conclusion}
\begin{frame}{Conclusion}
	\begin{center}
	\only<1>{
		\begin{itemize}
			\item Exploitation is cool
			\item CTF-oriented
			\item More to come thanks to bindings
		\end{itemize}
	}
	\only<2>{
		\Large
		Radare2 is \alert{nice}.

		You should use it.
	}
	\end{center}
\end{frame}

\begin{frame}{Resources}
	\begin{itemize}
		\item \href{https://github.com/radare/radare2}{Github repo}
		\item \href{http://rada.re}{Official website}
		\item \href{http://radare.today}{The r2 blog}
		\item \href{http://maijin.github.io/radare2book/}{The r2 book}
		\item \href{https://twitter.com/radareorg}{Twitter}
	\end{itemize}
\end{frame}

\end{document}
