Add x86 CET status to checksec output

peace-maker commented 11 months ago

Check if the binary was compiled with Control-flow Enforcement Technology (CET) and display if it supports shadowstack (SHSTK) and indirect branch tracking (IBT). Even though IBT hardware is rare (using those endbr instructions) it's useful to be futureproof here.

A binary compiled with -fcf-protection=full will now show both features in the checksec output:

[*] './test'
    Arch:     amd64-64-little
    RELRO:    Full RELRO
    Stack:    No canary found
    NX:       NX enabled
    PIE:      PIE enabled
    SHSTK:    Enabled
    IBT:      Enabled

This requires bumping of the minimum pyelftools version, which shouldn't be a problem and is required anyways as shown in #2280.

Similarly, the target machine's cpuinfo features are checked for "user_shstk" capabilities in ssh.checksec to know if the cpu and kernel support userspace shadowstack as described in the shstk docs.

Closes #2288

Arusekk commented 11 months ago

Nice! Two ideas:

IBT support in kernel can also be validated on SSH (but since ibt is just 3 letters, I'm afraid we should do proper parsing to avoid false positives),
maybe common code paths can be factored out in case more features appear interesting? (HWASAN might get useful one day for example, but is not quite there yet)
I know this is not in scope of this PR but I just noticed: ssh uses shellcraft.cat('/proc/self/maps') for testing the ASLR ulimit trick, which won't work on new kernels (see #1871 and #1995).
since the PR bumps pyelftools, maybe we can revisit iter_notes in corefile parsing? https://github.com/Gallopsled/pwntools/blob/5ff96409fc3ec188d9082fb7b1421e2e710e43d7/pwnlib/elf/corefile.py#L119-L122 (pyelftools supposedly fixed at least some of it in 0.25)

peace-maker commented 11 months ago

I've added ibt checks to ssh.checksec and refactored the property parsing to deduplicate code.

I'll change corefile parsing and cat2 separately.

Gallopsled / pwntools

Add x86 CET status to checksec output #2293