22034, 5/1102 ȸ¿ø°¡ÀÔ  ·Î±×ÀΠ 
   lMaxl04
   http://1111
   libc °ü·Ã

http://www.hackerschool.org/HS_Boards/zboard.php?id=Free_Board&no=37634 [º¹»ç]


Æ÷³Êºí ¹®Á¦¸¦ Ç®´Ùº¸¸é libc°¡ Á¦°øµÇ´Â °æ¿ì°¡ ´Ù¼Ò ÀÖ´Â °Í °°½À´Ï´Ù

¹®Á¦ ÆÄÀÏ ½ÇÇà ½Ã ÇØ´ç ÆÄÀÏÀ» ÂüÁ¶ÇؾßÇϴµ¥ ¾î¶»°Ô ÂüÁ¶ÇÏ°Ô ¸¸µé ¼ö ÀÖ³ª¿ä?

libc¿¡ ¸Â´Â ld ÆÄÀÏÀ» ã¾Æ ÇÔ²² patchelf¸¦ Çغ¸·ÁÇßÀ¸³ª libc¿¡ ¸Â´Â ld ÆÄÀÏÀÌ Àß Ã£¾ÆÁöÁö ¾Ê±âµµ ÇÏ°í¿ä ¤Ð¤Ð

¹°·Ð ³ë°¡´Ù·Î ¿ÀÇÁ¼ÂÀ» ±¸ÇÒ ¼ö´Â ÀÖ´Ù´Â°Ç Áõ¸íÇÏ¿´½À´Ï´Ù ¤¾¤¾

  Hit : 2120     Date : 2022/07/29 06:02



    
lMaxl04 Ãß°¡·Î, strings·Î libc ÆÄÀÏ¿¡¼­ /bin/shÀÇ offsetÀ» ã´Âµ¥, ÇÔ¼ö ÁÖ¼Ò´Â ¿Ö ±×·¸°Ô ãÀ¸¸é offsetÀÌ ´Ù¸¥Áö ±Ã±ÝÇÕ´Ï´Ù. 2022/07/29  
cd80 º¸Åë libc°¡ ÁÖ¾îÁö´Â °æ¿ì¿¡ patchelf°°Àº°É·Î °°ÀÌ ½ÇÇàÇؾߵǴ °æ¿ì´Â Èü¹®Á¦Ç®¶§ ¾Æ´Ï¸é °ÅÀÇ ¾ø½À´Ï´Ù
Èü¹®Á¦Ç®¶§´Â ÁÖ¾îÁø libc·Î °°ÀÌ ½ÇÇàÇϸé ÁÁÀº ÀÌÀ¯°¡ libc ¹öÀü¸¶´Ù Èü¿¡ °É·ÁÀÖ´Â check & mitigationÀÌ ´Ù¸£±â ‹š¹®ÀÔ´Ï´Ù
´ñ±ÛÀÇ ³»¿ëÀ¸·Î º¸¾Æ ´Ü¼øÈ÷ systemÇÔ¼ö¿Í /bin/sh¹®ÀÚ¿­ÀÇ ¿ÀÇÁ¼Â¸¸ ãÀ¸¸é µÇ´Â °æ¿ì °°Àºµ¥
(base) ➜ ~ strings -t x /lib/x86_64-linux-gnu/libc.so.6 | grep /bin/sh
1b45bd /bin/sh
(base) ➜ ~ objdump -d /lib/x86_64-linux-gnu/libc.so.6 | grep system\.\*\>:
0000000000052290 <__libc_system@@GLIBC_PRIVATE>:
0000000000153ae0 <svcerr_systemerr@@GLIBC_2.2.5>:
(base) ➜ ~

ÀÌ·±½ÄÀ¸·Î ãÀ¸½Ã¸é µË´Ï´Ù
/bin/shÀÇ offset = 0x1b45bd
systemÀÇ offset = 0x52290

ÇÔ¼öÁÖ¼Ò¸¦ strings·Î ãÀ¸¸é ´Ù¸¥ ÀÌÀ¯´Â systemÇÔ¼öÀÇ ½ÃÀÛÀº "system"¹®ÀÚ¿­ÀÇ ÁÖ¼Ò°¡ ¾Æ´Ï¶ó systemÇÔ¼ö ÄÚµåÀÇ ½ÃÀÛÁּұ⠶§¹®À̱¸¿ä
2022/08/01  
lMaxl04 ¿ª½Ã ¤¾¤¾ ±â´Ù·È½À´Ï´Ù
¿ì¼± ´ñ±ÛÀÇ Áú¹®¿¡ ´ëÇÑ ´äÀº Àß ÀÌÇØÇß½À´Ï´Ù.

¸»¾¸ÇϽŠ°Í°ú °°ÀÌ ´Ü¼øÈ÷ offsetÀ» ±¸ÇÏ´Â °æ¿ì°¡ ´ëºÎºÐÀ̶ó »ç½Ç ±×³É ãÀ¸¸é µÇ±ä Çϴµ¥, °£È¤ libc ³»ÀÇ Æ¯Á¤ ÇÔ¼öÀÇ Áß°£ÁîÀ½¿¡¼­ memory leakÀÌ ÀϾ´Â °æ¿ì libc ¹öÀü¿¡ µû¶ó¼­ ÇØ´ç ÇÔ¼öÀÇ À§Ä¡°¡ ´Ù¸¥ °æ¿ì°¡ ÀÖ´Â °ÍÀ» È®ÀÎÇÏ¿©¼­ ±×·± ±Ã±ÝÁõÀÌ µé¾ú½À´Ï´Ù ¤¾¤¾

¿¹¸¦ µé¾î libc_1.so ¿¡¼­ printf + 100ÀÇ À§Ä¡°¡ leak µÇ¾ú´Âµ¥,
libc_2.so¿¡¼­´Â printf + 200ÀÇ À§Ä¡°¡ leak µÇ´Â °æ¿ì ÀÔ´Ï´Ù.

¿ª½Ã patchelf ¸»°í´Â ¹æ¹ýÀÌ ¾øÀ¸·Á³ª¿ä?
2022/08/01  
cd80 ½±Áö ¾Ê³×¿ä ¾î¶² °æ¿ìÀÎÁö ¾Ë°Ú´Âµ¥ Àúµµ ±×·²¶§¸¶´Ù Á¤È®È÷ ½ÃÀÛÁ¡ÀÌ ¸¯µÇ´Â ÇÔ¼öµé·Î ¹Ù²ã¼­ ¸¯½ÃÄ×¾ú°Åµç¿ä memcpyÇÔ¼ö°°Àº°æ¿ì´Â base³ª lenÀÇ align¿¡ µû¶ó fast path, slow path·Î ³ª´²Áö±âµµ Çϴµ¥ ±×·±°æ¿ì¿¡ ´Ù¸£°Ô ¸¯µÇ´Â°Ô ¾Æ´Ò±î ½Í³×¿ä Á¤È®ÇÑ ÀÌÀ¯´Â ¸ð¸£°Ú½À´Ï´Ù 2022/08/02  
lMaxl04 ´äº¯ °¨»çÇÕ´Ï´Ù ¤¾¤¾
¿ì¼±Àº patchelf¿¡ ´ëÇؼ­ Á¶±Ý ¾Ë¾ÆºÁ¾ß°Ú½À´Ï´Ù.
¿ª½Ã³ª À̹ø¿¡µµ Å« µµ¿ò µÇ¾ú½À´Ï´Ù. °¨»çÇÕ´Ï´Ù
2022/08/03  
21954   ÇØÄ¿ Ä¿¹Â´ÏƼ »çÀÌÆ® Á» ¾Ë·ÁÁÖ¼¼¿ä... [1]     walker
01/22 2636
21953   ÇØÅ· °ú¿Ü ÇÕ´Ï´Ù.[3]     jdo
01/12 2161
21952   ÇØÅ· ÀßÇϽôºÐ[3]     sksh1290
01/03 2040
21951   Ãʺ¸ÀÚ¿ë ±â¼öÁ¦ Áö¿Á ÈÆ·Ã ¼­¹ÙÀ̹ú ½ºÅ͵ð±×·ì ºý°øÆÌ 6±â ¸ðÁý     teamh4c
01/01 2150
21950   ´Ù½Ã ÇØÅ·°ú¿Ü µéÀ¸½ÇºÐ ¸ðÁýÇÕ´Ï´Ù.[5]     sysadm
12/23 1944
21949   cd80´Ô °¨»ç ÀÎ»ç µå¸³´Ï´Ù.[2]     lMaxl04
12/15 1500
21948   ¸ð ±×·ì¿¡ Èë¼öÀú ÄÚ½ºÇÁ·¹ ÇÏ´Â ¶Ç¶óÀÌ ÇØÄ¿°¡ ÀÖ½À´Ï´Ù[3]     gggg
12/05 2216
21947   ÇØÅ· º¸¾È °ü·Ã °ú¿Ü¸¦ ÁøÇàÇÕ´Ï´Ù.[1]     bluewindsoul
09/11 2265
21946   ¿ì¸®ÀºÇà ÇØÅ·´ëȸ ¾È³»[1]     wooricon
09/05 2484
  libc °ü·Ã[5]     lMaxl04
07/29 2119
21944   ÇØÅ· °ú¿Ü ¼±»ý´Ô ã½À´Ï´Ù.     ploplo33
07/10 2108
21943   ÇØÅ·ÆÀ ¹× º¸¾È½ºÅ͵ð ¸ðÁý     hideroot
06/21 2996
21942   ¸î³â¸¸ÀÎÁö ¸ð¸£°Ú³×¿ä ´Ù½Ã ½ÃÀÛÇϸç lob Áú¹® Çϳª µå¸³´Ï´Ù[10]     lMaxl04
05/01 2463
21941   Â÷¼¼´ë º¸¾È¸®´õ ¾ç¼º ÇÁ·Î±×·¥ 11±â ¸ðÁý ¿¹Á¤     ÇѽÂÀç
04/26 2418
21940   ¿ìºÐÅõ 22.04 LTS°¡ Ãâ½ÃµÇ¾ú½À´Ï´Ù     ÇѽÂÀç
04/23 2193
21939   ÇØÅ· ±âÃÊ °ú¿ÜÇÕ´Ï´Ù~[2]     jsi606897
04/10 3121
21938   2022 µðÁöÅÐ Æ÷·»½Ä 縰Áö ÀÏÁ¤ÀÌ °ø°³ µÇ¾ú½À´Ï´Ù[2]     ÇѽÂÀç
04/05 2538
21937   º¸¾È ½ºÅ͵ð ÇÏ½Ç ºÐ[1]     mailwoou
03/29 2341
21936   »çÀÌÆ® ¸®´º¾óÀº ¾ðÁ¦µÇ³ª¿ä?[3]     john1913
03/03 2528
21935   ÇØÅ· º¸¾È °ü·Ã °ú¿Ü¸¦ ÁøÇàÇÕ´Ï´Ù.[1]     bluewindsoul
02/14 3187
[1][2][3][4] 5 [6][7][8][9][10]..[1102]

Copyright 1999-2024 Zeroboard / skin by Hackerschool.org / Secure Patch by Hackerschool.org