hacking-the-art-of-exploitation

Recommendations

Info

Despite the randomization between runs, notice how similar the address in ESP is to the address of the buffer (shown in bold). This makes sense, since the stack pointer points to the stack and the buffer is on the stack. ESP’s value and the buffer’s address are changed by the same random value, because they are relative to each other. GDB’s stepi command steps the program forward in execution by a single instruction. Using this, we can check ESP’s value after the ret instruction has executed. (gdb) run The program being debugged has been started already. Start it from the beginning? (y or n) y Starting program: /home/reader/booksrc/aslr_demo buffer is at 0xbfd1ccb0 Breakpoint 1, 0x080483fa in main (argc=134513588, argv=0x1) at aslr_demo.c:12 12 } (gdb) i r esp esp 0xbfd1ccfc 0xbfd1ccfc (gdb) stepi 0xb7e4debc in __libc_start_main () from /lib/tls/i686/cmov/libc.so.6 (gdb) i r esp esp 0xbfd1cd00 0xbfd1cd00 (gdb) x/24x 0xbfd1ccb0 0xbfd1ccb0: 0x00000000 0x080495cc 0xbfd1ccc8 0x08048291 0xbfd1ccc0: 0xb7f3d729 0xb7f74ff4 0xbfd1ccf8 0x08048429 0xbfd1ccd0: 0xb7f74ff4 0xbfd1cd8c 0xbfd1ccf8 0xb7f74ff4 0xbfd1cce0: 0xb7f937b0 0x08048410 0x00000000 0xb7f74ff4 0xbfd1ccf0: 0xb7f9fce0 0x08048410 0xbfd1cd58 0xb7e4debc 0xbfd1cd00: 0x00000001 0xbfd1cd84 0xbfd1cd8c 0xb7fa0898 (gdb) p 0xbfd1cd00 - 0xbfd1ccb0 $1 = 80 (gdb) p 80/4 $2 = 20 (gdb) Single stepping shows that the ret instruction increases the value of ESP by 4. Subtracting the value of ESP from the address of the buffer, we find that ESP is pointing 80 bytes (or 20 words) from the start of the buffer. Since the return address’s offset was 19 words, this means that after main’s final ret instruction, ESP points to stack memory found directly after the return address. This would be useful if there was a way to control EIP to go where ESP is pointing instead. 0x6c2 Bouncing Off linux-gate The technique described below doesn’t work with Linux kernels starting from 2.6.18. This technique gained some popularity and, of course, the developers patched the problem. The kernel used in the included LiveCD is 2.6.20, so the output below is from the machine loki, which is running a 2.6.17 Linux kernel. Even though this particular technique doesn’t work on the LiveCD, the concepts behind it can be applied in other useful ways. 384 0x600
Bouncing off linux-gate refers to a shared object, exposed by the kernel, which looks like a shared library. The program ldd shows a program’s shared library dependencies. Do you notice anything interesting about the linux-gate library in the output below? matrix@loki /hacking $ $ uname -a Linux hacking 2.6.17 #2 SMP Sun Apr 11 03:42:05 UTC 2007 i686 GNU/Linux matrix@loki /hacking $ cat /proc/sys/kernel/randomize_va_space 1 matrix@loki /hacking $ ldd ./aslr_demo linux-gate.so.1 => (0xffffe000) libc.so.6 => /lib/libc.so.6 (0xb7eb2000) /lib/ld-linux.so.2 (0xb7fe5000) matrix@loki /hacking $ ldd /bin/ls linux-gate.so.1 => (0xffffe000) librt.so.1 => /lib/librt.so.1 (0xb7f95000) libc.so.6 => /lib/libc.so.6 (0xb7e75000) libpthread.so.0 => /lib/libpthread.so.0 (0xb7e62000) /lib/ld-linux.so.2 (0xb7fb1000) matrix@loki /hacking $ ldd /bin/ls linux-gate.so.1 => (0xffffe000) librt.so.1 => /lib/librt.so.1 (0xb7f50000) libc.so.6 => /lib/libc.so.6 (0xb7e30000) libpthread.so.0 => /lib/libpthread.so.0 (0xb7e1d000) /lib/ld-linux.so.2 (0xb7f6c000) matrix@loki /hacking $ Even in different programs and with ASLR enabled, linux-gate.so.1 is always present at the same address. This is a virtual dynamically shared object used by the kernel to speed up system calls, which means it’s needed in every process. It is loaded straight from the kernel and doesn’t exist anywhere on disk. The important thing is that every process has a block of memory containing linux-gate’s instructions, which are always at the same location, even with ASLR. We are going to search this memory space for a certain assembly instruction, jmp esp. This instruction will jump EIP to where ESP is pointing. First, we assemble the instruction to see what it looks like in machine code. matrix@loki /hacking $ cat > jmpesp.s BITS 32 jmp esp matrix@loki /hacking $ nasm jmpesp.s matrix@loki /hacking $ hexdump -C jmpesp 00000000 ff e4 |..| 00000002 matrix@loki /hacking $ Using this information, a simple program can be written to find this pattern in the program’s own memory. Countermeasures 385
Page 1:
CD INside 2nd Edition Hacking the a
Page 5 and 6:
® San Francisco
Page 7:
BRIEF CONTENTS Preface ............
Page 10 and 11:
0x300 EXPLOITATION 115 0x310 Genera
Page 12 and 13:
0x6a0 Hardening Countermeasures....
Page 14 and 15:
ACKNOWLEDGMENTS I would like to tha
Page 16 and 17:
2 0x100 The rules for this problem
Page 18 and 19:
4 0x100 overly simplistic encryptio
Page 20 and 21:
can be written to accomplish any gi
Page 22 and 23:
0x230 Control Structures Without co
Page 24 and 25:
lest it continue into infinity. A w
Page 26 and 27:
called constants. Returning to the
Page 28 and 29:
Quite often in programs, variables
Page 30 and 31:
0x244 Functions Sometimes there wil
Page 32 and 33:
void turn(variable_direction, targe
Page 34 and 35:
library, a function prototype is ne
Page 36 and 37:
Like a row of houses on a local str
Page 38 and 39:
Below, GDB is used to show the stat
Page 40 and 41:
There are also operations that are
Page 42 and 43:
The display format also uses a sing
Page 44 and 45:
The first four bytes are shown both
Page 46 and 47:
(gdb) x/10i $eip 0x804838b : cmp DW
Page 48 and 49:
022 18 12 DC2 122 82 52 R 023 19 13
Page 50 and 51:
familiar address of EBP minus 4 int
Page 52 and 53:
the English language, knowledge of
Page 54 and 55:
Function "strcpy" not defined. Make
Page 56 and 57:
only be in one of 2 32 possible bit
Page 58 and 59:
pointer.c #include #include int m
Page 60 and 61:
addressof.c #include int main() {
Page 62 and 63:
0x264 Format Strings The printf() f
Page 64 and 65:
The final line just shows the addre
Page 66 and 67:
As discussed earlier, dividing the
Page 68 and 69:
} } printf("[char pointer] points t
Page 70 and 71:
Naturally, it is far easier just to
Page 72 and 73:
This is rather hacky, but since thi
Page 74 and 75:
eader@hacking:~/booksrc $ ./a.out '
Page 76 and 77:
0x267 Variable Scoping Another inte
Page 78 and 79:
[in func1] i = 5, j = 42 [in func2]
Page 80 and 81:
10 (gdb) break 7 Breakpoint 1 at 0x
Page 82 and 83:
Notice that the static_var retains
Page 84 and 85:
70 0x200 The heap segment is a segm
Page 86 and 87:
End of assembler dump (gdb) disass
Page 88 and 89:
0x804836f : mov DWORD PTR [esp+8],0
Page 90 and 91:
int global_initialized_var = 5; voi
Page 92 and 93:
int main(int argc, char *argv[]) {
Page 94 and 95:
errorchecked_heap.c #include #incl
Page 96 and 97:
The bar code on the back of this bo
Page 98 and 99:
eader@hacking:~/booksrc $ ./simplen
Page 100 and 101:
} printf("\n"); display_flags("O_WR
Page 102 and 103:
eader@hacking:~/booksrc $ chmod 731
Page 104 and 105:
uid_demo.c #include int main() { p
Page 106 and 107:
} void fatal(char *); // A function
Page 108 and 109:
#define FILENAME "/var/notes" int p
Page 110 and 111:
[DEBUG] found a 34 byte note for us
Page 112 and 113:
of current_time, an empty tm struct
Page 114 and 115:
While struct memory can be accessed
Page 116 and 117:
815015288 1315541117 2080969327 450
Page 118 and 119:
printf("6 - Reset your account at 1
Page 120 and 121:
int fd; } printf("\n===============
Page 122 and 123:
} } // This function is the Pick a
Page 124 and 125:
invalid_choice = 1; while(invalid_c
Page 126 and 127:
Would you like to play again? (y/n)
Page 128 and 129:
114 0x200 Play around with this pro
Page 130 and 131:
A program can only do what it’s p
Page 132 and 133:
don’t say exactly what their crea
Page 134 and 135:
By now, you should be able to read
Page 136 and 137:
eader@hacking:~/booksrc $ gcc explo
Page 138 and 139:
11 if(strcmp(password_buffer, "bril
Page 140 and 141:
auth_overflow2.c #include #include
Page 142 and 143:
As expected, the overflow cannot di
Page 144 and 145:
(gdb) c Continuing. Breakpoint 2, c
Page 146 and 147:
Notice the two lines shown in bold
Page 148 and 149:
eader@hacking:~/booksrc $ perl -e '
Page 150 and 151:
0x0804848d : mov eax,DWORD PTR [eax
Page 152 and 153:
20 offset = atoi(argv[1]); (gdb) 21
Page 154 and 155:
called the NOP sled, that can assis
Page 156 and 157:
The function of the for loop should
Page 158 and 159:
\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6
Page 160 and 161:
eader@hacking:~/booksrc $ ./notesea
Page 162 and 163:
int main(int argc, char *argv[]) {
Page 164 and 165:
char *buffer = (char *) malloc(160)
Page 166 and 167:
7e99000-b7e9a000 rw-p b7e99000 00:0
Page 168 and 169:
for that user. Using the salt value
Page 170 and 171:
0x342 Overflowing Function Pointers
Page 172 and 173:
7 - Quit [Name: Jon Erickson] [You
Page 174 and 175:
0804b630 A _edata 0804b6d4 A _end 0
Page 176 and 177:
n 5 AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
Page 178 and 179:
6 - Reset your account at 100 credi
Page 180 and 181:
[Name: Jon Erickson] [You have 1230
Page 182 and 183:
Parameter Input Type Output Type %d
Page 184 and 185:
This is an interesting detail that
Page 186 and 187:
0x353 Reading from Arbitrary Memory
Page 188 and 189:
The wrong way to print user-control
Page 190 and 191:
The addresses and junk data at the
Page 192 and 193:
eader@hacking:~/booksrc $ reader@ha
Page 194 and 195:
0x355 Direct Parameter Access Direc
Page 196 and 197:
Since the stack doesn’t need to b
Page 198 and 199:
0x357 Detours with .dtors In binary
Page 200 and 201:
located. Then the actual bytes are
Page 202 and 203:
Since the .dtors section is writabl
Page 204 and 205:
[DEBUG] found a 34 byte note for us
Page 206 and 207:
eader@hacking:~/booksrc $ objdump -
Page 209 and 210:
0x400 NETWORKING Communication and
Page 211 and 212:
For example, whenever you browse th
Page 213 and 214:
Datagram sockets and UDP are common
Page 215 and 216:
From /usr/include/bits/socket.h /*
Page 217 and 218:
htons(short value) Host-to-Network
Page 219 and 220:
fatal("in socket"); if (setsockopt(
Page 221 and 222:
When compiled and run, the program
Page 223 and 224:
This reveals that the webserver is
Page 225 and 226:
From /usr/include/netdb.h /* Descri
Page 227 and 228:
} while(recv_line(sockfd, buffer))
Page 229 and 230:
} /* This function handles the conn
Page 231 and 232:
Accepting web requests on port 80 G
Page 233 and 234:
the two addressing schemes. In the
Page 235 and 236:
also exist on this layer. ICMP pack
Page 237 and 238:
0 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3
Page 239 and 240:
Interrupt:16 Base address:0x2024 re
Page 241 and 242:
u_char buffer[9000]; if ((sockfd =
Page 243 and 244:
pcap_handle = pcap_open_live(device
Page 245 and 246:
eader@hacking:~/booksrc $ $ grep -R
Page 247 and 248:
The compiler padding, as mentioned
Page 249 and 250:
Now that the headers are defined as
Page 251 and 252:
The caught_packet() function gets c
Page 253 and 254:
With the headers decoded and separa
Page 255 and 256:
Due to timeout values, the victim m
Page 257 and 258:
eader@hacking:~/booksrc $ sudo neme
Page 259 and 260:
data structures for the packet head
Page 261 and 262:
if (pd->file_mem == NULL) pd->file_
Page 263 and 264:
only builds ethernet/IP ARP packets
Page 265 and 266:
The remaining libnet functions get
Page 267 and 268:
dest_ip = libnet_name_resolve(argv[
Page 269 and 270:
In the example above, the host 192.
Page 271 and 272:
0x454 Ping Flooding Flooding DoS at
Page 273 and 274:
The host machine will receive the s
Page 275 and 276:
char errbuf[PCAP_ERRBUF_SIZE]; // S
Page 277 and 278:
TH_RST, // Control flags (RST flag
Page 279 and 280:
Christmas tree), and the Null scan
Page 281 and 282:
0x475 Proactive Defense (shroud) Po
Page 283 and 284:
char errbuf[PCAP_ERRBUF_SIZE]; // S
Page 285 and 286:
NULL, // Payload (none) 0, // Paylo
Page 287 and 288:
} while(recv(sockfd, ptr, 1, 0) ==
Page 289 and 290:
$1 = 540 (gdb) p /x 0xbffff5c0 + 20
Page 291 and 292:
" 90 90 90 90 90 90 90 90 90 90 90
Page 293 and 294:
When this exploit is compiled and r
Page 295 and 296:
0x500 SHELLCODE So far, the shellco
Page 297 and 298:
mmap2(0xb7ee4000, 9596, PROT_READ|P
Page 299 and 300:
#define __NR_stime 25 #define __NR_
Page 301 and 302:
In shellcode, the bytes for the str
Page 303 and 304:
eader@hacking:~/booksrc $ export SH
Page 305 and 306:
which means that a small value like
Page 307 and 308:
Instruction inc dec Description I
Page 309 and 310:
After assembling this shellcode, he
Page 311 and 312:
exec_shell.s BITS 32 jmp short two
Page 313 and 314:
eader@hacking:~/booksrc $ nasm tiny
Page 315 and 316:
int setresuid(uid_t ruid, uid_t eui
Page 317 and 318:
push BYTE 11 pop eax push ecx push
Page 319 and 320:
So, to make socket system calls usi
Page 321 and 322:
push BYTE 16 ; argv: { sizeof(serve
Page 323 and 324:
00000030 80 b0 66 43 52 52 56 89 e1
Page 325 and 326:
This loop iterates ECX from 0 to 2,
Page 327 and 328:
push edx ; Build sockaddr struct: I
Page 329 and 330:
pop eax inc ebx ; ebx = 2 (needed f
Page 331 and 332:
the return address uses multiple by
Page 333 and 334:
0x600 COUNTERMEASURES The golden po
Page 335 and 336:
0x620 System Daemons To have a real
Page 337 and 338:
} printf("Caught signal %d\t", sign
Page 339 and 340:
tinywebd.c #include #include #inc
Page 341 and 342:
if(fd == -1) { // If file is not fo
Page 343 and 344:
In previous chapters, we’ve writt
Page 345 and 346:
63 if (listen(sockfd, 20) == -1) 64
Page 347 and 348: message. Shell variables are used f
Page 349 and 350: There’s a simple mistake in the t
Page 351 and 352: any program to show every system ca
Page 353 and 354: 0x080487ee : mov DWORD PTR [esp+8],
Page 355 and 356: 0x08048f5f : call 0x08048f64 : nop
Page 357 and 358: push BYTE 0x6 ; Close () pop eax in
Page 359 and 360: A quick glance at the function prol
Page 361 and 362: push edx ; Build arg array: { proto
Page 363 and 364: This program can be used to inject
Page 365 and 366: Then, from another terminal, the ne
Page 367 and 368: strace is used with the -p command-
Page 369 and 370: ig red flag. We could change the po
Page 371 and 372: of new_sockfd will still be correct
Page 373 and 374: 00000020 b0 3f cd 80 49 79 f9 b0 0b
Page 375 and 376: push ebx mov ecx, esp int 0x80 ; pu
Page 377 and 378: Instruction Hex ASCII inc eax 0x40
Page 379 and 380: eader@hacking:~/booksrc $ gcc -o up
Page 381 and 382: Amazingly, these instructions, comb
Page 383 and 384: ESP up (toward lower memory address
Page 385 and 386: eader@hacking:~/booksrc $ gcc -o pr
Page 387 and 388: At the end, the shellcode has been
Page 389 and 390: esp 0xbffffa2c 0xbffffa2c eax 0x0 0
Page 391 and 392: functions are shared, so any progra
Page 393 and 394: A quick binary search shows that th
Page 395 and 396: eginning of the buffer. When a prog
Page 397: The breakpoint is set at the last i
Page 401 and 402: matrix@loki /hacking $ for i in `se
Page 403 and 404: manual page for execve() for detail
Page 405: for(i=0; i < 90; i+=4) // Fill buff
Page 408 and 409: encryption, credit card transaction
Page 410 and 411: through the incorrect filter, its p
Page 412 and 413: This means that, in general, the gr
Page 414 and 415: Without some way to manipulate the
Page 416 and 417: With a little bit of basic algebra,
Page 418 and 419: Since this is all done modulo N, th
Page 420 and 421: 0x750 Hybrid Ciphers A hybrid crypt
Page 422 and 423: [:] - Static route to port on host
Page 424 and 425: communication channel with the atta
Page 426 and 427: e asked to add the new fingerprint.
Page 428 and 429: to be a bit hazy. The goal behind t
Page 430 and 431: ---[Current State]-----------------
Page 432 and 433: 0x760 Password Cracking Passwords a
Page 434 and 435: crypt_crack.c #define _XOPEN_SOURCE
Page 436 and 437: Custom dictionary files are often m
Page 438 and 439: possible hashes for a single plaint
Page 440 and 441: Of course, there are downsides. Fir
Page 442 and 443: charval = (k-32)*95 + (l-32); // La
Page 444 and 445: } /* Print the plaintext pairs that
Page 446 and 447: printf("Building probability vector
Page 448 and 449:
Of course, if WEP is turned on, onl
Page 450 and 451:
Now when keystream data is needed,
Page 452 and 453:
After an IV collision is discovered
Page 454 and 455:
is really quite amazing. It takes a
Page 456 and 457:
Seed = IV concatenated with the key
Page 458 and 459:
int key[13] = {1, 2, 3, 4, 5, 66, 7
Page 460 and 461:
and the key is hard-coded into the
Page 462 and 463:
9 0 | 41 1 | 73 0 | 105 0 | 137 1 |
Page 465 and 466:
0x800 CONCLUSION Hacking tends to b
Page 467 and 468:
CNET News. “40-Bit Crypto Proves
Page 469 and 470:
INDEX Symbols & Numbers & (ampersan
Page 471 and 472:
uffer overrun, 119 buffers, 38 prog
Page 473 and 474:
dtors_sample.c program, 184 dump()
Page 475 and 476:
declaring as void, 17 for error che
Page 477 and 478:
Internet Protocol (IP), 220 address
Page 479 and 480:
nemesis_arp() function, 245 nemesis
Page 481 and 482:
pointer_types4.c program, 56 pointe
Page 483 and 484:
session layer (OSI), 196 for web br
Page 485 and 486:
text segment, of memory, 69 then ke
Page 488 and 489:
More No-Nonsense Books from NO STAR
Page 490:
UPDATES Visit http://www.nostarch.c
show all

hacking-the-art-of-exploitation

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?