Linux Exploit Writing Tutorial Part 1 - Stack Overflow.pdf

(846 KB) Pobierz
Linux exploit writing tutorial part 1 - Stack overflow
WARNING:
This should be tested in a virtual environment, turning these security features off might put
you at a higher risk of exploitation!
NOTE:
This tutorial will skip the “exploit writing 101” as well as the ASM basics and GDB basics if you do
not know these than please take a look at:
Assembly Language Megaprimer.
Corelan tutorials.
GDB Documentation.
In this tutorial we are going to see how to make a simple stack overflow on Linux.
Required knowledge:
- Understanding the concept behind buffer overflows.
- Basic ASM and C/C++ knowledge.
- Basic terms used in exploit writing.
- Knowledge about GDB (just basic stuff.)
- Exploiting techniques.
Without having knowledge about those mentioned above this tutorial might not make much sense to you!
Author: sickn3ss
Blog:
http://sickness.tor.hu
Date: 17.03.2011
Let’s start!
Before actually starting we have to turn off the “Linux
ASLR”
, this can be done by passing an integer
value to /proc/sys/kernel/randomize_va_space.
Figure 1.
After we have turned off ASLR, we have to compile our vulnerable application:
##############################
// I am a vulnerable thing.
#include <stdio.h>
#include <string.h>
int main(int argc, char** argv)
{
char buffer[500];
strcpy(buffer, argv[1]); // Vulnerable function!
return 0;
}
##############################
Now it’s time to compile our vulnerable code, however we have to disable some protections when we do
this.
Author: sickn3ss
Blog:
http://sickness.tor.hu
Date: 17.03.2011
Let’s see what happens if we compile it normally, load it in a debugger and try to trigger out buffer
overflow.
Figure 2.
Author: sickn3ss
Blog:
http://sickness.tor.hu
Date: 17.03.2011
Why is this happening?
Well gcc 3.x and 4.x by default compile code using a protection technique called “stack-smashing
protection” (it’s available by default in all the Linux distributions by now I think), this protection technique
is used to detect a stack buffer overflow before any malicious code is executed.
How does it work?
It places a randomly chosen integer in memory just before the stack return pointer. Normally, buffer
overflows overwrite memory addresses from low to high, so in order to overwrite the return pointer it
will automatically overwrite the small integer that is placed just before the stack return pointer, SSP just
checks to see if that integer was changed or not before the use of the return pointer on the stack.
We can turn the SSP off by adding the “-fno-stack-protector” flag to gcc when compiling.
Now that we have our vulnerable program ready, let’s open it in GDB and try to find the offset needed to
trigger an overwrite.
Figure 3.
Using the “run” command actually executed the current program from gdb with it’s full path (/root/
vulnerable_1 in this case) followed by the rest of the data that we want to send.
As we can see we have managed to successfully overwrite the EIP!
Author: sickn3ss
Blog:
http://sickness.tor.hu
Date: 17.03.2011
Let’s take a look at our registers maybe we can find something useful.
Figure 4.
So using “info registers” we can see all our registers and with the “x/FTM ADDRESS” we can check out a
particular register (in this case ESP).
We notice that ESP contains our evil buffer, but how does this help us?
Well if we could find out the address of the ESP before the function strcpy kicks in and let’s say subtract
200 bytes from it what would we get !? We would get the address of ESP before the last 200 bytes of our
buffer get pushed on the stack.
Author: sickn3ss
Blog:
http://sickness.tor.hu
Date: 17.03.2011

Plik z chomika:

Inne pliki z tego folderu:

Inne foldery tego chomika:

Zgłoś jeśli naruszono regulamin