Linux Exploit Development Part 2 (rev 2) - Real App Demo (part 2).pdf

(572 KB) Pobierz
Linux exploit development part 2 (rev 2) - Real app demo (part 2)
This will be a short tutorial demonstrating a "buffer overflow" exploit on a real application which
is freely available using the techniques covered in part 2 of my tutorial series, if you have not
read it you can check it our here:
Linux Exploit Writing Tutorial Pt 2 - Stack Overflow ASLR bypass Using ret2reg
NOTE:
* This paper will not go in depth with explanations (as this has already been covered in
the tutorial mentioned above).
* This paper will not teach you about "buffer overflows" (as mentioned this is just a
demonstration).
* I am not responsible for anything you do with this knowledge.
Requirements:
* The required knowledge for this can be found in the previous mentioned paper.
* You will need a Debian Squeeze (latest).
* Backtrack 4 R2 (Or any other distribution with Metasploit on it).
* Some GDB knowledge.
*
checksec.sh
(a very useful script).
* The vulnerable application (HT
Editor
<= 2.0.18)
If you do not posses the required knowledge I can not guarantee that this paper will be
beneficial for you.
Let us begin!
Author: sickness
Blog:
http://sickness.tor.hu
Date: 10.04.2011
Compiling and checking our vulnerable application.
As you have probably expected the vulnerable application will be taken from exploit-db, the
application is called “HT Editor”. (I did not discover this vulnerability I am just reproducing it).
You can download the application from:
exploit-db.com
or
sourceforge.net
(The version has to
be <= 2.0.18).
Now that we have the application let’s go ahead and compile it by typing:
##############################
./configure
##############################
This is how the configure output should look like (make sure you try and make it look the same).
Figure 1.
Author: sickness
Blog:
http://sickness.tor.hu
Date: 10.04.2011
After obtaining the same output we still need to make some changes in the Makefile to turn off
NX, we just need to add the “-z execstack” flag in some lines.
Figure 2.
##############################
make
make install
##############################
We have your application up and running now let’s see what protections is has using
checksec.sh
(again, make sure the results match if not the exploit might now work).
Figure 3.
As we see there are no protections, let us move on.
Author: sickness
Blog:
http://sickness.tor.hu
Date: 10.04.2011
Open application in debugger and trigger the exception.
Now we open our application in GDB and send it some junk to see it’s behaviour. After a few
tries we see that the offset needed for an exception to occur is “4108”.
Figure 4.
Once you send the junk the image might look something like this (could happen only here).
Figure 5.
If this happens just type in gdb “shell clear” and press ENTER.
Author: sickness
Blog:
http://sickness.tor.hu
Date: 10.04.2011
Ok so far so good! Now let’s check the registers and see what we have.
Figure 6.
We have overwritten EBX, ESI, EDI and EIP. If we take a look into ESP we see that the ESP
points to our buffer which actually goes a little higher.
Figure 7.
Author: sickness
Blog:
http://sickness.tor.hu
Date: 10.04.2011

Plik z chomika:

Inne pliki z tego folderu:

Inne foldery tego chomika:

Zgłoś jeśli naruszono regulamin