hlogin2

Size: px

Start display at page:

Download "hlogin2"

옥숙 전
8 years ago
Views:

1 0x02. Stack Corruption

2 off-limit Kernel Stack libc Heap BSS Data Code

3 off-limit Kernel Kernel : OS Stack libc Heap BSS Data Code Stack : libc : Heap : BSS, Data : bss Code :

4 off-limit Kernel Kernel : OS Stack libc Heap BSS Data Code Stack : libc : Heap : BSS, Data : bss Code :

5 * Stack libc Heap

6 Stack Corruption

7 ret2 0xbffffa26 parameter buf[] sfp ret parameter 0xbffff4c0.

8 ret2 0xbffffa26 parameter buf[] sfp ret parameter Saved Frame Pointer : EBP Return EBP SFP 0xbffff4c0.

9 ret2 0xbffffa26 parameter buf[] sfp ret parameter Saved Frame Pointer : EBP Return EBP SFP 0xbffff4c0.

10 Basic Stack corruption buf[20] sfp[4] ret[4] parameter 20byte byte 4 byte 4 byte 4 byte scanf( %s, buf); input buf = 1234

11 Basic Stack corruption sfp[4] ret[4] buf[20] ABCD HEHE parameter eip = 0x scanf( %s, buf); input buf = 1234 * 5 + ABCD + HEHE buffer overflow

0x45484548 1234 1234 1234 1234 1234 scanf(

12 DEMO

13 Big Endian IBM SPARC Motorola Little Endian Intel x86 AMD DEC CPU Big Endian, Littie Endian, Big Endian, Little Endian.

14 Push EBP Mov EBP, ESP

15 Push EBP Mov EBP, ESP Stack Frame

16 Push EBP Mov EBP, ESP Stack Frame Stack Frame

17 Mov ESP, EBP Pop EBP

18 Mov ESP, EBP Pop EBP Stack pointer Caller function stack frame

19 Mov ESP, EBP Pop EBP Stack pointer Caller function stack frame EBP

22 Leave Mov ESP, EBP Pop EBP Ret Pop EIP Jmp EIP

23 cdecl stdcall fastcall

24 EIP Extend instruction pointer. EBP Extend Base pointer. ESP Extend Stack pointer.

25 A BB TEST BB ESP BB ESP A A A ESP PUSH A PUSH BB POP TEST Stack TEST = BB

26 ESP EBP push EBP call Function() Mov ebx, eax

27 ESP EBP push EBP call Function() Mov ebx, eax Push EBP Mov EBP, ESP

28 EBP push EBP call Function() - 4 ESP Mov ebx, eax Push EBP Mov EBP, ESP

29 EBP push EBP call Function() - 4 ESP Mov ebx, eax Push EBP Mov EBP, ESP Push A

30 EBP push EBP call Function() - 4 A Mov ebx, eax - 4 ESP Push EBP Mov EBP, ESP Push A

31 EBP push EBP call Function() - 4 A Mov ebx, eax - 4 ESP Push EBP Mov EBP, ESP Push A Push B Push 1234

32 EBP push EBP call Function() - 4 A Mov ebx, eax ESP B 1234 Push EBP Mov EBP, ESP Push A Push B Push 1234

33 EBP push EBP call Function() - 4 A Mov ebx, eax ESP B 1234 Push EBP Mov EBP, ESP Pop eax Push A Push B Push 1234

34 EBP push EBP call Function() - 4 A Mov ebx, eax ESP B 1234 Push EBP Mov EBP, ESP eax = 1234 Pop eax Push A Push B Push 1234

35 EBP push EBP call Function() - 4 ESP A Mov ebx, eax B 1234 Push EBP Mov EBP, ESP eax = 1234 Pop eax Pop ebx Push A Push B Push 1234

36 EBP push EBP call Function() - 4 ESP A Mov ebx, eax B 1234 Push EBP Mov EBP, ESP eax = 1234 ebx = B Pop eax Pop ebx Push A Push B Push 1234

37 ESP EBP push EBP call Function() A Mov ebx, eax B 1234 Push EBP Mov EBP, ESP eax = 1234 ebx = B ecx = A Pop eax Pop ebx Pop ecx Push A Push B Push 1234

38 EAX Extend Accumulator,. EBX Extend Base index. ECX Extend Counter,. EDX Extend Data, Eax. ESI / EDI Extend Source, Extend Destination cpu 32bit

39 .

40 1 Mov Eax, Ebx == Eax = Ebx 2 Add Eax, 1 == Eax = Eax + 1

41 .

42 gdb gdb -q [binary] gdb (?). run (r). continue (c). quit (q). disassemble (disas) [ ]

43 gdb info function break reg info break, delete (del) delete [number] (del [number])

44 gdb break (b) function. skip. b* function.. b* [address] break.

45 gdb stepi (si).. nexti (ni).,.

46 gdb print [function] (p) p $reg p/[ ] [ ] d x 10 16

47 gdb x/[ ][ ][ ] [ ] x/[ ]i [address] x/[ ]s [address] x/[ ]wx [address] 16 4byte

48 gdb set {type}[address] ex) set {int}0x = 100 set $[reg] ex) set $eip = 0x

49 gdb set disassembly-flavor intel set disassembly-flavor att at&t

50 gdb set follow-fork-mode child gdb. set follow-exec-mode new exec gdb.

51 gdb finish u disas [address] [address]

52 DEP (Data Execution Prevention) ASLR (Address Space Layout Randomization) Stack Canary == SSP (Stack Smashing Protector) Ascii Armor

hlogin7

hlogin7 0x07. Return Oriented Programming ROP? , (DEP, ASLR). ROP (Return Oriented Programming) (excutable memory) rop. plt, got got overwrite RTL RTL Chain DEP, ASLR gadget Basic knowledge plt, got call function